Analysis
-
max time kernel
2352059s -
max time network
135s -
platform
android_x86 -
resource
android-x86-arm-20231215-en -
resource tags
androidarch:armarch:x86image:android-x86-arm-20231215-enlocale:en-usos:android-9-x86system -
submitted
20-12-2023 03:00
Static task
static1
Behavioral task
behavioral1
Sample
7f88e9c866ebbb743be1486785fa87b224a3a25da117c05701106d11ec246258.apk
Resource
android-x86-arm-20231215-en
General
-
Target
7f88e9c866ebbb743be1486785fa87b224a3a25da117c05701106d11ec246258.apk
-
Size
11.8MB
-
MD5
fbd9e92603604755893f1f474d482221
-
SHA1
4609b33790e823a48883aec7f6f35c3249d8f632
-
SHA256
7f88e9c866ebbb743be1486785fa87b224a3a25da117c05701106d11ec246258
-
SHA512
3345cae7dffe9cd738d4d227bbb5d3dd7ce2ee382b32c0f645dcd5b34ce86c339bcd3b43f86f7daf36db8b6e176bef45c3205184c30b0e6f43217071a29dde3e
-
SSDEEP
196608:gT4LK5i/jh2xje/1+pXjUI5sRwUui3eojnSJBARtpXCuVHh7RElY9A:bK5i/tXgFjUI5BUT3CBARtpSS4J
Malware Config
Signatures
-
Loads dropped Dex/Jar 6 IoCs
Runs executable file dropped to the device during analysis.
ioc pid Process /data/user/0/com.towardmobile.fistofhero/app_gameassist/builtin/com.gameassist.pluginmanager/1.apk 4272 /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.towardmobile.fistofhero/app_gameassist/builtin/com.gameassist.pluginmanager/1.apk --output-vdex-fd=47 --oat-fd=48 --oat-location=/data/user/0/com.towardmobile.fistofhero/app_gameassist/builtin/com.gameassist.pluginmanager/oat/x86/1.odex --compiler-filter=quicken --class-loader-context=& /data/user/0/com.towardmobile.fistofhero/app_gameassist/builtin/com.gameassist.pluginmanager/1.apk 4246 com.towardmobile.fistofhero /data/user/0/com.towardmobile.fistofhero/app_gameassist/builtin/com.gameassist.autoplugin.com.towardmobile.fistofhero/1.apk 4296 /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.towardmobile.fistofhero/app_gameassist/builtin/com.gameassist.autoplugin.com.towardmobile.fistofhero/1.apk --output-vdex-fd=50 --oat-fd=51 --oat-location=/data/user/0/com.towardmobile.fistofhero/app_gameassist/builtin/com.gameassist.autoplugin.com.towardmobile.fistofhero/oat/x86/1.odex --compiler-filter=quicken --class-loader-context=& /data/user/0/com.towardmobile.fistofhero/app_gameassist/builtin/com.gameassist.autoplugin.com.towardmobile.fistofhero/1.apk 4246 com.towardmobile.fistofhero /data/user/0/com.towardmobile.fistofhero/app_gameassist/builtin/com.gameassist.pluginmanager/1.apk 4246 com.towardmobile.fistofhero /data/user/0/com.towardmobile.fistofhero/app_gameassist/builtin/com.gameassist.pluginmanager/1.apk 4246 com.towardmobile.fistofhero
Processes
-
com.towardmobile.fistofhero1⤵
- Loads dropped Dex/Jar
PID:4246 -
/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.towardmobile.fistofhero/app_gameassist/builtin/com.gameassist.pluginmanager/1.apk --output-vdex-fd=47 --oat-fd=48 --oat-location=/data/user/0/com.towardmobile.fistofhero/app_gameassist/builtin/com.gameassist.pluginmanager/oat/x86/1.odex --compiler-filter=quicken --class-loader-context=&2⤵
- Loads dropped Dex/Jar
PID:4272
-
-
/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.towardmobile.fistofhero/app_gameassist/builtin/com.gameassist.autoplugin.com.towardmobile.fistofhero/1.apk --output-vdex-fd=50 --oat-fd=51 --oat-location=/data/user/0/com.towardmobile.fistofhero/app_gameassist/builtin/com.gameassist.autoplugin.com.towardmobile.fistofhero/oat/x86/1.odex --compiler-filter=quicken --class-loader-context=&2⤵
- Loads dropped Dex/Jar
PID:4296
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
8B
MD5e8b0a102bea856330cd445a3f8c473cf
SHA159fbc7f6fec5f2e7209a899e0e4f73e5266b5d7a
SHA256d99c135915c47f8eaa1c1e5fe907def4b3652564b1c4462922ed17637a165cb6
SHA512957557f568477f5da58ae099fff490f8ce587195f3281f1f146eccc5f7b82947ec30ef73ddb09e826a83ec72bd8b74b936e5856ef39e263b60350b5c4f079c88
-
/data/data/com.towardmobile.fistofhero/app_gameassist/builtin/com.gameassist.autoplugin.com.towardmobile.fistofhero/1.dex
Filesize418KB
MD5784abdd59528bb82efce7c107030d30f
SHA1ecda6f7a228b4e0cb3a7694e081fb4e0bb6824db
SHA256b1f529e9f9c815d5a0340b5d4611d9f90e78f5d638da700d1a87620a9bfd5a19
SHA5126de204611c3aef3da4583f187a476760f52cd1d6afd845e234cecdbe96a3d9d06d4733eda19eb95af9a0da09e4db1893651818a68fff0a059da0f476d53ae651
-
Filesize
132KB
MD5b8c186242ebb0566e25d9365b5bacda1
SHA1cdc60ae89a0cf1761c7afc075ac6c1a45ea50b67
SHA256e1b5885376cb309b6ad619550e29dbb6b3f82c5a9ee71237a2cd39abebbbee16
SHA512eddf506d974a22c4573ae9ec762f898e6d67e635c8783afbb4108c22961d23030fe9fa75ae647acd8366b8890a94b03d353ea6868d17d192e7c9cd0bfdc26b62
-
/data/data/com.towardmobile.fistofhero/app_gameassist/builtin/com.gameassist.pluginmanager/lib/libplugin.so
Filesize53KB
MD5f27afd2b8684ac830334aa37e166c99a
SHA14b6d730d2cb8377690673bc904ed77b466ce9af5
SHA256599cb5764e59a8189741f44539cfdfb20f44b700ce2bd32ecead9bdf41e06e47
SHA512a1715aa901f62b247310fd05f67b60852301f23b3ef9b579138f356a9cac4e6041868a0a166581fb8fe29ec8f0683938db91762fc1d5d5df855132c330babfb6
-
Filesize
225KB
MD5772da3e94c83b9e92503ea39aa4002b6
SHA163c4bd313bda12fd57f02942c08a6661949cd97a
SHA256e987be89ba8f1274e5c0affd890aa81f40baba15e687e36c38343ea2eb53ce50
SHA512299b9e19d1fd0a606de8fd2ce09a11ac793b39c4d05f4c8f2b8eab3fc8d63af85dea8926d87b87966a317875529ce6977bb22b6ef11de8e7084d8fe3f32f80e6
-
Filesize
153KB
MD503c89bfaf34f35b6ae41c346c4523e34
SHA1c9873c0ecb0cc1b66e479845a0109c7df55d4a02
SHA2562816f454e1ae7f4f16cd04ea826a4788a492ba401c8eb5c387458c2f4af0d671
SHA5124228a449d1a3e6529c587251e01a0381047718950bf3644d02edb55d4d692564102a452e8aeddf853cd038ae515a5add46c26ad89d311a26c720777af14f3517
-
Filesize
132KB
MD573c452d87dc9f68237a1821fc43d7532
SHA12fceaa41aea0b6132fa44fa4871712e89f0a4de0
SHA2567236724b16d2677711b21bf4f859ffe39aae7937c8c4bd1414c86ddbb4596ff9
SHA512e891ead0570fd1183cb2b1a7aecbd5041c59239394bb696bb2848fdd811491e8959cea334d8db63192ec27acb0254d80220906eb23ae40971afe382a389134aa