420d5f544b73f52dba333c92601576f54b93be504bff774a745f2939d9453eb8

General

Target
a996f06e7525c43b6e6e19d4186be3ae.apk
Size 263KB
Sample240227-tpjxtadf35
SHA256 420d5f544b73f52dba333c92601576f54b93be504bff774a745f2939d9453eb8
MD5 a996f06e7525c43b6e6e19d4186be3ae
SHA1 c3c5a46b9f7fc88609339774f25d419f4f6116ac
SHA512 a28124e151b0a72cec81dada5ac68a336a211f9356637537d5fc179822b72a75a24c6799fe5c335b006ca13054784c1580ed042567e27dd8af0d958ade48159c
SSDEEP 6144:DfUPNvivXSCeVvnD2IJOsBFaw4IzEsS/ZXBc2Y4MT5fNK:Ci6tQIwsBFa/IvcR9UK
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

stealth trojan

Malware Config

Signatures

Removes its main activity from the application launcher 1 IoCs

stealth trojan

pid	Process
4241	com.okasa.ttdobgwz.fyopsjqtjg

Loads dropped Dex/Jar 2 IoCs

Runs executable file dropped to the device during analysis.

ioc	pid	Process
/data/user/0/com.okasa.ttdobgwz.fyopsjqtjg/app_tfile/fields.jar	4299	/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.okasa.ttdobgwz.fyopsjqtjg/app_tfile/fields.jar --output-vdex-fd=45 --oat-fd=46 --oat-location=/data/user/0/com.okasa.ttdobgwz.fyopsjqtjg/app_tfile/oat/x86/fields.odex --compiler-filter=quicken --class-loader-context=&
/data/user/0/com.okasa.ttdobgwz.fyopsjqtjg/app_tfile/fields.jar	4241	com.okasa.ttdobgwz.fyopsjqtjg

Uses Crypto APIs (Might try to encrypt user data) 1 IoCs

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	com.okasa.ttdobgwz.fyopsjqtjg

com.okasa.ttdobgwz.fyopsjqtjg
1⤵
- Removes its main activity from the application launcher
- Loads dropped Dex/Jar
- Uses Crypto APIs (Might try to encrypt user data)
PID:4241
- /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.okasa.ttdobgwz.fyopsjqtjg/app_tfile/fields.jar --output-vdex-fd=45 --oat-fd=46 --oat-location=/data/user/0/com.okasa.ttdobgwz.fyopsjqtjg/app_tfile/oat/x86/fields.odex --compiler-filter=quicken --class-loader-context=&
  2⤵
  - Loads dropped Dex/Jar
  PID:4299

com.okasa.ttdobgwz.fyopsjqtjg:RemoteProcess
1⤵
PID:4320

com.okasa.ttdobgwz.fyopsjqtjg:guard
1⤵
PID:4676

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

fields.jar

Path /data/data/com.okasa.ttdobgwz.fyopsjqtjg/app_tfile/fields.jar
Size 38KB
SHA256 e9ff86b6d3b34fdbb39636c8b08693738d66a0d02435de276d47e7cfe592e25e
MD5 408c5743c6ddc75bc8741d6310a60d52
SHA1 6cb02b4cacdb5278fb8ff1f7c90c7b6ee2087ced
SHA512 cde6a159948809763aac2e556393ebb58a5e3c31b39ff49e9e9fd229eb2f36d592eb48496977a5627ad4e52ff5d5cd2d7d36b3c1f53a280ee23d13f6f00ecbee
SSDEEP 768:mlmTO0Aicg6HAvTlO9ga+JLw1FF8fjB6UkLjDIm9Z+MDlPn9:KmRAic4blQgnLQ6jMUojcm9HD59
MD5 SHA1 SHA512 SSDEEP

Submit Download

tbcom.okasa.ttdobgwz.fyopsjqtjg

Path /data/data/com.okasa.ttdobgwz.fyopsjqtjg/databases/tbcom.okasa.ttdobgwz.fyopsjqtjg
Size 4KB
SHA256 0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514
MD5 f2b4b0190b9f384ca885f0c8c9b14700
SHA1 934ff2646757b5b6e7f20f6a0aa76c7f995d9361
SHA512 ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1
MD5 SHA1 SHA512

Submit Download

tbcom.okasa.ttdobgwz.fyopsjqtjg-journal

Path /data/data/com.okasa.ttdobgwz.fyopsjqtjg/databases/tbcom.okasa.ttdobgwz.fyopsjqtjg-journal
Size 512B
SHA256 d6e7bfcac1750b8dcd9b1c1becd3fa60a921562b7764a955066a346ffeee334d
MD5 663467e1ccf96658e3ec85d915837239
SHA1 42c654591238faf7ad7aa965b708e78775bb9673
SHA512 f723e7333a80deeee7c0d1ca5bf7b0508bfb40dffb2d072cec24f365dbf155beccdf2238bd70b3daa92e3f919f33f3858022e6555bec538ed03b026db1f6d811
MD5 SHA1 SHA512

Submit Download

tbcom.okasa.ttdobgwz.fyopsjqtjg-shm

Path /data/data/com.okasa.ttdobgwz.fyopsjqtjg/databases/tbcom.okasa.ttdobgwz.fyopsjqtjg-shm
Size 28KB
SHA256 18619b678a5c207a971a0aa931604f48162e307c57ecdec450d5f095fe9f32c7
MD5 cf845a781c107ec1346e849c9dd1b7e8
SHA1 b44ccc7f7d519352422e59ee8b0bdbac881768a7
SHA512 4802861ea06dc7fb85229a3c8f04e707a084f1ba516510c6f269821b33c8ee4ebf495258fe5bee4850668a5aac1a45f0edf51580da13b7ee160a29d067c67612
SSDEEP 3::
MD5 SHA1 SHA512 SSDEEP

Submit Download

tbcom.okasa.ttdobgwz.fyopsjqtjg-wal

Path /data/data/com.okasa.ttdobgwz.fyopsjqtjg/databases/tbcom.okasa.ttdobgwz.fyopsjqtjg-wal
Size 48KB
SHA256 22c08c318e28d7e894595eb4dd6e8385b4321ef137957f785a51772e24d466ac
MD5 8f8d5219a9620dff6dca226647e4122a
SHA1 c9151541596d5f8598b4693f64fa0a2517b56908
SHA512 c534fd9a253728a6a41359f3bd18e131b3674ed76cd3f6f0dd5b4800d83e02c3fdaa41dafd88bc25e6b9562dfe3a354421253c506bebf3e78a1c5fc2b49cca46
SSDEEP 24:KCYD+zyGSP/8diAEFPIOfl8M/LxIx2pq4WwHkuEHV6psLT0vGSP/mOfL:A+zNSP/1PZGqdIgpT1EHV6e8eSP/tL
MD5 SHA1 SHA512 SSDEEP

Submit Download

fields.jar

Path /data/user/0/com.okasa.ttdobgwz.fyopsjqtjg/app_tfile/fields.jar
Size 281KB
SHA256 71c5cdeeaea45916c993908370cb7b1d60911d8e233dc9d1def0e75915e4548e
MD5 4654f352b1b2095d54e0945af0e3948c
SHA1 4819b9827e70025c72a74869a85c996d92603931
SHA512 a58ba607dbdb9af50beb9bec719e24c7d4e457e6bd9a6ef71460b0ee629f002788ac8a93d2d18728304c695fca3ac000138f19427c064cd66c628dab8a839ce3
SSDEEP 3072:1pvE7Pwv2RBvfjst2seA29yiNYoBwwimVEAlkT0mTXZ6QzS5C/4260XQlb0rI5cL:LdUqtZ29yToCwFzkT0M4tQrBXRyOpd
MD5 SHA1 SHA512 SSDEEP

Download

fields.jar

Path /data/user/0/com.okasa.ttdobgwz.fyopsjqtjg/app_tfile/fields.jar
Size 281KB
SHA256 52132037e9b950a9cb48d6374ee2c6747a6bfe776e13a726395771f1b40ee9da
MD5 73b11c4c10150bbd4f29ad012dc11dde
SHA1 65c83ad32c29f9811c32eda75d7fcdc92ef42dda
SHA512 3e53b1ee22a00e60896da86d2695195e0965c93d190c4d1c0dba2eb5c611d670ee7693a9f8756858255e2b170cb82a753719dd4d6a827af437309b7a1dcc6f01
SSDEEP 3072:1pvE7Pwv2RBvf6O6V/xmK/EOrVLH1QhVHM4e1rSZV7IPelASJ0XQlb0rI5cVgZi7:LdUJaxyOBLejirHqxJQrBXRyOpd
MD5 SHA1 SHA512 SSDEEP

Download

sdsid

Path /storage/emulated/0/Download/sdsid
Size 4B
SHA256 fe675fe7aaee830b6fed09b64e034f84dcbdaeb429d9cccd4ebb90e15af8dd71
MD5 b8c37e33defde51cf91e1e03e51657da
SHA1 dd01903921ea24941c26a48f2cec24e0bb0e8cc7
SHA512 e3d0e2ef3cab0dab2c12f297e3bc618f6b976aced29b3a301828c6f9f1e1aabbe6dab06e1f899c9c2ae2ca86caa330115218817f4ce36d333733cb2b4c7afde7
MD5 SHA1 SHA512

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads