filecoder | 61f73bf90c3234faeb8aa7c90f24fa3f7a3a1d38b2e94d40ce96a21e7320fd28

Analysis

max time kernel
125s
max time network
131s
platform
android_x86
resource
android-x86-arm-20240221-en
resource tags

androidarch:armarch:x86image:android-x86-arm-20240221-enlocale:en-usos:android-9-x86system
submitted
23/02/2024, 14:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

61f73bf90c3234faeb8aa7c90f24fa3f7a3a1d38b2e94d40ce96a21e7320fd28.apk
Size

6.8MB
MD5

73d0f5db820e8b491365e3faa9b55498
SHA1

d5ef600aa1c01fa200ed46140c8308637f09dfcd
SHA256

61f73bf90c3234faeb8aa7c90f24fa3f7a3a1d38b2e94d40ce96a21e7320fd28
SHA512

796c47b244bf7d871eb0c0e43dd1b8eed86d15c00a5128ae7740bf87c0b5fcbe9787ee133f739ee0dd5986bee49075208bb768718db12590b2c7073ebe1ed89b
SSDEEP

196608:HSwZWQeHQZzcTK77FMQ+V+Y4Bz/JdLdJ3Uh3IwNde:H5ZwH80EJEv4h/9Shz7e

Score

10^/10

filecoder ransomware

Malware Config

Signatures

Filecoder.C
A ransomware family that spreads to other victims via SMS.
ransomware filecoder

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
4	pastebin.com
5	pastebin.com

Changes the wallpaper (common with ransomware activity). 1 IoCs

ransomware

description	ioc	Process
Framework service call	android.app.IWallpaperManager.setWallpaper	net.south.seven

Uses Crypto APIs (Might try to encrypt user data) 1 IoCs

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	net.south.seven

net.south.seven
1⤵
- Changes the wallpaper (common with ransomware activity).
- Uses Crypto APIs (Might try to encrypt user data)
PID:4173

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/data/system/users/0/wallpaper_orig

Filesize
88KB

MD5
c14441d34222027b653022d87f0ad84f

SHA1
04814901f61b5725eca3661b690791c4f3f415da

SHA256
12696196c1d9c5fbc185c023fb261d256b4112607cf3e1e213494b73d9a90d77

SHA512
166f721ab100ea57a24697b08a5758f77a8608d01d7e3490044af6e10d20dfafb98f4f6007770a79b3f8cd77147a79a57f3ddd3f9b76fde2c23ad778abc06f42

Download Submit