Analysis
-
max time kernel
2999544s -
max time network
130s -
platform
android_x86 -
resource
android-x86-arm-20231215-en -
resource tags
androidarch:armarch:x86image:android-x86-arm-20231215-enlocale:en-usos:android-9-x86system -
submitted
24-12-2023 04:02
Static task
static1
Behavioral task
behavioral1
Sample
cd4cfb25cd47e1e3f52de6be00547fcde3ee7f058bda0febb86ccd9c2c2a82cb.apk
Resource
android-x86-arm-20231215-en
Behavioral task
behavioral2
Sample
cd4cfb25cd47e1e3f52de6be00547fcde3ee7f058bda0febb86ccd9c2c2a82cb.apk
Resource
android-x64-20231215-en
Behavioral task
behavioral3
Sample
cd4cfb25cd47e1e3f52de6be00547fcde3ee7f058bda0febb86ccd9c2c2a82cb.apk
Resource
android-x64-arm64-20231215-en
General
-
Target
cd4cfb25cd47e1e3f52de6be00547fcde3ee7f058bda0febb86ccd9c2c2a82cb.apk
-
Size
5.4MB
-
MD5
f150e5b51f7d33b2350e236fb3ab5ff1
-
SHA1
e0f569e935a4c8c0238ad170824bf2b21a65b63a
-
SHA256
cd4cfb25cd47e1e3f52de6be00547fcde3ee7f058bda0febb86ccd9c2c2a82cb
-
SHA512
8eb4505a0ab64270802546285095de5aab979a0a7ba47850221f6827db2d4930ac3185d95c7c993c16321fd5b7c4711aceb8addb1cca627fb3e183e5a29a27b8
-
SSDEEP
98304:VoXm4EjEm7H+dXPgGvpfyfrl6yTL+pfOUxDY00/SCEIzczRZvpiBdf/piVA5tvgG:VoXegm7UvpoaDYLCvp+DiyfgAN
Malware Config
Signatures
-
888RAT
888RAT is an Android remote administration tool.
-
Android 888 RAT payload 1 IoCs
Processes:
resource yara_rule /data/data/com.protectstar.antivirus/cache/volley/-4440143562082814216 family_888rat -
DiamondFox
DiamondFox is a multipurpose botnet with many capabilities.
-
DiamondFox stealer 1 IoCs
Processes:
resource yara_rule /data/data/com.protectstar.antivirus/cache/volley/-4440143561595694984 diamondfox_stealer -
Acquires the wake lock 1 IoCs
Processes:
com.protectstar.antivirusdescription ioc process Framework service call android.os.IPowerManager.acquireWakeLock com.protectstar.antivirus -
Checks the presence of a debugger
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
737B
MD5146a9346ba4d2723e8cd6b72fa37c5b4
SHA1d68f1592246e6ff9a50321c006ae60004fca3d09
SHA256c8617137f7cabb8bdaead36d756c13567e936d7dfcb33e1658be0788fb06e47e
SHA512136b116826f5a44e5817719aad514adddc55a5f90271729aa39542ec44bf630bf1cfad65f5e4242da93d322256c716eb3a8993dabb78cca4c589702d8218c9eb
-
Filesize
116KB
MD5b72d43b55d169d903505248ae6f7848e
SHA194d8e79e7fb5a99410b78e002d8e801fa119d312
SHA256f8c45f9c92aa8e641f5619caf95fbb9307414e44f913c4be3fdaf7b662a3919c
SHA512a28bcda30fa6c37681ae89303fff18c35576d26fc8052b90223ed9ea6165d3252ad6483b9e45f4e9bfa63ac62c2950a61ced83ba3656aa891282294f2e0f104b
-
Filesize
737B
MD554a13fa836b35d7dbb074015994246a7
SHA1e0f9a1d01f51c38c9529f93f7dd75023acc0dd08
SHA256aa6acc3e323e261841753904330ec07bdf6db29591d7e70a7f377a13484c7867
SHA512006e4b5492b3dd69d20ed321142cc799c6bbfc766f8e373fdb04388e1d12f61ad1a2a4b09992f61920c26ebed50c0f7e7e7c0060e5e0548a627f9802518c7841
-
Filesize
397KB
MD5e74b9a2b27333b020a2ec96538d185fb
SHA1868690e6d00606553d7b2a3c99f246c202a9b431
SHA25680da155a2f4391cce5d781a8070486ede8d70427ee81f84e065a23a560980532
SHA51286ebe956594ef2b37d1e87685c26d13a6479ff8c24182fc4e8490e8149ee4890f170663d9419ac0e814c65e00cfc79bd32697beccf8ae762fa1b5528a9f4bef3
-
Filesize
759B
MD50858f0181337b8dfb5186b2f579a4de2
SHA1dbc8875a05f5ec3c67d45aa47df429644cea52ed
SHA256b53ae4cca3f5df2939575cad3810877e3eaeb9ebd6cefad0316bcb624c95f58a
SHA5126a6906777ca60c07883ba8f41237ef7771db98cf8443635c0885151772c7c0a6e0784840c4ae743d3c3309f5c0ec99a7331ec86ba0d24d91895e00dd37c5947f
-
Filesize
255KB
MD5f2b9cc6a384d0b3392306ff2dd5703c1
SHA1611299c8eefb4f11626b03b8938a9ca81b0b4f03
SHA25666316a081286294ae8b9b9f9c24112aca24eac6ee9b46bc79a5b3d78c4b2bad3
SHA5125c315621e1de51e059870b88ea6454160e64c83f2e8254f7202154adfa1e463251c982fb45c97133b37cef6e58450e3d3c153c52515a7da944f514f2b68d724c
-
Filesize
954B
MD53f5f56964fd0cfdba44b7f5a4f4dd891
SHA1b80be9fab3803c62360998c3a3591e00129dd2d7
SHA256364a9867d43fdfc4c8ba749d08e0181c2c6c334a5cb552929a3e2ee69cadd25d
SHA512fbeaea81091092512dec35c48db9e8a7a5ca087bdca983838c35d84a2bd16991dec0b613a1599c87153e61f349f3ffc920a8ca69c5234c82cceaa375fe5b4690
-
Filesize
954B
MD57d2afad9d690355e36d0a3ac5500f0b8
SHA1ab714073f6db40b867bb865de989c263dfc27475
SHA2565bedd86865df2b2af3dbed933957ead8553b38ee73a001ec4764c71a43233367
SHA512b265a09a6c400b2a66fb006fa02d6d3113403a2ce91c4632bb8d711263f5914969b2c26bad62f89e9952099124832844f7ae19135df1190fc2ee31b7ff70d3d2
-
Filesize
4KB
MD5f2b4b0190b9f384ca885f0c8c9b14700
SHA1934ff2646757b5b6e7f20f6a0aa76c7f995d9361
SHA2560a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514
SHA512ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1
-
Filesize
512B
MD5fc5173bc21faefc6639ff87e4a71c504
SHA11b6ee03ea302f2dad2cbca466e3265962d9b567b
SHA25634347954101c346bbe899df91ecb7b5a3837de27e12fe3a3bf5c442e35624559
SHA5125b51996954b9bf211fe20328e0bbb1c5765260ba4d275411ba5c9799420e12d7a22dd6add94ecf3f1c586450914a4fd848b7453ba5dfd4f5ee0c799b34b70a14
-
Filesize
8KB
MD5d1a20fa1e7861c67afc1662a21ef7594
SHA17af247714c44f22ad5f4bdb369d3a05d03723547
SHA2565e31acf28f1d54ef2c925f08ac292d75bf709279b818bc0f4a7463717ad9f985
SHA51297040ed8f022089f91327f87353435f2da5d45884514c671f7930496389fc7710f70a5bca209e8290995eb1b7595164e0939e3b52ab52226f70e36851a283cb9
-
Filesize
16KB
MD57237409e0640cfab7bdbd429bf821a3b
SHA14c3da934842f8d4835dfe2a9c275a300e5123309
SHA2565c8e1b63d187efafe1e09bfadd83fd360176d689b57b5a0cc40e6854c12449fa
SHA512c8afaf6a8ee43ce3601feff417bfaec563c01bcff0aae24577054034112b2020967f25b0b1a919c3c9e5e81d62a21a87e908b782c4d5cb8bba8ac259108e9c1f
-
Filesize
16KB
MD5532ba5b738a379355ba22ce9e624fc5d
SHA1663c546bd94c81a5d26ce7019f59c4ca7bbd9850
SHA256293fe7ce4601f9740ac7c121f3d1c54c235b1346ad3631c11b99e15a3644bb56
SHA51284fd1a07f9b1c6b93ba459f225128c43587aa8ce6b3277f5515c16e8c780c0ee9a591bd63764ed665f9346812028c4b6b43e8454e3b254b8363e7f9dd519250e
-
Filesize
16KB
MD567a9a192726fd8d2f1f33485bac7cf87
SHA1762feb97ec018134ecd085dee2ea3eb0bd502412
SHA256a715b57f05b92b26c9a6355e941c2fc97ceb747113ba9366f72e007a5a325b71
SHA512f654dcdf04048cd324b53dfa50951258e80fbf03a2af75cac740fccb4f00b0ed256e055fe1e966aa4f03fd1493d86d7da7a3967d405091be64b210dceb5be98a
-
Filesize
16KB
MD535329b2478878d81378c65109591fd8f
SHA18bfef74dd72c699a007824129b1ea1662ea19e94
SHA2569c1609b28c618b6d61871880f4aa5a1b5b8a82b110dd34a13348e0f2bf24be74
SHA51204d0215ae2ebc16bd6ca9667b918c0abf5d3eb1c0d0fe6869aef1b42800346b24b9225e4ff865b553ab559a9c5560fe80892953dfabe03c8d15226ba5f76450d
-
Filesize
16KB
MD5f77b259a1ffd898f82ab9e828663b825
SHA1e71ad812cfacbadfc1753541a8570d1b5adf97d3
SHA256bc81f8e6c594d4cb28e241739a069eb33c575fd1dafe11ffd575da513a9560f2
SHA51203300c2f27b39ed9acc712a78d9e808207498c27139095fdbd37f870540faa512e89cb3064f5dd7a597a390beadfb8f2b43c2c86c2002149d25ab7987d6c2432
-
Filesize
16KB
MD55fbdd243431a734f0f062841d8267ba9
SHA14f4432cae25802003652801f68ac9c9ca75272e2
SHA2563360361e195c3c53f42ed2a1b3e4bf2c3b419b3828557db1ec204d2a0e45b345
SHA5128085291190709473c004b4ecaec7f512298bfea291bf194470d6412ba590d38eebabf8b6b34d955c3a301dfa048d9729f7123d07899a442f8a70b88ce0ec3a65
-
Filesize
512B
MD5e769d69c48c8b863a1208b451981c7f0
SHA1b028cd5b9868c6ed6b4b5801e506e1cbe46e8d9f
SHA2562496cae4e2bd7d0eed7b5bc6bb67bd292b229dd954ef34e697cbbe4d03f494fc
SHA512ac6ebde044affacf895765e434193524d93c5a86ee59195a89cf02249f79fe70f7d795e9583149ddeb744ad8dbda6fb3e8da18899f2709e00cb70f73abb6632c
-
Filesize
36KB
MD58ac6013afbe41daabf57503c99ee2391
SHA1e6e80d9cedfde236c4a557f931e38461ca8e4e89
SHA256a69cca4d1f4486f308cb195c2e71ba67a59469a8038f52f0d2c77920e2e0e76f
SHA512a44c2e8ad5750a46c65be28b3b76ba6cfe3f3e3c1730ffcb7d60d0ee5063fd38416d382cc68ce0557c010ef6b1cad937038614c297a60059b8cc6d67415d2fcb
-
Filesize
4KB
MD5f3c54b688545914f370cb5b38422433c
SHA11236ac04d0027a98f2d3c4d9a393be87eccdcaf7
SHA2563e57e8badabedceae6b6b883046ab5500dbe0a72b61f337e381827f66163e5fb
SHA5123f8746c263a89269c4e3b68138a36c9e4dfdd615b9c4ec2f6639262888e02143a6c2b4f5b7bdd9d2b018cf0e88ab77e90f2aafa95e32a54a2b2a8a2ce70edb5b
-
Filesize
4KB
MD589b4d4ec502b912b29b9650bf6f2d3c6
SHA1fbc36f3a6efd5e1051a51f87ac6ee166d73e69d1
SHA2560b0be4bb12fb266143eafa39e7e0cb152551d82b6f7f94f078fafee4a573a65b
SHA512cf91695724322b330ecff14a2ed138f82b9d66af3290344533c979b5c776fd72052977e8c86123a9594c13213a3b29fabf3b16ecd30f8fa47ea7655bd8322166
-
Filesize
4KB
MD5b3f7190e1fb6c6077a2d443f2fcae7a9
SHA182e5875cfde70592863aaab89a80f9352c9815bb
SHA2563cc56b059b96b477a81a91853c9344b9e4e389e19be80d28c93459dee97f2909
SHA5123b070e5ff0d97cf1ebc46ab6e6dc528901c7d0e1ef4820ef92e38ea7b715654864c236a4360db8702393f04486d98c6cae74a152a6d57ed375ddac2e787a6b1d
-
Filesize
4KB
MD5edb0436df002c7b61c8217fab8a615c6
SHA171dd35486340fdddb4b9ffacfd8630caf1526633
SHA256cdc657a84c1d34c37f053c4eb6da03d10163511d107a6dd2e23b98b275d84152
SHA512b7664918c9b333782f60cc3d080c1c75563f45e0f5db821d821b7f570dba584a3a17190fe3f460a6761cc2a698bcf866da246b60c4ad6aafe8d17ecbfb6e45ee
-
Filesize
4KB
MD587cf8dd13c4b64c10c60f36d3fb219a3
SHA130dad8046c397444227a9d08264b8186a142cf02
SHA25609066625c665bfaf799b251a8f238631ba39db6eeca738007f2e81808ac2c19a
SHA512ed8baad30b9c7b633d7aa8b12d361dd9ebde37ef4db40e8378b7062b4e580f38633233e0c3a62b0aa7db29e96a1acbfa06d6e180e14c88db3a7d244f22db608c
-
/data/data/com.protectstar.antivirus/files/.com.google.firebase.crashlytics/658E065502E2-0001-10B2-2172563614A1BeginSession.cls_temp
Filesize75B
MD5b4fd1951a26ee113a166789675ee6bd8
SHA19e2051e66e2632171d33f15d98d537bc234e1f5a
SHA25644d63d0109ad510ee0932ac76c05486becf586c8cc5384a30b570a48396b742e
SHA5123a2623f756a7dffa1bdc49e4552950dcc602f6f3633802e3c72fa5514b2a35c9489d155f84cf257c97c33e6a3f0a93f888e40c3617f07308fcc07d192acd759a
-
/data/data/com.protectstar.antivirus/files/.com.google.firebase.crashlytics/658E065502E2-0001-10B2-2172563614A1SessionApp.cls_temp
Filesize78B
MD591ebf8460e76a345262e2ce4fb252031
SHA1d3680b0a5dcc566c68ee317892741b190ab4228f
SHA25642ac988e1eeea98e07440ea15dca4f359830129bd0716a40f2bdd06b3d60c425
SHA512b5fa7024cd4f4bd88267b182268eb1bff7add2209622a0ff8cc592395e3aacb1401958d293904885366eee3b9e5c716befdc4d356b8bb171caf79a31c9da253d
-
/data/data/com.protectstar.antivirus/files/.com.google.firebase.crashlytics/658E065502E2-0001-10B2-2172563614A1SessionDevice.cls_temp
Filesize48B
MD5630aaf4621d940e95530e8a8b0d39283
SHA1d06c5d18de58b6abb5890a83b6fb3c3aa4a2139e
SHA2562f752007f6c33aaba282800edfe3d52da2ea954e3eceddf08efb0bfdc989cb93
SHA51298c301f0188ced6036a863ba790e03ba22f88ec55a884fdf808711147228e97ee0571abad094ad68d758b2482db6ee3f2950d43d56c875bfeda7f0a58cd1a86a
-
/data/data/com.protectstar.antivirus/files/.com.google.firebase.crashlytics/658E065502E2-0001-10B2-2172563614A1SessionOS.cls_temp
Filesize14B
MD59b3d4522944ce6396563812bfdb92fa9
SHA16d2a6133c8f01938a48ccc77ef86ad8ca335c020
SHA256d32805d685a3f50caa7f1c0bd7c8804c4d937a866513289f60e3184f7a591ed9
SHA512091d87643712530bf9006135db42a5a50742bb5ca3026bcc5f2c1c17bf4fd984a8938d29263b0abde3d15cac196d2230902534e200b0b79485e3a1bd97d95727
-
/data/data/com.protectstar.antivirus/files/.com.google.firebase.crashlytics/com.crashlytics.settings.json
Filesize720B
MD5b955d74a1cf7683ea103cbb97da81c34
SHA18ff22f5ededcfecd29af40a0c211ec8737703522
SHA256adb118a002291f90f713f528cb1e740f59b7a038b75b66ed823d1f2901697566
SHA5121594b7a169ca328dc845ec6ae27f0c7cc6d2a3685c579f3eb46ac6b9dd6116e7145ae166429246549a9830b082ea731f775a196ed7184e740f15f7160aeac173
-
/data/data/com.protectstar.antivirus/files/.com.google.firebase.crashlytics/log-files/crashlytics-userlog-658E065502E2-0001-10B2-2172563614A1.temp
Filesize198B
MD588b1c93c0087d767345acea8c71fd85e
SHA12352c525477e44efca17b66c1ac9edeef6a1fed3
SHA256223d8bdff43425c9491e9b4adddaf8954d521ba23a9c78d2f8d0fa16d51f6864
SHA5121aec43fcaf14105b7a8857032d0ff3d287b9953dede3cea8c664edb3d8e914ed17ffe31ca2595820a25129edafa0b08dd44112f824aa91f040aca652097ada29
-
/data/data/com.protectstar.antivirus/files/.com.google.firebase.crashlytics/log-files/crashlytics-userlog-658E065502E2-0001-10B2-2172563614A1.temp.tmp
Filesize16B
MD5c33583fae4e0b61cde1c5b9227963237
SHA1fe2ebe4d27469af1460f7e852031a04208ef629b
SHA25635c6d6e5b93657e4a741a1cec71c21813fe05aab219909ebbb0f62fb0ae648dc
SHA512fa09047004bec791b23f0dade0b64f8ab9bbd67555505e0d0818f6e89dfe56f474df80db0786d081d36adf23a5bacea40275ba043444a3a85d3d9612575bdd1e
-
/data/data/com.protectstar.antivirus/files/.com.google.firebase.crashlytics/report-persistence/sessions/658E065502E2000110B22172563614A1/report
Filesize753B
MD526d645cff0c2b1e8ba9f26fe2e7e9dd2
SHA1811bbf7be2e9ed7818ee947f4ded2a60cca41a16
SHA2561f2ed99a0820bedc63eb46801ffa1ca219e8f117763756f481826e0d215633c4
SHA512dfd01bd07d2db62a9ce7db7a68e2d7849fc42b98228ab3c2df5025d6062e87d58fe2970d769d0bb609568ad4c470c6caeec1ad9e389c37e3b7fc07c3baaec5ce
-
Filesize
90B
MD584d612bafa672160eca6f5204968d773
SHA1da9d7e5b554a3c60aad9f02fe091035be7519e27
SHA256a8458ccb93b47fdcf5559fc2eb3cbf5e97c143332eddeb9cda84afbb36b3ebed
SHA512232fc9e903d74e4f00d68b6af2599d83b064a29e36a25dbdcaa0fca197fe23d8e3456062ad047a4a31a5d3d3a4a67fff59afd3467968a98d679444ed0feb4b3c
-
Filesize
569B
MD54b15020b1896a6685e3856a8f8f4c227
SHA1296fff4b9a95a20105a6b6f56e21cf3b3ee2113e
SHA2566260e428d1ab9493da8c765a43a777120296e0b5031a728a22926b7b9e91652d
SHA512be1167d1401e1afd35319e5eddf3281d86a1c26dc07d92c655bf9334f073094a12d6f34ae669fd286c694f4e28912ae887e422a1a803419b103fe02e244093d3