Analysis
-
max time kernel
2300252s -
max time network
130s -
platform
android_x86 -
resource
android-x86-arm-20231215-en -
resource tags
androidarch:armarch:x86image:android-x86-arm-20231215-enlocale:en-usos:android-9-x86system -
submitted
19-12-2023 23:38
Behavioral task
behavioral1
Sample
6d9b63f3df43164faccf3be53730253d4f5f3d9ebebbc70483ce037f7731ae59.apk
Resource
android-x86-arm-20231215-en
Behavioral task
behavioral2
Sample
6d9b63f3df43164faccf3be53730253d4f5f3d9ebebbc70483ce037f7731ae59.apk
Resource
android-x64-arm64-20231215-en
General
-
Target
6d9b63f3df43164faccf3be53730253d4f5f3d9ebebbc70483ce037f7731ae59.apk
-
Size
989KB
-
MD5
ae1c47a260eaa74b9d4d7117ce67499d
-
SHA1
2ce606a7998a931257102719b111fa193e1f8d08
-
SHA256
6d9b63f3df43164faccf3be53730253d4f5f3d9ebebbc70483ce037f7731ae59
-
SHA512
f998f0ec63ac7001a249f7ddf6a829277e1cd565d5e211f15ba60e589d4acd20c035fe4be8e6d8b134688c026a58f773624561e87c5927d26b6365f998d2eb32
-
SSDEEP
24576:FsBc0rZkwdxnIvo7bYIaalsd/wDgjfGXdUqBYEr:FsBcq9AA7Lliw8zPqt
Malware Config
Signatures
-
Requests cell location 1 IoCs
Uses Android APIs to to get current cell location.
description ioc Process Framework service call com.android.internal.telephony.ITelephony.getCellLocation com.dotgears.flappybird -
Loads dropped Dex/Jar 2 IoCs
Runs executable file dropped to the device during analysis.
ioc pid Process /data/user/0/com.dotgears.flappybird/app_cofl/cp.zip 4358 /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.dotgears.flappybird/app_cofl/cp.zip --output-vdex-fd=105 --oat-fd=108 --oat-location=/data/user/0/com.dotgears.flappybird/app_cofl/oat/x86/cp.odex --compiler-filter=quicken --class-loader-context=& /data/user/0/com.dotgears.flappybird/app_cofl/cp.zip 4239 com.dotgears.flappybird -
Reads information about phone network operator.
-
Uses Crypto APIs (Might try to encrypt user data) 1 IoCs
description ioc Process Framework API call javax.crypto.Cipher.doFinal com.dotgears.flappybird
Processes
-
com.dotgears.flappybird1⤵
- Requests cell location
- Loads dropped Dex/Jar
- Uses Crypto APIs (Might try to encrypt user data)
PID:4239 -
/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.dotgears.flappybird/app_cofl/cp.zip --output-vdex-fd=105 --oat-fd=108 --oat-location=/data/user/0/com.dotgears.flappybird/app_cofl/oat/x86/cp.odex --compiler-filter=quicken --class-loader-context=&2⤵
- Loads dropped Dex/Jar
PID:4358
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
52KB
MD53240ae918f9c4ab4833dafb6de17c8bf
SHA18bbfd576f94154c65755cee688aaa6ae6d76aa01
SHA256bb283db0620b99956872a5a45e80076f396380cc3844bb1bc2b1ed3ba2907f33
SHA512be8c0faee4b6be9cbec5a615a254114f7a835847df57516deddd2beeccb7d4225bb6d97cf53a3c72cf8d501ce4aa8fa0e5511f4f6e1a95170e17ca8815204f25
-
Filesize
1022B
MD54b9b64c9dc6d13733a9ac3320ac9f53f
SHA1a02218ada2417dd85a3f3a22db31d30c150440bd
SHA25635dc398b4409f3037ef52c21e4674a283e1cc0f71894704a4583752b91fb0cf1
SHA512b819d1ca851815549bff946c1950539db7d199b3b04be0f6a6aadb1602225e895ac7283c525733e9e421646a6f2da2b732ce3cccb8461e93574c04e5d64b31b7
-
Filesize
979B
MD5db45ab95930456e6baddab4e6fcbe712
SHA1fa0c152e3afd7fa7026b0f688a3c6ea2c27b53c8
SHA2565c3755a2f79003a4702ee79232d59efad418aa83e30b2691256a44457b0c602a
SHA512d658b23e0687867f44567ae4dddb1a01cebab15508032ff7336458fa226e592db84217c852eaaa2132226cebd4bd7f74b8144a78aa85f77e979a7a1f104b8582
-
Filesize
970B
MD520c4a831398dd9ebd8dba380a2e7857a
SHA1c6db26860686a65f5f402d29d98b358630c10e40
SHA25603353442682b665da8ccb439ac22407ed53cb499266361581a818d3b267b356d
SHA51285ca28c7eace2766c4a5d8c8b1df4dc81cdecb241e8d129b9e43ebdcc2f3c7385aecf12afd02755bba850c19260f07635199ca606f32a8ea0d71355f64e4e423
-
Filesize
1KB
MD5ffe93c95f1ceef187397bb763c992ccf
SHA16b082b7f6c55acd0987611b3b9a5aac9a5b06d67
SHA25606dcc9066f53227b50faa763aed62944dc8d5a1612beba619caae2b1a81b42d9
SHA51210693e4df14b0212798817d20cde37c88226353f4389968a81607fe7420244cabe2fb2074627e5194ff2c06cba0cb068598ab5078c0dbf8dbe4928f86ced6161
-
Filesize
1KB
MD5a7481cc1f04ff397669d5313711676b9
SHA16a8a1755f8bae8c1c4236420de731ac5e6479df1
SHA2567bb0b4de65d49b7256c1083332005aac1f40eb496fe16996657721570b427c0b
SHA5126cad2566cc0c5b2247a2309180659a883dbdfd7e546c75bdb0683e3102ccc833d63255a5776a466880cba7f7f12666c493e84043c8512ab929dbf357c32609bb
-
Filesize
1KB
MD56a976eab4bd6a204fff19f363a3e0fad
SHA17815e2d7905bb25ecec99c6491e05e498baefefb
SHA256a2520bd431de7d71c9453f9e808369c694b1214b4d13759fc0a08d5af681f796
SHA5128f0537ebd9954fe5792421f15e499c71e009d26aeac810672e8d3cce982c4291c64917ca36651f4c7f33f4bd32480c9eb3ee6ee7ffd82d2e08d8147d850ae285
-
Filesize
1KB
MD5135b4b02c06ce896c0289c06931523d7
SHA1219d7fcb9a47b14dc724030a5b22b00e4912c419
SHA2567bc734fa69ef36df3ed4d3926657a52eee7f8448842586a3320804b7f86c47bc
SHA512e9ef72d8a52cf365cc0d32d6ac9d333b3fc116b70e87d4279249efbcc0c57bae2951c4c6ecf2e675ab37f6ebc4374898cf75ca3ac11aa3286136b6770d680fa3
-
Filesize
1KB
MD5cd03c81961866339359a8862cd420751
SHA14356e958c4b333453a187b13cfb8e4951e85b5c1
SHA2565d81cceefef430d84abee2aee1a655e975e638eb6e90d9edeaf70df18f761453
SHA51229c6a83607ef938c8d74031781008075f9e29f28381893ce565d0d0e5e2193657264deb7752709f124bac8a7625ecda18a90763f8b8cccd48868105fde62846b
-
Filesize
1KB
MD5b61c2cbfc113d3080881c1a6c805de7f
SHA18bfb29fbebab3ff36faa5f6d19bf7bdf57608dad
SHA256740a7a55675de72a6d165dd1aea7f15e6744f08e5131c2abea7e6e02ac4752c9
SHA5127cb6ca09b180adeb87552b9b814ec50723d2f8e909a5aa1c3c63526bfe90043c0f6f97696b0e40d33c045a6d7f4b4df711ecda2a93839b9409f69c84491b3151
-
Filesize
1KB
MD5144bfaa9628bdc547f92dd8ce04960db
SHA1f60797400afdb88cc1a7b26eaaf5c18b7d34e3c3
SHA25656707731bc7b76b806d9db7ec7e73173d0ba7c5acf22c8c040fb1bbb0d07090e
SHA512071111562423e811333afd56dbd18fb68e0720f41936c42d266f70d041862560b363aa202ae24af40e9ca611d7f3eb996ee4184834097e85fbda1e2d36291f4a
-
Filesize
1KB
MD5c56a569d3e2cc40deb8ef6dd9c8273df
SHA1fcdfdfa5f883afe7dea8a08b4e22d66b243065c5
SHA2560e603b7797d42f1eadf5ea14499460e84e6525df6bdc4ee1464e00789c10c057
SHA512b1549f4667c2765feb11d38469a5bfa4f599609ff519e65b73fc01521886cd57e7f30c2c43655d2b3af8665c77cde4f3a07e1e21f7dded059dc22ac60cbdb4b8
-
Filesize
1KB
MD5a0314cf413a6efe118ce49aabe7d323d
SHA1a8134a8d8506f5d44cf084b501a73fddd194fb8d
SHA2563d723fa2d6bef03b2f44e09486edadd7eee392e14da4bc9435521fdb9d5a1537
SHA512e5decc76e4461aa063571e45e9d1e47fcd8586311b726c1d1bb60e327c43ef8e104f4e1614e9ac656d5ae0e9095042e230f7245c7a3f0d89d515a2fad78046d3
-
Filesize
1KB
MD55b1fe1609131bc828527fc35dc4c7353
SHA139b6169e1e2a7fee0e56e421184d81f071d3693b
SHA256ebc4e49b42208680f7d5b9ebae07bed1712a1ecb6443dcf5b09171faae0e0eae
SHA51274ebfb919c0af6fabc52228d7b501c632c95d28b91e0ae87109d9da5f422471f96190858f26d097bc502a8e673ccf31e35ab2b15910f7a43e8c48fac64a0c8e7
-
Filesize
3KB
MD567d8c02c18a4eebb21aa28ebd88d7a8b
SHA1f31fe91485bba4da727e9a0d0525c7417d6c72ee
SHA2567b341f9b1ab0a691029b44f9b1d64cf74fd72ad0c74772964645c79f687402d0
SHA51273c14d96680105ce3e24ba0667cd2452848f9c7d2549e937667c25bcce01a4d9207a78f2dcfc7c09cdb39f87f079c7847ceacbed36cfae55013126ab3bdbf5fd
-
Filesize
2KB
MD56edfc3ccf80c5cb2c25bf82dd5e78c46
SHA10f71fe007ebb0479e42905c6a78f80b0a109a03b
SHA2562225deaa4204ae88206589b390dd277c9e24ab0a68338cec19eae600b854fe32
SHA512a8e4adcc0cd0867e8bb2cfe43a04c3a8e8a84de99ad7150c339c4dab1e81c8dab87af17fe7b7bbea41d54c6acd6214224f07ba456a8dc0fc8c33b3782e83ba4f
-
Filesize
2KB
MD5089965b9fb96326ad74e361a9a524e4b
SHA1528cc6c7a10de9f525919a477c9e20d6b6e93d55
SHA256d7c9eec30a30c3da3e80d2f7db31ae1ceb542c590f5ce8abaa77f39a16a0cf46
SHA512b19f99764693882cb845b024bf5ef42121826dc92047532df19ff3e236c5e5e57e1390b942182275cc906fea83c541190325d21c88f70bd1041288b17489a579
-
Filesize
1KB
MD5c64af13b874ab8cfdac99f000c29a3be
SHA1e5274173c7721f8c77bb5da46fc94f195abb4924
SHA25667af721ddafee67f3eea6241bcdb5b8c1315e8ed1b8dc852646cde24fe040516
SHA512d59c85b4576152848427a74214c7b979c576f5cc6978430b9d7076f50cdf8957d8256eccf55aaba2bf7f80da2a7a2b445a26758aeaf3e889ae1c84a3fb2185c9
-
Filesize
9KB
MD5c34bb6ce3d7def12e8af79e87a6b5173
SHA199e8103027a7bba73b736fcded9d0d91b49e4ed9
SHA256daf75ee4e642b335cf1918ac9678502bace139f76645eedde7eaca4f296b7e57
SHA51258735b6034ff6ce1974aa0a48952100345b6bdf74a4dd083925aa87b0882e1931ff8608d03d0854c9de23ca409e5726ddc1e8313339181f57312bee0804ee2b7
-
Filesize
1KB
MD56fb767d2563a35f3c0e362a5970ffe1e
SHA16d3a8fdbd7ced06a363517cd6cea7a7fea16c269
SHA256534fe818efbaa752826c53f1b63d3ecc1b647c8a9f7970012e316cbce5fb5ae2
SHA512ab989e8b01b9d397cb2968dc8191a9c2c6fdf19947b30b96cd5266afc6fc330a318de8c914d34adef98caffd151a0bc29fb130bf11c5638e97b3ff15c723fc2b
-
Filesize
2KB
MD528554ef38f282f89a2f3b298157fc984
SHA108147f2b5a83fd07f5acadb43598480a13d3fac1
SHA256b4034e26cfd742433a0b59676bf73a78d93d413decc891abf3d34486160d307b
SHA512cd31cd81a7c37155f540c1b636cad9ea198860952d79f8b3d39dac661c2e7fa82e1398830c7aacfa6904e4d4cffa6f5f1d906dabbf97091f3e38a65fb5fa51da
-
Filesize
1KB
MD5590dd3230f50ba57b7a828cf1ad04aa0
SHA1d8cd7d9cca6d011d3d4f6cea8c76fc3c1a7898ee
SHA256d67f2ece3ab36175096b96cf121f83b0e44d7bf96fc5c8315b0c26ceb6d53cb7
SHA512449dd317e61e063b342fe5491f8f09344699ec92a7e46aff6eea231472c55a0ee772ca875f46900de7f20c9d760fe20a662aea42551328c0f3cefe9bfaf82b79
-
Filesize
1KB
MD52bf3d7d7ffe4a54396979c2802e5a0a7
SHA1631def5dc6bd48080d51d3482a85c470b291c316
SHA256ec1601e7e19b69d6d6bc8f18738698a6b4483a4f1ac546215dbcff9cc74acf7f
SHA5122a9a95a9298c59a90b7234343f01b70219653e4d43217c83dd3dcafea84b96727d1e5f40ba035c36fb4dc6a83478fa66d545a2cf8221aa2da1ab9565b3deae79
-
Filesize
1KB
MD51c4e3c1de688a5cde892bd74eec4bfc1
SHA1bade0d4743822214421dc664449c0b0d94d69aae
SHA256ee7abc5886a058b4436aa0a53c6be535fc0bd3a6832f2b0b0e611473667dca5f
SHA512ccf419b266d7fcdf4c6696963c657f7138a59b06a4fdd900effebcaac0b162ddb5e9135f5032a33e2b3ffc17642065600d9b9292005e200f5cd8e79b17968f24
-
Filesize
1KB
MD59dfe941765a15b163eeb46b49cb4e89b
SHA1caad3358c1706f28624e10616cf6d26a45b2dd5d
SHA256d92d42135d59f97d35cc2d553b7bc79f19397a40cae9ac971a86def6fbc9167f
SHA5120a38e4a6187fac65999a9a27ff4a917ab6dd023587ae5b0e33c95a502e7e93626ac3cfb48affaacc274b5f7fa118f483a627e70288757308041ac67e3337a4f1
-
Filesize
1KB
MD5ffaccc20bf244076988df00a6bc20b06
SHA14a7176527cca9e9a862cb12485cf02c49c228913
SHA25671d16959b999e8251ea5ffbf0075a43724b02f85ca34e3ee82b31935537c9a9f
SHA512dba973767cc9e9eec698232e9f7d057bdf5464c8d70fcef3e6631ad72d9e62ab4cc08169db2e3927e2f3a870787ee60bfb4b26ec1ed8c3fd30e84aa38afd65c2
-
Filesize
1KB
MD58487656fa992a7c3603773e0b1b1d7e0
SHA1ac740cc2ce2ff0729b70c26c70ac0462072d1b81
SHA25612b5a8c075e94cfd69d4a3ea6e62552d7e3e7e2ae5f6e69b7fc4ab5a6c9635a8
SHA512b6be96693719978dabdaf05e3f733925b126959bf8ec0096775d76eeb08a6a5fd56c2ddb4697d81a8da9ef1e00524348c0ec7aaa36ac5302d89dd51db6f08fad
-
Filesize
1KB
MD564e607b18ceed3c184658ad0bead2c87
SHA1ce0da694a61264c3dc52a42c5e4eef67c267330b
SHA256ad6e950cabd47d19678ed9e243a954c428e11aefc17b14b03929ff9e7379a7ad
SHA512a37c72b611a02dbcf6621904e34bd80fa2f0c71b5ff0f229cff91794924d3a8907d5971bc3dddc8a81536e78ec7b92cc1ca4c782ea91bfd065defbd842cdf63e
-
Filesize
1KB
MD5153c4a358fd2029b62d88c5abc8315f8
SHA1b8db469b4ed0798040ed2cd7618fb31c143bb733
SHA2566d7b544ef6694a9440ab7b2fe902a67480f4cfdca37156b12db1ecb4bffd1945
SHA5127cf959e5fa3bab95af3efe74e56b82d48e393b5ef1b733fd37e2f5f62611083fe58ace340a3b0bfea2227e94cae921714a82bcf64d1bb5834ca73ef088876850
-
Filesize
4KB
MD55101a78d00419574d0dcc0eb1f4b75a1
SHA1c4142d79270fddb27f24d6e8e8b61e9837b3de48
SHA256abe1bd342d024dbe2e1e853af11ce74d2e3d9286a8e44c6d94b4b5e4e7abf999
SHA512cbe4d2438dbde51d36c19d26afc826d37d8221bd76a6641e93e6c2e6e4e124fedf8dd5ae10c90c882ae0220ce4647d7dd469c53ba5a8c2769e0a4983c5df637e
-
Filesize
1KB
MD51533f88b71966664017deaa78437e057
SHA17b68a5bc7a6808a041c05ac7adc5da0fd378aecd
SHA256ba11714200029dfc64b90b9953f80cdc49f30eaac9bbe8597d949f7a89b52b8a
SHA512f04b79396404b4cf1cda6ad3ed7af3137b177d0da249d59a818c9a8ddb1e80cd98d078bfee9c352117f8c62303f08c9b3565bbd558a08d5aa07cf07527318728
-
Filesize
5KB
MD5e50c867a1725d1a77477d0a3931266f6
SHA11561a6d26dcc43254237e0dd99a8c1a8f0ad7d67
SHA2560a549f08924e57ce9a5142fae8932efc57eca3454ae80ba8af57553f834be8be
SHA51288faee49b0db9a401dee69f8fccb96fd2b671bb646a3cdb91d5f53a110e470d9fe027cd36684c77b0aed4e0f19d71522b1b88551ade135d5828ce4f41ad4c28f
-
Filesize
934B
MD583f9aabf34554a65a8f47514703ea69f
SHA1bc3097db92c0f1821d60779d9b1f712cd0cc7866
SHA256a5d81d5357d00dcff6099ee28f989711e289cf1e41fc6ef0903640d5ee73fd6d
SHA51211fd5b05b830a48f658a9767556b8dcdfefc864bbe0ce5278f40c272879326fd03100cf73e2d762c3ae674f2eafc2ae5ea0285e690c4c18c7721ddfeb447bcbe
-
Filesize
1KB
MD517f5c25477711a64b0dac419b8d68c0c
SHA1475301f9d8143ba1548114d1de9272a18298a5dd
SHA256b0e6d8458712cbb246fd4022cefee92796e55858a2c4f25cdec4dead894006a8
SHA51209050759dca1837f59ab10d8c2531d986483ce50af2ab5038aefba3e5255fc8f67db1412f50717022b2c54fc39acc5ceab7ef3dcd51b38a61086ecedb885d478
-
Filesize
56KB
MD5041fe7117a6f3cdf3c3ce3116f3068f3
SHA179b213aa87051fc75a924335a3947f031f8385da
SHA2566a9560771ce9e947d996e8f9c6cea1c8577dcf227bfdea3efbc533d689d911ad
SHA512ece73c2ae75819a2b918cf76a49cb07994a489857a645ca0518c1be914a17fd9d474714ea9d75d8118a19399e7ca9a14c576befee8d65d356362ec73ecd0179d
-
Filesize
1KB
MD5a4b86908ed245d9a90836b1326d8af05
SHA10e8752980bdff335d19844ce4a19978e7fe0e528
SHA25695eaab66660ecba11ae7d887f653863c2b389cc8bf8da7c9cfc11aabd2fc1cb0
SHA5124c626a6b1b0538e29391dd0f13773096c91bddd96833be987c3e8c2a903a7b7eac62c60b7727fe6b2dd8f1a802e552caea04b154a927f0d61d875983d2ab4619
-
Filesize
2KB
MD5d80f6d032778b02d10a9c9a2f1a24714
SHA1e34d4ea9618b1b499b65032723ea029ab3998500
SHA256ee2de01a238f9e1834f9f9934dd1f5b267bdf9747965641d2fd636d740041f9b
SHA51234fa52d41831142f86999ac407aafeb2b69bb4cd45ada9f739be84c80deb0414d11d6784f385eec287e4f6b5bdf29ba1c9a6a77c07707d66a73c60eb389136e1
-
Filesize
120KB
MD5e50e41da9f35036f5a2d00f34b70533e
SHA1513d6c904237186dc567368e86def8cc7a1e154a
SHA256053e24109c0b7048d5b36e0b4c5e2dde31cf574f1a0422735778653bbfcc9bf9
SHA5129df92d21f10efa1d536556e16ed9dfa231244f56735cfba3ee47c65928efb6d0ab883b6d716c10dd89cd4fa6a3538fa6e97abd9a906f6eec18af6ddb65cc414b
-
Filesize
120KB
MD5b78e6d6c58ef53a5d2a84ae511ba974e
SHA17d024bcc4e68f6055752a887ece0ac951115a64d
SHA256a1106d9a5a83b2bfdd3b879e2b893fc6d9160ac677690420cab209179e32cf1d
SHA512dd02c643d1504463171dd389208c6ffe10da583898abe6df717ca57ee98ee90a635a6d3d86ccba23ffb76995eb2fff6e720ed605ad483c00028ce401e63187bc