Analysis
-
max time kernel
2824705s -
max time network
148s -
platform
android_x64 -
resource
android-x64-20231215-en -
resource tags
androidarch:x64arch:x86image:android-x64-20231215-enlocale:en-usos:android-10-x64system -
submitted
22/12/2023, 08:12
Static task
static1
Behavioral task
behavioral1
Sample
7c45bcc605e82a03c55b0fedaa3ea268.apk
Behavioral task
behavioral2
Sample
7c45bcc605e82a03c55b0fedaa3ea268.apk
Resource
android-x64-20231215-en
General
-
Target
7c45bcc605e82a03c55b0fedaa3ea268.apk
-
Size
263KB
-
MD5
7c45bcc605e82a03c55b0fedaa3ea268
-
SHA1
84d823e9f0b15d0d275da93203519c4952a14b50
-
SHA256
517a81d126639b1cb3afd224e4490dc976aaaff3cdf923f8dec7afe242ab1434
-
SHA512
21c962f8bd2e21a880b3a9d8141539353ce050b5cf52e46637a637b79dd21249b8f1f1a1c04ecb719a1f8c459c0740eab18653243971bf0121a0965e96e73e09
-
SSDEEP
6144:OhPNvivXSCeVvnD2IJOsBFaw4IzEsS/ZXBc2Y4MT5fNr:O/i6tQIwsBFa/IvcR9Ur
Malware Config
Signatures
-
pid Process 5105 com.okasa.ifdwti.mheryztaptkndjmh -
Loads dropped Dex/Jar 1 IoCs
Runs executable file dropped to the device during analysis.
ioc pid Process /data/user/0/com.okasa.ifdwti.mheryztaptkndjmh/app_tfile/fields.jar 5105 com.okasa.ifdwti.mheryztaptkndjmh -
Reads information about phone network operator.
-
Uses Crypto APIs (Might try to encrypt user data) 1 IoCs
description ioc Process Framework API call javax.crypto.Cipher.doFinal com.okasa.ifdwti.mheryztaptkndjmh
Processes
-
com.okasa.ifdwti.mheryztaptkndjmh1⤵
- Removes its main activity from the application launcher
- Loads dropped Dex/Jar
- Uses Crypto APIs (Might try to encrypt user data)
PID:5105
-
com.okasa.ifdwti.mheryztaptkndjmh:RemoteProcess1⤵PID:5142
-
com.okasa.ifdwti.mheryztaptkndjmh:guard1⤵PID:5561
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
138KB
MD5cceb8db3b057d24673d49eda229e9892
SHA1b18f6353b2156410249079a3b7b86ef3a530e8ee
SHA256e900cb4c3fe9d8f45196a7457e9645c65b0f3cde820f4161950252cff67a4d97
SHA5124a42cde3165a706e823caa1362001ed8aa647caf22325a4f2554c64fc4ebcd79afe44fe5eab5474221806f26e7aca9d2901026de6e597ef62fe867f123e4bd57
-
Filesize
369B
MD56de41202d76cfb91657a014430e7f33d
SHA11c066a98ee1dae3493881522b42a6978ef72ffee
SHA25651491488aa5999f64c4d74c50676559497e9890b2a3978cdc8f07dc782e945ec
SHA512765ef4f4ca7a832af8677b8cb38b705a5cf809b6d321f7d86bcb03471d5e55d8c9b8dc04dbad9f89b10febd5e87b29d29e1bd36fa91259ba00ea863ad1225236
-
Filesize
4KB
MD5f085b706dbf508740a27a59be028bc9b
SHA1832a68bca54bb2c22e13389b2c3d782d42b71bb5
SHA2560aaf976e6667e8f70c3162172774b481636f307e4731d436e30c4dcea6ab80db
SHA512514c47d0f0e871868f8d7fd08598c100dfb487f2fc556dc5485d87ed70c5d5d177943b724111bd4b1efbef68d05dfc89063c711417c3df7620d04ae7d41c4f50
-
Filesize
512B
MD559e3ec1bcc30e24d74e838495925b6f2
SHA15506866713d6b839281cd18d972fb09bfcb36f0c
SHA2568a851778e6224118009ca0d9e5cd7716df5e597d6f68686503ec333909450e9a
SHA512db0f51339e31bf3eede75ff13c5da48168ffbde6da94850b8abeb917e3132c524c25df60f0c936816e898219a3381354d27fcc6a689c6d38aa607455d49e994d
-
Filesize
281KB
MD573b11c4c10150bbd4f29ad012dc11dde
SHA165c83ad32c29f9811c32eda75d7fcdc92ef42dda
SHA25652132037e9b950a9cb48d6374ee2c6747a6bfe776e13a726395771f1b40ee9da
SHA5123e53b1ee22a00e60896da86d2695195e0965c93d190c4d1c0dba2eb5c611d670ee7693a9f8756858255e2b170cb82a753719dd4d6a827af437309b7a1dcc6f01