502fd61148b4b308bd444affb8737cb19ce3788c780b1818d258f5b34c9cd91e

Analysis

max time kernel
150s
max time network
145s
platform
android_x86
resource
android-x86-arm-20240221-en
resource tags

androidarch:armarch:x86image:android-x86-arm-20240221-enlocale:en-usos:android-9-x86system
submitted
12-03-2024 12:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c364e980178d3e4fb0c805ec65e49186.apk
Size

2.9MB
MD5

c364e980178d3e4fb0c805ec65e49186
SHA1

e70fbc4e3b93fd51d2a7b714bc4a502c0051da17
SHA256

502fd61148b4b308bd444affb8737cb19ce3788c780b1818d258f5b34c9cd91e
SHA512

6f11d59f45c2e9ab0b836590798fd12f70a3183e3a199c5a65393a2ab46795aa03543243354c277005ed4bdef8dd8601bf543fb4d0614d7889065bacdeef1756
SSDEEP

49152:S21otkWiLd8BsI+kcmNUG61Jnvq2fhpM5MdtwX4ts0lO6PDwBHUfUMDr:SOoKWiLd8BsI+kHNUG61w0MSwX4tpZsC

Score

7^/10

evasion

Malware Config

Signatures

Loads dropped Dex/Jar 1 TTPs 2 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/com.pranavpandey.rotation/cache/1582435991586.jar	4416	/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.pranavpandey.rotation/cache/1582435991586.jar --output-vdex-fd=134 --oat-fd=135 --oat-location=/data/user/0/com.pranavpandey.rotation/cache/oat/x86/1582435991586.odex --compiler-filter=quicken --class-loader-context=&
/data/user/0/com.pranavpandey.rotation/cache/1582435991586.jar	4291	com.pranavpandey.rotation

Uses Crypto APIs (Might try to encrypt user data) 1 IoCs

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	com.pranavpandey.rotation

com.pranavpandey.rotation
1⤵
- Loads dropped Dex/Jar
- Uses Crypto APIs (Might try to encrypt user data)
PID:4291
- /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.pranavpandey.rotation/cache/1582435991586.jar --output-vdex-fd=134 --oat-fd=135 --oat-location=/data/user/0/com.pranavpandey.rotation/cache/oat/x86/1582435991586.odex --compiler-filter=quicken --class-loader-context=&
  2⤵
  - Loads dropped Dex/Jar
  PID:4416

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.pranavpandey.rotation/cache/1582435991586.jar

Filesize
9KB

MD5
e8e0527a01aefdb89afd2c508f131da1

SHA1
f1103e6b260c657ceb3d95f1b023af3fda8b133a

SHA256
f809447486f89fcaa74f87e06d126d103d37eb2b3157e88f2c06d989b2c284ce

SHA512
fb53683a83f1068d0f94567b156e6a8910c45b1b5f33db919f7e0b9c55eab28507a235ef76d44d5b549599ea3b54dbc00496a633339d276a80f395da938d6d34

Download Submit
/data/data/com.pranavpandey.rotation/cache/oat/1582435991586.jar.cur.prof

Filesize
85B

MD5
9aaeb6976c5d0568a9968abac3b3dcbe

SHA1
695fca7bac7834cc30c3afc0c2b460da11463362

SHA256
e60517955427adbbec79a28e921cb4c6999008d31f105fef19e3e7d949295dd6

SHA512
ecc15406928e464e50d12767f50eadaedbe1327b74b5bf73a0a868f2bb403e017aafe0304244efac2a52a955f75bad493809fe7151d064e52484245e1cda9033

Download Submit
/data/data/com.pranavpandey.rotation/databases/OrientationModes.db

Filesize
4KB

MD5
f2b4b0190b9f384ca885f0c8c9b14700

SHA1
934ff2646757b5b6e7f20f6a0aa76c7f995d9361

SHA256
0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514

SHA512
ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1

Download Submit
/data/data/com.pranavpandey.rotation/databases/OrientationModes.db-journal

Filesize
512B

MD5
70fadd6b08f8b3e2af544dc23abd78c3

SHA1
b6868f1f84e8ac16a1322a0f072521f661b65db6

SHA256
1a89f35df471779cbcef2525be34a279c6f8065254e930fcf219832eea58437b

SHA512
7bad47d1205abefc6986292af5f5b8c0bf7bec34a16b0c2c0e16770e913612aa72d9e6ded63464538b990422187bee011c10e6f1ba90db55b9912e5519040a44

Download Submit
/data/data/com.pranavpandey.rotation/databases/OrientationModes.db-wal

Filesize
24KB

MD5
ebd13ba266232dfe4909c94091b3207d

SHA1
972e0aa3a79248ed1887b28ce0e4813df2ad7a62

SHA256
78e9faea68e7a1a00e543dda0e7ebfd5826f3fd3d57437cecf1b5ddad59fe944

SHA512
87e314b4a8956a5ec63425f3a02a3ea19209d99ec34eceb5543f11cb661b51fb15258a0637c86f8615adb3cd4a76c228d93dd84d13bc8fb089bcc14fc532489b

Download Submit
/data/user/0/com.pranavpandey.rotation/cache/1582435991586.jar

Filesize
20KB

MD5
2048eb6124a452540ee51dae4145aadf

SHA1
d05005b2cd7fe4cd652b0d7fd1bdac2c19d51451

SHA256
105c54b6fe3f25350e92187467761598e4c21d62b1091b77d091f65f3bd98864

SHA512
bb6cb3853dd2a5d0701e20607d4e153ae201268dd2e5e2d06cc2df208b3b4dc50132a4ab428251b1644d2399fcc717662438d082ff14203387bab8794109d44d

Download Submit
/data/user/0/com.pranavpandey.rotation/cache/1582435991586.jar

Filesize
20KB

MD5
fde2ee00cbd121cfab5290b078aa3ceb

SHA1
e2b77d5320e155e413d040a8c20020962065b2f8

SHA256
2897b0812077c654a9b3fbb0b6303d5cde681eeba7ad9981de65716c7810d685

SHA512
a9326aff8e454a2b4ac09984ef2a65fddd4dc146b4c44d839035549bff8c9fdaae490326d0b018f76c1ca2e4fb25426d74f550ca0950982fba632a023af99a56

Download Submit