Analysis
-
max time kernel
2187330s -
max time network
157s -
platform
android_x86 -
resource
android-x86-arm-20231215-en -
resource tags
androidarch:armarch:x86image:android-x86-arm-20231215-enlocale:en-usos:android-9-x86system -
submitted
19-12-2023 11:01
Static task
static1
Behavioral task
behavioral1
Sample
0f2ce9a46ff195da3bc4085d6aca1203.apk
Resource
android-x86-arm-20231215-en
Behavioral task
behavioral2
Sample
0f2ce9a46ff195da3bc4085d6aca1203.apk
Resource
android-x64-20231215-en
Behavioral task
behavioral3
Sample
0f2ce9a46ff195da3bc4085d6aca1203.apk
Resource
android-x64-arm64-20231215-en
General
-
Target
0f2ce9a46ff195da3bc4085d6aca1203.apk
-
Size
4.7MB
-
MD5
0f2ce9a46ff195da3bc4085d6aca1203
-
SHA1
8c8aa0e4da20427bc6d3be160637e98bd7965fdf
-
SHA256
6ec2c5ddd89dfed4d066bf6ab8e7576614b4ce49479898a0aad86835661052b8
-
SHA512
56401772711efda6184713fdd173c62312a2e528a12df001678366520ff2c5810ff7721e0013fd837b4ed164e8dee8b38f32f602404de6d0ac2577bf56b2f725
-
SSDEEP
98304:Yzhqka7Qm735bxNz3e9h+85DOF84FeGxLs7/QwPHth:2hqVRprzu9h+84I7/QOz
Malware Config
Signatures
-
Loads dropped Dex/Jar 3 IoCs
Runs executable file dropped to the device during analysis.
ioc pid Process /data/user/0/com.ResepKueBasah.oscadroid/cache/1582435991586.jar 4351 /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.ResepKueBasah.oscadroid/cache/1582435991586.jar --output-vdex-fd=117 --oat-fd=118 --oat-location=/data/user/0/com.ResepKueBasah.oscadroid/cache/oat/x86/1582435991586.odex --compiler-filter=quicken --class-loader-context=& /data/user/0/com.ResepKueBasah.oscadroid/cache/1582435991586.jar 4244 com.ResepKueBasah.oscadroid /data/user/0/com.ResepKueBasah.oscadroid/cache/1582435991586.jar 4390 com.ResepKueBasah.oscadroid:Metrica -
Reads information about phone network operator.
-
Uses Crypto APIs (Might try to encrypt user data) 2 IoCs
description ioc Process Framework API call javax.crypto.Cipher.doFinal com.ResepKueBasah.oscadroid Framework API call javax.crypto.Cipher.doFinal com.ResepKueBasah.oscadroid:Metrica
Processes
-
com.ResepKueBasah.oscadroid1⤵
- Loads dropped Dex/Jar
- Uses Crypto APIs (Might try to encrypt user data)
PID:4244 -
/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.ResepKueBasah.oscadroid/cache/1582435991586.jar --output-vdex-fd=117 --oat-fd=118 --oat-location=/data/user/0/com.ResepKueBasah.oscadroid/cache/oat/x86/1582435991586.odex --compiler-filter=quicken --class-loader-context=&2⤵
- Loads dropped Dex/Jar
PID:4351
-
-
com.ResepKueBasah.oscadroid:Metrica1⤵
- Loads dropped Dex/Jar
- Uses Crypto APIs (Might try to encrypt user data)
PID:4390
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
9KB
MD5e8e0527a01aefdb89afd2c508f131da1
SHA1f1103e6b260c657ceb3d95f1b023af3fda8b133a
SHA256f809447486f89fcaa74f87e06d126d103d37eb2b3157e88f2c06d989b2c284ce
SHA512fb53683a83f1068d0f94567b156e6a8910c45b1b5f33db919f7e0b9c55eab28507a235ef76d44d5b549599ea3b54dbc00496a633339d276a80f395da938d6d34
-
Filesize
148B
MD5a3b78d197d786c13687c3f0f89703bd8
SHA19967f0726b6b1ed3f198904547b81920f8329621
SHA256c5e6754556dbe01b055066f23c28ddaaf5fe67cee4baed00d59dc993335b3d97
SHA5129a47c9bb977edec9d29d22f280e0078ca931a722eaecc2b085c6b5aaf6246d17a6ad07c9faca45070bb5b89a3ee6cf896f5e2c7e73fb033e3ac57471df70a8b1
-
Filesize
164KB
MD5cce63bdffb9a554a22ffe684cc0421d8
SHA1e93e0d0a64518fe3ff27653f793efc89e0acb7e3
SHA25692e6b8014f0aa135e1476253caa2b9bdb55ac83958f59363a286a727863826c1
SHA512fd0c9051d03ecfeb795e290a50d80658fc08632fd5828d63476a639bcc13c17ab9202eecf0848beebe5698a04ad3b8c2ff8990f051f67fa22ef7f73c2452b057
-
Filesize
28KB
MD5e11a2ee0267e3c2f33792bfa8d29823e
SHA1df304335886024163fdf9fbd8181780f445e4f4c
SHA256ca1d9bb35e35323d6d4d2f19becef95352f6b589539925e3cb127b7fc0d57f73
SHA5122288452211f964e51ae5e1d2b6ec800d6d07a063b85b9433b0189b509e4219d9ee55fd6961223e306b3304d95af5511ada23caf2ce910cfef291aead11db12ee
-
Filesize
233B
MD5b03bd605e26b5f5147707acac833cb71
SHA1d09b612a79200ac03a2726dac123872b8350f7b3
SHA256253f1a7a691a5ac091aab7344bceb4a482e82c66d12847a4948388d2f865f00a
SHA512ea958d48841b025339c4803a7cfab8a483552850e63b1f31b759b6e1e88b0b304f0d856a479e306f6d61567b9376580f37b08eedd5f6c75c404e200965232844
-
Filesize
197KB
MD52ac9ce152af7ab88c8de88b0fc752a4f
SHA1bd021af40a52adcfae76b50caab363f9dd262352
SHA2564574d0e81c4c886fc76609a02fc75793cddbce11bc983513fbb05f8a9ec40848
SHA5126128b7def6767e6df564fe4111b16599c2c94ea0f628423d91f29e22cda0ee449eb3efb7bdd5d2edd28623965ac95569d6ec82b42280726450dcd3b78e96c7f4
-
/data/data/com.ResepKueBasah.oscadroid/no_backup/db_metrica_com.ResepKueBasah.oscadroid_20799a27-fa80-4b36-b2db-0f8141f24180-wal
Filesize96KB
MD525a1e7445c573472ccadd115a2a2b18a
SHA1137febef5cf7ff26933f84f4abfe85941a7b0ce2
SHA25607404bc9d65da39c143d94bff94fb54117c8fd4528a53ddd8b7d5c9da696b3e3
SHA512957d01c24d6b38610691de0695e77f54b778834e9b0162f9f32b0f153fdbbd218706b3acbd7d0f71e92af9f695115264f49de2147284ad5de73d3ed4de3ba0a2
-
Filesize
20KB
MD544def4f6e42c3ec63f229d23af8c804a
SHA1f5956d9295778b539bced03215343fd3cf7a9dd8
SHA256882faff2a0f007164d5dbda7bd7f803306423b5eb48a88b1bb72bde65b77e50a
SHA512a14770398044635a8a8fc0d59dc95af3a97ae78146a9ace3795d600a44098a5ff7099aa3d0ac40442f8ff8c5d3b5ceecb4b360bf47f3e8c7c902879e2e76228d
-
Filesize
20KB
MD508e1b6172f27561d8ca660aba550f859
SHA1a30f88c5aa0d3b31d902cdb2b26577fed9e74606
SHA256ad1a38dab6c45e0d46cd69e6b8efeacf5c73d5d9f42c392fea1613b71491c747
SHA5121d67ff429fa79fb1f15cdc9438a4313e395a2fe923d6a6c2fb38a0699d7573af59c01aa745ad7eda39d40462978e2944b50f86018468d8bb2712799e96d780b3
-
Filesize
20KB
MD5d8f9291766a8b006ed2fd89f848600cc
SHA1621cc0bf461d30448123025b479d84933bbb488d
SHA256667b87bc91f971ef986d4fcbea4628ed2248b7dd7ec2c3bc0559eb2407e4a1c0
SHA512634ce76de13cae96ede956f1144f1bb0c7299b59adf4e8ec715134164e77d44d471d142d80ac7a662d19504361553ab2acfaf57d0fda3bf38735fc1011e717a2
-
Filesize
32KB
MD562d2b2c98830f0104ab8f4a9df390388
SHA186d1018b14e586b538186c9d5677450038c3258d
SHA2563de1e112d48d9f3ce4c1fe8585c6e0a94477a9082575dea43995b79df5615c3a
SHA5129df58dde8e24e073c0c49d991c2e94a2d7c83090631ce00e385224bc7c9b57cdcce7a2be973fe217666be64be62770a7f7463d2b7606e98088b6c41225b741b0
-
Filesize
20KB
MD5c40945b38ab3a9530cac10e6a82017fe
SHA14cd02150ad7db1d73c8fe9732fd28c0e1de0d5da
SHA256d5fa53191e758414987418170e85f3fdbab2ec08b4c4fc8ff9eb98a6dd62644f
SHA512a1745ed53f94f872c118cb13d623c7584c00db2a385c25e3de09217ec0c6261295fbd6a6454d194491a005c6d7e03804cdc356482a6c9acc1ce4eab57e7e71e5
-
Filesize
20KB
MD58521f47f584b315795dc9c9a4e99574b
SHA19505a53b8d3c7d483507c98313e70f77e45709f5
SHA256dfec764bea5ce243a788ec817682d0bdc635f95b4f19211ac44f07d44e743e6b
SHA51250674ca5018484ebdaed0bc6018515e0c677df7ccc6b256ff16793704078864cde80c364c995ba7e21ef24a146c70ceaa2cbb39776d24ddf4f59156eb1bdede4
-
Filesize
20KB
MD521631b12c955b901c92656a30422d59a
SHA1ca303fe162609c173811fe63e1c4fb8b55583637
SHA2567ad9f5df9dcb9f5913a603aded0b7a5ef8ad84b6f38e013bfb021ac9b5b31a35
SHA512c9bfc64960eed62aa81e69974b83252d4518b859ff57b36e8221429e8789a3839d6fe23a934872bec0d3b1964114eec43ada9ada326da84e0ba9c463323ab8fa
-
Filesize
512B
MD51f74a32637c11919257923bdf6d8ff6e
SHA1dfa8d296970d66579ab3ee3ecf39886494791c3a
SHA2563ca51685cb5b0020d000baf7715448710712a72b1a476e84ac591d7c821ead38
SHA512fee6c84d657d5628d6f9825dc932bec4e6caf65df3fd28dcd1dcd3e076f19ae8b8bff734001e56f280fe5f0a23e40db1532681d053f473f8faeaf3354877ba1d
-
Filesize
28KB
MD5cf845a781c107ec1346e849c9dd1b7e8
SHA1b44ccc7f7d519352422e59ee8b0bdbac881768a7
SHA25618619b678a5c207a971a0aa931604f48162e307c57ecdec450d5f095fe9f32c7
SHA5124802861ea06dc7fb85229a3c8f04e707a084f1ba516510c6f269821b33c8ee4ebf495258fe5bee4850668a5aac1a45f0edf51580da13b7ee160a29d067c67612
-
Filesize
8KB
MD5d08fb1d20c4ccc67294672e749a662ee
SHA123d79d6c275528ffc90e8586cee783d2209e71e9
SHA2568b6a53a9a345b70a749d11414374291510d4690eeb475a2a1d7e3a887c594b0b
SHA51253281094f6cc74c86d21d3f432fc264fd34d572ba1ef9c0f6ba268fe7930ec689c3e3772060a5d8520dfbd1e0d2796b0373b58e519214c88cbaa05c73ed3f106
-
Filesize
8KB
MD5408e78235672181aa393d1ce66fb662e
SHA184f450987c9f9e18c1fa8900ae06c4e1635faf42
SHA256d42089e3221eb80c2a4c22ba178031cbfdb99f86578f84487d3e29d23f0f0054
SHA5125b724790ed89b2969d6b57c3750e995812dd4a27be4cdbfb2d42d5b107bfd5fe6acc8f29fd02decd1f8b43f20fa2bff542fd4438e2b398ff48e3d565c2256e43
-
Filesize
8KB
MD56695cbd37da86dbf9986f0dacd56ccc4
SHA1090de1030e3165914363fda6db9f07f34c80f141
SHA2565c405f0a5531bae8c6cb7c7d5269a496749efd19e4816a614d3dbc405ba3019f
SHA5128bb129f171e9a1a4571b618bc442f1e29b3143b6997cd3d39a874afa24f77fff6741d0b1df81853cdf3f500fe74c3f04b429c54b3de370326d333c9f80db44f3
-
Filesize
265KB
MD5d3ee3513fa25beaca8783a814023f9a7
SHA1b87dd3bae32be5170e0bf8a5958d4ac91fecd9a6
SHA25619d2bf69f3cbe0bf405d068165dfafcf1656245afb07c4b3813c4404c75f39d2
SHA512478f54b9f5dc72bbe61cc9b329f0a0cd27150363c8c0f1087dda9b45c751ddf0d29e9ae71e511988b5080e6ef2f56502eae5e06bb334b69297f388898e352bae
-
Filesize
8KB
MD5a54b87133593114ef214dabc78bc31d6
SHA15151b66a50fc432142d82c852a66f68deffbf27f
SHA25627ea0fb612c362f92f00080432e29d8889b5f79d68fb4983d18eb5d0ffb765ef
SHA51291e322f1fcf93b93688ab6a0d2ee0b8f7709340d44da02e0fe18c02fa57f5ccccc7951df984f62e652b3dfd075b3e36bd7ee093a5465a698047f328db723123e
-
Filesize
8KB
MD5d9766db812cfdc351a863b725f04f0da
SHA125ec534ca832b54faa594f0196bef414d7fee318
SHA2562259bbfe3023a8e4a029176b790e5d56138bb01da8c53216b4eb92179d4b526a
SHA512e42c6a3c811f1bc9b78351a5f7e3bc60463a30173a64baa89ad2a0171c581aa8c1ba431585deaf1f9222e0a333f6fa563f9264c4a0a0d1756c61b19176ffeb83
-
Filesize
32KB
MD539f3645bbb6b5ecfffa0e27860e62256
SHA1274ae32100c906845dab38e3c8a0b817352fb420
SHA2563579c98c64e0427e5d77cc44168858254a06344de1f0bc54db6dc309ee865ff4
SHA5124f597120c0a92379016a7da30b8784fea8ee35e78491736b97b6e6389dfac1ff5cdcf0d8b25bf98f75f0ddca9f333ca7a940cede77812be4b3d50cbd2133b577
-
Filesize
4KB
MD5f2b4b0190b9f384ca885f0c8c9b14700
SHA1934ff2646757b5b6e7f20f6a0aa76c7f995d9361
SHA2560a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514
SHA512ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1
-
Filesize
512B
MD56703ebdc58140adcf62fad5b57208da8
SHA19a0f9b166b64153cf8b2600aa8ad71be46f153fd
SHA2560595c83fe25f032a822ddf46ae1820d19ddce298f92dfd0addce1c4b39a0e4fe
SHA512ce3a0d1c4dc11e4863d998c6b815947c610b040fa8dc6b1df746b12b4e496c8fb68d99ca7d5b57d1851fe9198a46b8d7df7cc438565b330c3e0308832598a621
-
Filesize
28KB
MD57d9441cfeff5fd19b51f57e0ef10cb91
SHA1739705236dc804cf8555d769da3c74d755ef6a39
SHA25683be21aa4ed772ccb867469fda774907553ab20e59b63592b36d8c88e4abc627
SHA512731862d48f0288c15206a2d57c07b39151ed549cececd298fb61c42a22c96425042f2c656a5544e8025a8256c6e8b7dc789b37ef845eb36aca4b179dc48bbbd8
-
Filesize
100KB
MD504e157929111a1d24319020548f6c3f9
SHA1557be1932ea264dca052b9c5d8a1c543291e40d7
SHA25604b4f94198119c9b771084d9bc9e9041c7107756f2ad9363bbec56bf13e754a2
SHA512693aed200f3c8664e48e721e376cbf823bde8d7059c0f28c65f23becda08a66ce636ca58080f271f8ce621318194050a603857f028e5960e5bba985c16450fdf
-
Filesize
20KB
MD52048eb6124a452540ee51dae4145aadf
SHA1d05005b2cd7fe4cd652b0d7fd1bdac2c19d51451
SHA256105c54b6fe3f25350e92187467761598e4c21d62b1091b77d091f65f3bd98864
SHA512bb6cb3853dd2a5d0701e20607d4e153ae201268dd2e5e2d06cc2df208b3b4dc50132a4ab428251b1644d2399fcc717662438d082ff14203387bab8794109d44d
-
Filesize
20KB
MD5fde2ee00cbd121cfab5290b078aa3ceb
SHA1e2b77d5320e155e413d040a8c20020962065b2f8
SHA2562897b0812077c654a9b3fbb0b6303d5cde681eeba7ad9981de65716c7810d685
SHA512a9326aff8e454a2b4ac09984ef2a65fddd4dc146b4c44d839035549bff8c9fdaae490326d0b018f76c1ca2e4fb25426d74f550ca0950982fba632a023af99a56