Analysis
- max time kernel
61s - max time network
143s - platform
android_x64 - resource
android-x64-20240221-en - resource tags
androidarch:x64arch:x86image:android-x64-20240221-enlocale:en-usos:android-10-x64system - submitted
10/03/2024, 22:07
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
45406be65d10301adc856fdb6e36946deb08a601a0bfd2f07647a5dd0e7745fb.apk
Resource
android-x86-arm-20240221-en
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
45406be65d10301adc856fdb6e36946deb08a601a0bfd2f07647a5dd0e7745fb.apk
Resource
android-x64-20240221-en
4 signatures
150 seconds
General
- Target 45406be65d10301adc856fdb6e36946deb08a601a0bfd2f07647a5dd0e7745fb.apk
- Size 249KB
- Sample240310-116dhsdb6s
- SHA256 45406be65d10301adc856fdb6e36946deb08a601a0bfd2f07647a5dd0e7745fb
- MD5 201122305823e0daee4643e2e0a538ce
- SHA1 0c841d726241bfa35d31ac6b8067451004f14364
- SHA512 3f75115a03795c089d0f8e6f71dc8575e8ed3c67812a9a5987c06a8277e81cf9e00ee3cd582df817cac659883abdf618cd6854285091984e1a5de7fcac40f0e7
- SSDEEP 6144:YVsoarqTj6Izm+gPYajJVf9J27+KBmtAFC8XNDuafnylFq8RXJ9SNWY:z1rMj6I6+jaVc73UupAFDtSwY
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs 1 IoCs
description ioc Process Framework service call android.content.pm.IPackageManager.getInstalledApplications fsdfsdf.gsdsfsf.fsdfsdf.lbljhkjblkjblkjblkj -
pid Process 5065 fsdfsdf.gsdsfsf.fsdfsdf.lbljhkjblkjblkjblkj - Reads information about phone network operator. 1 TTPs
- Uses Crypto APIs (Might try to encrypt user data) 1 IoCs
description ioc Process Framework API call javax.crypto.Cipher.doFinal fsdfsdf.gsdsfsf.fsdfsdf.lbljhkjblkjblkjblkj
Processes
-
fsdfsdf.gsdsfsf.fsdfsdf.lbljhkjblkjblkjblkj1⤵
- Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)
- Removes its main activity from the application launcher
- Uses Crypto APIs (Might try to encrypt user data)
PID:5065
-
fsdfsdf.gsdsfsf.fsdfsdf.lbljhkjblkjblkjblkj:rt1⤵PID:5736