Overview

overview

10

Static

static

10

8ef40f13c6...1a.apk

android-9-x86

8

8ef40f13c6...1a.apk

android-13-x64

1

Analysis

  • max time kernel
    2529159s
  • max time network
    138s
  • platform
    android_x86
  • resource
    android-x86-arm-20231215-en
  • resource tags

    androidarch:armarch:x86image:android-x86-arm-20231215-enlocale:en-usos:android-9-x86system
  • submitted
    20-12-2023 07:21

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    8ef40f13c6192bd8defa7ac0b54ce2454e71b55867bdafc51ecb714d02abfd1a.apk

  • Size

    2.0MB

  • MD5

    0ea22a4baee75c86f9895e39cbc04572

  • SHA1

    cf610aae906ffcfd52c08d6ba03d9ce2c9996ac8

  • SHA256

    8ef40f13c6192bd8defa7ac0b54ce2454e71b55867bdafc51ecb714d02abfd1a

  • SHA512

    228481850ab1532989774e0e738041359bf81c5867f7d3bacf9eb32c36784eb330d23fa52bbdda58ef6b657e34686d95675f602229f6088f6a17ef374061996f

  • SSDEEP

    49152:4Fkzdw14Nb12ssSjs502qFL6a2D4j9+dwGxFqyMrxdRhVzdJ+:lw1yB2V509V6fkj9CtbLMrxzzd0

Score
8/10
bankerevasionstealthtrojan

Malware Config

Signatures

  • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 IoCs
    banker
  • Removes its main activity from the application launcher 1 IoCs
    stealthtrojan
  • Requests cell location 1 IoCs

    Uses Android APIs to to get current cell location.

  • Acquires the wake lock 1 IoCs
  • Reads information about phone network operator.
  • Requests disabling of battery optimizations (often used to enable hiding in the background). 1 IoCs
    evasion

Processes

  • com.xdja.jxclient
    1⤵
    • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)
    • Removes its main activity from the application launcher
    • Requests cell location
    • Acquires the wake lock
    • Requests disabling of battery optimizations (often used to enable hiding in the background).
    PID:4252

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/data/com.xdja.jxclient/databases/com.google.android.datatransport.events
    Filesize

    4KB

    MD5

    f2b4b0190b9f384ca885f0c8c9b14700

    SHA1

    934ff2646757b5b6e7f20f6a0aa76c7f995d9361

    SHA256

    0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514

    SHA512

    ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1

    Download Submit

  • /data/data/com.xdja.jxclient/databases/com.google.android.datatransport.events-journal
    Filesize

    512B

    MD5

    785e49b49c946f3cf2d97792f59edd4e

    SHA1

    50dbaf01373e9fb1403ed518da83f4e469489a13

    SHA256

    5966b86c7f0ce4a5fb89496d0852a88d8212ef0fb40ae785a56ac09f608e0af1

    SHA512

    0108bdfcccee34101939d7bcf159b45ac97257ebcd6165bc7a544bd92bd4cd638c5adac27059bf5a8c7077443d77b6b1d46ad411011c0abe381f35b1d00ef787

    Download Submit

  • /data/data/com.xdja.jxclient/databases/com.google.android.datatransport.events-shm
    Filesize

    28KB

    MD5

    cf845a781c107ec1346e849c9dd1b7e8

    SHA1

    b44ccc7f7d519352422e59ee8b0bdbac881768a7

    SHA256

    18619b678a5c207a971a0aa931604f48162e307c57ecdec450d5f095fe9f32c7

    SHA512

    4802861ea06dc7fb85229a3c8f04e707a084f1ba516510c6f269821b33c8ee4ebf495258fe5bee4850668a5aac1a45f0edf51580da13b7ee160a29d067c67612

    Download Submit

  • /data/data/com.xdja.jxclient/databases/com.google.android.datatransport.events-wal
    Filesize

    44KB

    MD5

    682d4f3ddc4906bb0e74c4c9e190e03b

    SHA1

    706189ce96793c4219c717e15cef7452ce547ef1

    SHA256

    a1f55a78f482e1da55a6735b82f10664a59c46481262b925c94eb6aaa581f0f1

    SHA512

    5d0e6f0b733a6971eaa383dac1838e24dbec984fff4b8963893355c1acec4bad3e4f11663e9b777cc99c87235189a1ef5a192fbc9390f7336f15aacec9543328

    Download Submit

  • /data/data/com.xdja.jxclient/files/PersistedInstallation1026132873511949208tmp
    Filesize

    90B

    MD5

    37aa6c9fa87f001a87cbdbbf17ec7da9

    SHA1

    6084967bfd4cec7317b196372b6ecf96fc333f84

    SHA256

    efc0cacc22986317f48ec688ae62ae7aad407d1ddacf9fc278988a591356d77a

    SHA512

    720efaebca86a38cee44de353439b2814ae7a72780f5e3eb13669ec067b2587d9831a4371e40a4e47af79b914ec00ac490774befce54f6f2c6626613a943e8f2

    Download Submit

  • /data/data/com.xdja.jxclient/files/PersistedInstallation3687191896764394670tmp
    Filesize

    114B

    MD5

    3151f74db118af6af3d5f0ff868d0f2b

    SHA1

    be5ad112d37a2ae1307d6f239b21d42fcf212974

    SHA256

    415f22b1d9a38a008879e0476821e6f34641d9cb88627b824cc7ea0b9d705449

    SHA512

    0fab815f744c2adedb186b2e81a4af80058266fb9c256fc3d95b4eea52590f33481acb964ab4e064ee8d903807862b34ef83ee1b40ad42880a1442a09571cb64

    Download Submit