dd8a5a1a8632d661f152f435b7afba825e474ec0d03d1c5ef8669fdc2b484165

Resubmissions

14-02-2024 07:37

240214-jfx3zaea42 10

10-09-2021 11:39

210910-nsawesdbcl 10

Analysis

max time kernel
8s
max time network
127s
platform
android_x64
resource
android-33-x64-arm64-20231215-en
resource tags

androidarch:arm64arch:x64image:android-33-x64-arm64-20231215-enlocale:en-usos:android-13-x64system
submitted
14-02-2024 07:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

dd8a5a1a8632d661f152f435b7afba825e474ec0d03d1c5ef8669fdc2b484165.apk
Size

2.9MB
MD5

1698651d6b8fd95574f62b046b4f68e5
SHA1

ed0558bbfd7929cb4a28d6b095f68f26fcea4370
SHA256

dd8a5a1a8632d661f152f435b7afba825e474ec0d03d1c5ef8669fdc2b484165
SHA512

74d932cda56d661ade9dbf4ebcb0c092bee262a5475eded9b98010d00a97cbb6dc2083948e6ca568b238c1a801e52f096df35daa76160bfa8683bab41eb046a9
SSDEEP

49152:l3rn6XGN9GpBBCY2MTUf0JRBvZY5AN1dtX1Oqasd09Iqufd9BBT8AIubi0DEZKzG:l3D9kBBD24UgbG2brX1wsd0qfr7T8Aot

Score

8^/10

stealth trojan

Malware Config

Signatures

Removes its main activity from the application launcher 1 IoCs

stealth trojan

pid	Process
4198	com.clqg.sbtkqsb.ixrooga

Loads dropped Dex/Jar 1 IoCs

Runs executable file dropped to the device during analysis.

ioc	pid	Process
/data/user/0/com.clqg.sbtkqsb.ixrooga/code_cache/secondary-dexes/base.apk.classes1.zip	4198	com.clqg.sbtkqsb.ixrooga

Requests enabling of the accessibility settings. 1 IoCs

description	ioc	Process
Intent action	android.settings.ACCESSIBILITY_SETTINGS	com.clqg.sbtkqsb.ixrooga

Acquires the wake lock 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.clqg.sbtkqsb.ixrooga

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
12	api.ipify.org
13	api.ipify.org

com.clqg.sbtkqsb.ixrooga
1⤵
- Removes its main activity from the application launcher
- Loads dropped Dex/Jar
- Requests enabling of the accessibility settings.
- Acquires the wake lock
PID:4198

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

/data/user/0/com.clqg.sbtkqsb.ixrooga/code_cache/secondary-dexes/base.apk.classes1.zip

Filesize
1.8MB

MD5
3a37d9161a5fb141a103d43cea7ea958

SHA1
e579b581976eb284771c3c8736326e2380e74656

SHA256
2c8f41711f9c4f661f1fd8f7f28d347fc4ee0ff587019fa1b5991db9523749b1

SHA512
2907fcf135a20559e0a7b67aa43db3df0531f3ea93eb2260f67eef78311da3839476e363c3375b61b55861eca8605f1ef4a0bab07338bb7e78f0c80c5b2021d9

Download Submit
/data/user/0/com.clqg.sbtkqsb.ixrooga/code_cache/secondary-dexes/tmp-base.apk.classes8514568496970051098.zip

Filesize
163KB

MD5
2a14747d2e5fec478aa64abbaec04c8b

SHA1
69d7796cd4453876c6023fa92d62b77c2d4a2b09

SHA256
e4f1d0ac593835df5973a8b32e33a416938428de9d571ea9be506d6732c7d41b

SHA512
40d365a3b98f7adbe6c4f6bd18d0f9f5f10a4a595ec5e0420552adf5b03bf08ce1f254b091a0dd2ac147728ac8cad781d7dcafdca38c44c2c747b7f410cfd0dd

Download Submit