Analysis
-
max time kernel
2275644s -
max time network
136s -
platform
android_x86 -
resource
android-x86-arm-20231215-en -
resource tags
androidarch:armarch:x86image:android-x86-arm-20231215-enlocale:en-usos:android-9-x86system -
submitted
20-12-2023 00:10
Behavioral task
behavioral1
Sample
72512e7de8099e66beb9b4395b8c4a5c1dfd413c85977a31480ff8bd68b2ca6e.apk
Resource
android-x86-arm-20231215-en
Behavioral task
behavioral2
Sample
72512e7de8099e66beb9b4395b8c4a5c1dfd413c85977a31480ff8bd68b2ca6e.apk
Resource
android-x64-20231215-en
Behavioral task
behavioral3
Sample
72512e7de8099e66beb9b4395b8c4a5c1dfd413c85977a31480ff8bd68b2ca6e.apk
Resource
android-x64-arm64-20231215-en
General
-
Target
72512e7de8099e66beb9b4395b8c4a5c1dfd413c85977a31480ff8bd68b2ca6e.apk
-
Size
14.9MB
-
MD5
72830ce590ffeb0994e35e9019abfce5
-
SHA1
ba1d41348b44d9fda098a44ade23372dd0a3206a
-
SHA256
72512e7de8099e66beb9b4395b8c4a5c1dfd413c85977a31480ff8bd68b2ca6e
-
SHA512
d6e5e6bcda86eaf2d1e8f579ecd51103277525785fb56dfef00ebf501a85e7824cb26888c23fb7d7525471ff57837e03c304f615bb88cfeb7c2f296e9627e17c
-
SSDEEP
393216:8HZUiBmacX7X52NWdXJq2TN5+dIwepObrfum7R:85BqgY5+AOLR
Malware Config
Signatures
-
Loads dropped Dex/Jar 2 IoCs
Runs executable file dropped to the device during analysis.
Processes:
/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.ltdevelopergroups.litecleaner.m/cache/1616432909849.jar --output-vdex-fd=121 --oat-fd=122 --oat-location=/data/user/0/com.ltdevelopergroups.litecleaner.m/cache/oat/x86/1616432909849.odex --compiler-filter=quicken --class-loader-context=&com.ltdevelopergroups.litecleaner.mioc pid process /data/user/0/com.ltdevelopergroups.litecleaner.m/cache/1616432909849.jar 4345 /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.ltdevelopergroups.litecleaner.m/cache/1616432909849.jar --output-vdex-fd=121 --oat-fd=122 --oat-location=/data/user/0/com.ltdevelopergroups.litecleaner.m/cache/oat/x86/1616432909849.odex --compiler-filter=quicken --class-loader-context=& /data/user/0/com.ltdevelopergroups.litecleaner.m/cache/1616432909849.jar 4216 com.ltdevelopergroups.litecleaner.m -
Reads information about phone network operator.
-
Uses Crypto APIs (Might try to encrypt user data) 1 IoCs
Processes:
com.ltdevelopergroups.litecleaner.mdescription ioc process Framework API call javax.crypto.Cipher.doFinal com.ltdevelopergroups.litecleaner.m
Processes
-
com.ltdevelopergroups.litecleaner.m1⤵
- Loads dropped Dex/Jar
- Uses Crypto APIs (Might try to encrypt user data)
PID:4216 -
/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.ltdevelopergroups.litecleaner.m/cache/1616432909849.jar --output-vdex-fd=121 --oat-fd=122 --oat-location=/data/user/0/com.ltdevelopergroups.litecleaner.m/cache/oat/x86/1616432909849.odex --compiler-filter=quicken --class-loader-context=&2⤵
- Loads dropped Dex/Jar
PID:4345
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
9KB
MD52c84bc0c28d4ac333d267f7a152b4039
SHA149e67f04004587ae351d5aba4da5f18644746864
SHA2561eea5584eb2332554753b4beec7fe8e972bfb3eeadbe0c05dba33de267f25a00
SHA51244ab6c390cac8b11bf43097293ef73bb620b1466fd671a945639198ea10dea425a0c9443b47752cc0a6689a6f5a7661b35f7a8a350ffcba30a72be60d5f18abd
-
Filesize
4KB
MD5f2b4b0190b9f384ca885f0c8c9b14700
SHA1934ff2646757b5b6e7f20f6a0aa76c7f995d9361
SHA2560a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514
SHA512ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1
-
Filesize
512B
MD567dc48a6eb5b8f53dbc4a804504db9e4
SHA1345a5883ae0d02f51fa53e372e94ed4632eb8c86
SHA25687127e699fe1cefaad8e61162e4b834bc5071400cafe8cbde7b33ece176ddfd8
SHA5126185ee5c33e17bf056fa637c73ce31c14b3ec0bd5cc59409f73a7a2572c41405b1b8aa320fc4884f6f2d69fcd2ea900489dc8063891788afd1ffc05e1603e6cd
-
Filesize
28KB
MD5cf845a781c107ec1346e849c9dd1b7e8
SHA1b44ccc7f7d519352422e59ee8b0bdbac881768a7
SHA25618619b678a5c207a971a0aa931604f48162e307c57ecdec450d5f095fe9f32c7
SHA5124802861ea06dc7fb85229a3c8f04e707a084f1ba516510c6f269821b33c8ee4ebf495258fe5bee4850668a5aac1a45f0edf51580da13b7ee160a29d067c67612
-
Filesize
16KB
MD5fa88ea6421ebb9a7eef205712fb7f5e8
SHA17123ed77a4ebf8b9cbc2278d5970711859b51a13
SHA25641a1dafba70c98c755444ded9732d92cb94d9b3f9d2907ff2d93ad87c094c75d
SHA512dbfd0a11aa5e3ede84f7fc60d80a18b0bf22e5451e957b1aa9a8b73fd171f2ec7c5bd5bf3080abea75e716e9c661a8bdab51b0dd07ff89e5f5914e2497e233df
-
Filesize
108KB
MD5421f453069b9314f0316e32f01e52053
SHA13a1a6761228143d5c0e7c61f030647017e71ec7d
SHA2568d40fc56a7487a7ccc8b5710c72b12ec29693527070eebf5a58aa0b54eece407
SHA51265104b0e368f797734e57d45c2d6b3bf313f613976da7c789d4e64cd2aa5fa14b3a4398acc2a5d82baa159a27d8edc4735ca6416830b581a943c70034e27ac0c
-
Filesize
21KB
MD5e06dd4fe2e90d133b141da7b4ed16eca
SHA1d3da2591d29fdc480cd998711e2abe67b5cf2ca8
SHA25629777214e781973439fe2871490d1d40e84a75128a0ea9b6864ea1da6efe3496
SHA51273f6d5feb7b72709e32292343673b00ac6131af883250fb044256526a5942fb70f30545bd275affc45a506347e7b0a1b571c914f90c46059f5401e4298b486f4
-
Filesize
21KB
MD586ce3683020b3f28f4110aac9c769ff7
SHA1876e0686440524927639a4797b2f13b12a26ce4a
SHA256be852340e03b169a28811d1ff41582d19638d9fc0540f237ecb960c45bd07071
SHA51204d03a9963ba49adf5d0d26a21b57e85e21416fcc3d479ce7522149d45f5ab630ff78e590e724695fe29850b08b4dccfa5051daf5d4e4afd9384f7183f887ddc