496e20eb04c7fb0fd64a1d3b519cb2515656e0486253f376176fdc996efebd16

Resubmissions

12-12-2023 15:01

231212-sd3ecafaan 10

11-12-2023 14:18

231211-rmn3mshaam 10

Analysis

max time kernel
1497319s
max time network
140s
platform
android_x86
resource
android-x86-arm-20231023-en
resource tags

androidarch:armarch:x86image:android-x86-arm-20231023-enlocale:en-usos:android-9-x86system
submitted
11-12-2023 14:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

787d01d67c2a0d4df7f100c8550e92b3.apk
Size

5.6MB
MD5

787d01d67c2a0d4df7f100c8550e92b3
SHA1

e71d636f44d4b5240c1d743d2c3164ca7ee0fbb6
SHA256

496e20eb04c7fb0fd64a1d3b519cb2515656e0486253f376176fdc996efebd16
SHA512

a86c7c7ca152cf49273d3d157a04156a30e42b366b7ccbb2bf078cbdd7612862c8d520d1849f868c3dea26ea9f9951e2020686aa12eeff8f42457d554282b112
SSDEEP

98304:jWvbn+hU4MIVGAxWWCICz95kP5zC/kRnvTzXDW640lfitWBacyjywQpHuGc4qL9l:JU2YnkRnHXDWx0RiQdyjynFAL9l

Score

7^/10

Malware Config

Signatures

Loads dropped Dex/Jar 2 IoCs

Runs executable file dropped to the device during analysis.

Processes:

com.ahzmpwhp.mpjvegk/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.ahzmpwhp.mpjvegk/app_apkprotector_dex/xvg6Fh1Q.insta --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/com.ahzmpwhp.mpjvegk/app_apkprotector_dex/oat/x86/xvg6Fh1Q.odex --compiler-filter=quicken --class-loader-context=&

ioc	pid	process
/data/user/0/com.ahzmpwhp.mpjvegk/app_apkprotector_dex/xvg6Fh1Q.insta	4291	com.ahzmpwhp.mpjvegk
/data/user/0/com.ahzmpwhp.mpjvegk/app_apkprotector_dex/xvg6Fh1Q.insta	4318	/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.ahzmpwhp.mpjvegk/app_apkprotector_dex/xvg6Fh1Q.insta --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/com.ahzmpwhp.mpjvegk/app_apkprotector_dex/oat/x86/xvg6Fh1Q.odex --compiler-filter=quicken --class-loader-context=&

Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

14 ip-api.com

flow	ioc
14	ip-api.com

com.ahzmpwhp.mpjvegk
1⤵
- Loads dropped Dex/Jar
PID:4291
- /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.ahzmpwhp.mpjvegk/app_apkprotector_dex/xvg6Fh1Q.insta --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/com.ahzmpwhp.mpjvegk/app_apkprotector_dex/oat/x86/xvg6Fh1Q.odex --compiler-filter=quicken --class-loader-context=&
  2⤵
  - Loads dropped Dex/Jar
  PID:4318

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.ahzmpwhp.mpjvegk/app_apkprotector_dex/xvg6Fh1Q.insta

Filesize
42KB

MD5
8f09f8485aad3dba01e6d707f2095191

SHA1
e0bf1f3012a31f60b75c27b074f0d324d2661edb

SHA256
568d92355a9eaa64f7e55a0930ac350b65243a4f8d375938b1be74f722bc8c8f

SHA512
c67de16641288bb40a4a9898fa3e9cc8d4bd5f7ca017a57be5f2dced4537910fe1dde75d636403c69b567b9a2bbdc9bdfa7dc5ed00614be78b6bb644654edbc9

Download Submit
/data/user/0/com.ahzmpwhp.mpjvegk/app_apkprotector_dex/xvg6Fh1Q.insta

Filesize
1.2MB

MD5
0e3a337a1a508e918086d9f244ca4831

SHA1
9df8518145607042363ef820f58d776204a1506b

SHA256
87a9505f964c5bc6287672ef2a3b05ee8b1d067d44484fa79ed7294840833bd4

SHA512
f03ac7408a9f76bd7ab89c8e011942d25cb1fcef8041924188127948dcc7f3abc09892b53e8891fec1a115a6c6de3626234ec6deb0fa7a8c5329c0d853835a76

Download Submit