Analysis
- max time kernel
87s - max time network
130s - platform
android_x86 - resource
android-x86-arm-20240221-en - resource tags
androidarch:armarch:x86image:android-x86-arm-20240221-enlocale:en-usos:android-9-x86system - submitted
14/03/2024, 10:21
General
- Target 7f2b749d050409f9081734c26e70eb47598aceea71ebdd85091a9f4607e588bb.apk
- Size 10.0MB
- Sample240314-mdt53she2x
- SHA256 7f2b749d050409f9081734c26e70eb47598aceea71ebdd85091a9f4607e588bb
- MD5 70134b12e0f118042293b6f8c28f90c9
- SHA1 8a9d11ba397ecab5748000900ad50a4a8dd0d681
- SHA512 387940dde6f04f068a3d265d9a854958fae1833e2ff74e3035dae7a57ec4291c42fde5efc57400d808f146faa5c40d3f56d3ada29b9adb352a53cc3972eea838
- SSDEEP 196608:v+DsCxYmCCly+PY/5SIWiBXHdnGkj4sL8mEp8T:6sCx3vQRS3aXHdGU4s3mg
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Checks Android system properties for emulator presence. 1 TTPs 1 IoCs
description ioc Process Accessed system property key: ro.hardware ru.homeaccounting.spendingandincome - Loads dropped Dex/Jar 1 TTPs 10 IoCs
Runs executable file dropped to the device during analysis.
ioc pid Process /data/user/0/ru.homeaccounting.spendingandincome/app_y6y0iwca680n5in6d2t9/spendingandincome.ext.jar 4191 ru.homeaccounting.spendingandincome /data/user/0/ru.homeaccounting.spendingandincome/app_y6y0iwca680n5in6d2t9/spendingandincome.dat.jar 4191 ru.homeaccounting.spendingandincome /data/user/0/ru.homeaccounting.spendingandincome/app_y6y0iwca680n5in6d2t9/spendingandincome.uni.jar 4191 ru.homeaccounting.spendingandincome /data/user/0/ru.homeaccounting.spendingandincome/app_y6y0iwca680n5in6d2t9/spendingandincome.stp.jar 4191 ru.homeaccounting.spendingandincome /data/user/0/ru.homeaccounting.spendingandincome/app_y6y0iwca680n5in6d2t9/ekzIpibaT.dex 4191 ru.homeaccounting.spendingandincome /data/user/0/ru.homeaccounting.spendingandincome/app_y6y0iwca680n5in6d2t9/spendingandincome.ext.jar 4191 ru.homeaccounting.spendingandincome /data/user/0/ru.homeaccounting.spendingandincome/app_y6y0iwca680n5in6d2t9/spendingandincome.stp.jar 4191 ru.homeaccounting.spendingandincome /data/user/0/ru.homeaccounting.spendingandincome/app_y6y0iwca680n5in6d2t9/spendingandincome.uni.jar 4191 ru.homeaccounting.spendingandincome /data/user/0/ru.homeaccounting.spendingandincome/app_y6y0iwca680n5in6d2t9/spendingandincome.dat.jar 4191 ru.homeaccounting.spendingandincome /data/user/0/ru.homeaccounting.spendingandincome/cache/1582435991586.jar 4191 ru.homeaccounting.spendingandincome - Reads information about phone network operator. 1 TTPs
- Uses Crypto APIs (Might try to encrypt user data) 1 IoCs
description ioc Process Framework API call javax.crypto.Cipher.doFinal ru.homeaccounting.spendingandincome
Processes
Network
MITRE ATT&CK Mobile v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path /data/data/ru.homeaccounting.spendingandincome/app_y6y0iwca680n5in6d2t9/ekzIpibaT.dex
- Size 2KB
- SHA256 d49ca634b2d7149c4580005bb69a847c159a016af929cf44bca10d943707db2d
- MD5 8e8dc815e2795ff0fa4c8aa314077436
- SHA1 c67125d5dcf4caf47fc73dd6e98310a56f6f490e
- SHA512 406c44fe67b665afad5ac88c3d5f5eee80582db0264d9752e8516de1f2ed29a8f80dcd3c6f223cb5f0a7639e329ba02c2f6e82d425bb8f51cd8ca318b4c36e50
- MD5 SHA1 SHA512
- Path /data/data/ru.homeaccounting.spendingandincome/app_y6y0iwca680n5in6d2t9/oat/spendingandincome.dat.jar.cur.prof
- Size 90B
- SHA256 40018745a08e50101d38c53df0d6543aad4b35d526ddd26ba27116bc0b8b2430
- MD5 2d4dd3af89b96e27e2ac8523a0143d7d
- SHA1 349fad4e5d7b9f7c8d3faec92258d95fc7634c90
- SHA512 7c656baa419762fea5e465f680d6d1e0734eeb714f64ea25dea1457d7225962b9ab94f0bc64c640b5fbaa2344872424f653c9b8299818d10120306fc3df67877
- MD5 SHA1 SHA512
- Path /data/data/ru.homeaccounting.spendingandincome/app_y6y0iwca680n5in6d2t9/oat/spendingandincome.ext.jar.cur.prof
- Size 791B
- SHA256 b92abb5fc0f69124cf0d17b5f5c62321d537ba251b39ac749cb7ec68d4897cc1
- MD5 4bca712a380de1cf6d595b011a890db1
- SHA1 5ea9a0559ea90472a8b3aa2c31c05a945f828886
- SHA512 c6610519a33aa94052e307b8f102561f0c66efa945d9c605a2ed7fa92f555c82933e3f2f4703f084ebcf1f68e123e013a6ea338f3ac71befe689593b5011ad70
- MD5 SHA1 SHA512
- Path /data/data/ru.homeaccounting.spendingandincome/app_y6y0iwca680n5in6d2t9/oat/spendingandincome.uni.jar.cur.prof
- Size 132B
- SHA256 262ba4601314d15b1426513848d9974e921157c6ff538e94356269c8145b9bac
- MD5 b8f454c2da76e96eadaa0f2e9cc5343c
- SHA1 17af396d8c18b789afa315a6324990088a07ff16
- SHA512 4b6acb5ed3fe3d8f2137d5d2259db1f285b2f3c54ae23121b1bbe70a5610678407d3fe625ea22b6681fe6a9e61da15306df47ed46945480fb95838d919b0fe11
- MD5 SHA1 SHA512
- Path /data/data/ru.homeaccounting.spendingandincome/app_y6y0iwca680n5in6d2t9/spendingandincome.dat.jar
- Size 2KB
- SHA256 cadecfa4eb81864aa8a81a73381248e518c24eda1e7170cc5b17f536829c6fec
- MD5 433bf7b2915bac63eab355a2916b78e2
- SHA1 7ae732bd8ec537f11c7dbec1089b78cf6c5d1e0b
- SHA512 53e5d8296355c31516a0c440b359bfffdae77a833bb9ec5cf9f83411e301e2044c34b269594e7940350f8576a8bba8bd5acab0394f3ec425cbf8687342c1908c
- MD5 SHA1 SHA512
- Path /data/data/ru.homeaccounting.spendingandincome/app_y6y0iwca680n5in6d2t9/spendingandincome.ext.jar
- Size 2.5MB
- SHA256 acf86d713ee1267bda4169175893237addea1ac36956451c71123a6d41bef094
- MD5 f37180decaf253f8e5bd9db2f40290b8
- SHA1 c780cc4bd6e1adc2ac66234701c690c6b44ed7bd
- SHA512 b45de8adc808265ae27704c73dbe6c8b20091401fe29b9068a5c60c08afa3e988e922961da5b7a878fa3dd53f4ecbc26b3c6339fb26a33cd4fbfd209775fc170
- SSDEEP 49152:mB+lvdW/FfK0oyJi4Wi09KjBgmdbp639VL8cO5syv6Ncty5oKWAa:BlqVG4Wi8UBtVg9VL8D5hFKQ
- MD5 SHA1 SHA512 SSDEEP
- Path /data/data/ru.homeaccounting.spendingandincome/app_y6y0iwca680n5in6d2t9/spendingandincome.stp.jar
- Size 460KB
- SHA256 57f308d0631319a36ae987584374182c4acfc7b04ebf225087eb1b43e0947f8b
- MD5 da93467530c3bb5d8e6ab6fb5b1a3282
- SHA1 5b334488c717f5b9e8cbbaa5fde499ed03deabf0
- SHA512 43a334eb9202ef6227045665494b4978cdfcf571108e2de93acd52ae31994252e181913d282ff642d00954404c8ea78f1d97170bcd6c9bbc34349ead2e62ae25
- SSDEEP 12288:3qxe5YqoQG1Kfuvy/CB2X/7ukSBnMq+7AVX/90vd:axeOfKf1/CB0KkSB7VFgd
- MD5 SHA1 SHA512 SSDEEP
- Path /data/data/ru.homeaccounting.spendingandincome/app_y6y0iwca680n5in6d2t9/spendingandincome.uni.jar
- Size 168KB
- SHA256 8a28c20664f529023074912f45fd08f5f0b70617451af9994cda5bd540f77054
- MD5 5f0964ed7e7291d5f555c96c8206e867
- SHA1 dc59fbbd7064318eb04ad480982385f03776a128
- SHA512 2d67f11c458da010c825c89ea8bf636c1c54da0da67616ae223d448fb17e46d96b0cbac721a572cdaba1abbef40e4c9b4e2cffa62df1c64dc672e3ca42353cb1
- SSDEEP 3072:ZyrcttQ9tkLNPyeMPIZfqt8QBTH8z1qVUCRrH+3l8OW0xIL1yyS:ZrYukDwZfqeQJj9Fe18OW0Y4
- MD5 SHA1 SHA512 SSDEEP
- Path /data/data/ru.homeaccounting.spendingandincome/cache/1582435991586.jar
- Size 9KB
- SHA256 f809447486f89fcaa74f87e06d126d103d37eb2b3157e88f2c06d989b2c284ce
- MD5 e8e0527a01aefdb89afd2c508f131da1
- SHA1 f1103e6b260c657ceb3d95f1b023af3fda8b133a
- SHA512 fb53683a83f1068d0f94567b156e6a8910c45b1b5f33db919f7e0b9c55eab28507a235ef76d44d5b549599ea3b54dbc00496a633339d276a80f395da938d6d34
- SSDEEP 192:uGJqbQwgQYuNUnEV4bAa0s/ombgmdxjX5fGpTVHb3qX:LkMwTTNdlns/ombJB
- MD5 SHA1 SHA512 SSDEEP
- Path /data/data/ru.homeaccounting.spendingandincome/databases/a
- Size 4KB
- SHA256 0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514
- MD5 f2b4b0190b9f384ca885f0c8c9b14700
- SHA1 934ff2646757b5b6e7f20f6a0aa76c7f995d9361
- SHA512 ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1
- MD5 SHA1 SHA512
- Path /data/data/ru.homeaccounting.spendingandincome/databases/a-journal
- Size 512B
- SHA256 c0ba948108c38cbfb31d17cf5663f202325f52d812331c240ec28e9c7c006dec
- MD5 990cf024f6cdd003600769b6956fe78c
- SHA1 2140f1bb2ad1533ab2940ce1ed41bd06a47364ee
- SHA512 43ea2d069747e1376df1f11935354f7bd89804dbe9eeafbf9db82206716c077df02b99a7f1afd798404f55a2b4772a34baced5900bae153876c7afcce1b9ff9d
- MD5 SHA1 SHA512
- Path /data/data/ru.homeaccounting.spendingandincome/databases/a-wal
- Size 16KB
- SHA256 7c2d779270f5ba04b15c109a75a626c25c363524b4e8697ede470f8c229b2013
- MD5 f9a02d23481d65147d46b86d70b44c41
- SHA1 8f858cd5edd68604a72529ae380a0c1e404f85ef
- SHA512 b94bb648d471f9acf000c73f4d68e24fcbb52966f1ef9ba42f2dae479c38fdda3655361fbf1d0226457cd72ec0d86cec5895f9f0c9896810196de6450fe41ce5
- SSDEEP 12:KbeAbHeRqzdTRmBEyPbP/+mtcmT8czVOw2:KbeFRqzyGSP/hZzR2
- MD5 SHA1 SHA512 SSDEEP
- Path /data/data/ru.homeaccounting.spendingandincome/databases/allowListManager-journal
- Size 512B
- SHA256 92ef6ac471eb2c7080f7317204c9a08e3a171fae185bd10b051e082f6630c513
- MD5 fff5b7341a5cac396c8116ce0faadd03
- SHA1 a424af094d8c3b9ecc79b5a44e34bc3465ef97b4
- SHA512 465c43cf3d004ab6b8187f49cef5051d19ee1b8de30ecf220c367ea422c8c191236700929f54a316aa5a71ca3902f60a391971df8364873ea41d10905a1496cc
- MD5 SHA1 SHA512
- Path /data/data/ru.homeaccounting.spendingandincome/databases/allowListManager-wal
- Size 28KB
- SHA256 7731ba0694849125e4cdd79e42590674f19de9056d985943f599a16241309288
- MD5 ee2db97608d832161b2ea4d7ef59aa9d
- SHA1 3aa35f54e9514ca72e85c05391983283408bcfd1
- SHA512 2364048ef98ce9749ac47290dbae44c6e7cad70a83f90127bad5e6cf06cf24f4d8b39479121985d75d83739c8b91ae377c317b9c753538dc833e6a1d80345394
- SSDEEP 12:Kwt5RhzdTRmBEyPbP/o5BDAcUWOwClfCgEkwlrCNGwPRmBEyPbP/omIt3:KwbzyGSP/41Z2NpkGSP/a
- MD5 SHA1 SHA512 SSDEEP
- Path /data/data/ru.homeaccounting.spendingandincome/databases/bookmarkManager-journal
- Size 512B
- SHA256 03cd9726f197a2326189417a5c8cb2a279c24edf874f23d7d036a14ff5c1ee8c
- MD5 1e048cfe95bb5b4a66f6ed5095155804
- SHA1 6b48affb6725a58df26a4d329bd89d5454f64aad
- SHA512 bb4ea476f76952bef852b2f66b187d59f7eb0445ea856ad50a16d4e1a5f503c162f3ef56c6c3b1a00418870b58cfaf0f216d1ce3fcca96a0a1d56c0442ed118e
- MD5 SHA1 SHA512
- Path /data/data/ru.homeaccounting.spendingandincome/databases/bookmarkManager-shm
- Size 28KB
- SHA256 18619b678a5c207a971a0aa931604f48162e307c57ecdec450d5f095fe9f32c7
- MD5 cf845a781c107ec1346e849c9dd1b7e8
- SHA1 b44ccc7f7d519352422e59ee8b0bdbac881768a7
- SHA512 4802861ea06dc7fb85229a3c8f04e707a084f1ba516510c6f269821b33c8ee4ebf495258fe5bee4850668a5aac1a45f0edf51580da13b7ee160a29d067c67612
- SSDEEP 3::
- MD5 SHA1 SHA512 SSDEEP
- Path /data/data/ru.homeaccounting.spendingandincome/databases/bookmarkManager-wal
- Size 32KB
- SHA256 ba01ac137a15df33a3ce527f1d6b8378a53545ccf7985f90c9dcec2042d65e42
- MD5 08e0ade5c13006b296ecde9f5d8481f2
- SHA1 e6cefd40f93e025bcf95f9a0223ce43508bbc3a5
- SHA512 ead2811e9c5b5bb7cc17957977b0d4622a80fd43fdde4463d162238e7cbabaa94aa08814ecb70e9bdf4e5bdc2b6405f43dbf3bf71310e369c49c918ee11a75ec
- SSDEEP 24:Kq8szyGSP/eXP4JSCZ8Y8RkIRYTcGSP/fyR9Vk29PreXw2IVA:btzNSP/e/QSQh8RZcbSP/fy7Vk2g3T
- MD5 SHA1 SHA512 SSDEEP
- Path /data/data/ru.homeaccounting.spendingandincome/databases/spendingandincome.db
- Size 3.3MB
- SHA256 0bf9a2e2ba60b93885acc5133102d754d1818a846a82207a16e218c9b39a426b
- MD5 44c4067ccf1e71f3177f779423c010b0
- SHA1 a4aa976dc09f6870c8e60b74ba03590bb3325878
- SHA512 241f261b225ee9215481f15914ca0664743993637cc94a76161e23b32e36f408f4af5d71fb00cf0676cd437334e142c36b4bce83d03237a9eced0fdeba64d764
- SSDEEP 98304:x3xNV2C6IHbh/MQnRxIO8HT7CQBxvUaQ4:hxjT6IHaMxw6sH5
- MD5 SHA1 SHA512 SSDEEP
- Path /data/data/ru.homeaccounting.spendingandincome/databases/spendingandincome.db-journal
- Size 1KB
- SHA256 736f21c35ef69269cde3a9c4bb934864e592fee0c34f04a3fc427458facb1de4
- MD5 d55827fafeadd1dc7b40f4932d599224
- SHA1 788150dc6bd17514113464cca91e2695e51bd69b
- SHA512 a3245f68eb9243c2a6f911808381ed309e4d54e9926aae3cdecb06dff84a0baa312d31811ae2597872563c9e7b80a7646e3464e4407dc86585decba7713aab4f
- MD5 SHA1 SHA512
- Path /data/data/ru.homeaccounting.spendingandincome/files/homepage.html
- Size 3KB
- SHA256 9083857723f9f6cb195a29583479b670be58e03162ebb1f85170f928fa4854f8
- MD5 31820480a8ca17632fe118e3f7609e94
- SHA1 3c1e55d741cf9b6c552c4fb5ca06ec2ac4d1e96e
- SHA512 dc4e03852609893fedd73924daa28f17c4ad5b53fa6a70ec1dc4f2b8fcf1fd8dbb3153d03a03d6ca9bb8f4ceaa1f3687ddc9a00831b27a69c49d39165c133fe7
- MD5 SHA1 SHA512
- Path /data/user/0/ru.homeaccounting.spendingandincome/app_y6y0iwca680n5in6d2t9/ekzIpibaT.dex
- Size 4KB
- SHA256 a07882c232965dee0bfda069ab7f7aecd101e3d4196d493972b48c3a4586a81d
- MD5 f1f02b61f1d51ee6e9bd2b10a829a1f8
- SHA1 dbfdb0ce9b13378e1591ac0add74c969a1a8c567
- SHA512 3b77377514c6efdcf8370553e3c763327e6844af72ab056083f0830f5efe03cafb8f68b205d5cf6ffccc8d670b40fd97f8c998bf5a19438209f6cc0943ee4272
- SSDEEP 96:nme9O7b1yoMmRo9QoBzgngalnWquornNKg4y:n5qxyoFRoNqgWrnNv4y
- MD5 SHA1 SHA512 SSDEEP
- Path /data/user/0/ru.homeaccounting.spendingandincome/app_y6y0iwca680n5in6d2t9/spendingandincome.dat.jar
- Size 6KB
- SHA256 fdb7cd537a8eb2aea1fe440463acdcb4334b4ace26e1a4af41472c894dc2850e
- MD5 10e381d012b281cfad565005f3e0e41a
- SHA1 1b2ced2018fba87cec8327094265320270fda661
- SHA512 b7a7ee8debc329dc64c2ad4dbc37cc045906b4e2e94ef22133278a35686077af40f13105a55318d968d0f249ce55984290b438b427afc6d03683c10cd741ab19
- SSDEEP 192:xQuG1WN7wyz1oySaLl7U7qQ+jdHA6zedIzTQlVgRgI7M2DytQIBQkpgG1NSsq/:xQH1WN7wyz1RSaLl7UOQ+jdgXdGTMOoi
- MD5 SHA1 SHA512 SSDEEP
- Path /data/user/0/ru.homeaccounting.spendingandincome/app_y6y0iwca680n5in6d2t9/spendingandincome.ext.jar
- Size 6.3MB
- SHA256 cd2966804df2089bde686ea41a3aa3c48f641f080633b28cc9f1978a6b3c0164
- MD5 f8ebc93ab7be46a69a0774c7550089e5
- SHA1 a93cb68c8a570bae2da6ecc0db3368ec18df6370
- SHA512 4bc01d971f01c8f02902ee03209e5de98cd7db568253fe17f8cee729588c96c37048a5e5c4e5ce557201047a151993adfe60c28acbbde4927feeca431168eb93
- SSDEEP 49152:2qnIbUSphYHN4ODK0uu0Ndi47lQ95eYr5G0Hcz3Z5zfzSRojYYD:2qnoxwQim7SAYk
- MD5 SHA1 SHA512 SSDEEP
- Path /data/user/0/ru.homeaccounting.spendingandincome/app_y6y0iwca680n5in6d2t9/spendingandincome.stp.jar
- Size 1.1MB
- SHA256 31fdc6c48124540edf532fa66a36652f997ec505662320abc3738a8308c3fe4a
- MD5 49b91e17f8168f2d406b5cd32e34c9b4
- SHA1 96054ee16e5dccae6de5b42395813fe5cbae0a4a
- SHA512 d4117115f9e6fdef2ace6724d984f60e7e054f7423195bd2cac22c22101052070c29e1350c9dbe5869b067d64c5e29fe86671757f484ac04db2102e712115193
- SSDEEP 24576:KXT1ensDmaXCs6wsp9Z6wG1RASkMDs3Uyp5CrWeu0GTEbpYTvZgq:KpeCJsp6WTF
- MD5 SHA1 SHA512 SSDEEP
- Path /data/user/0/ru.homeaccounting.spendingandincome/app_y6y0iwca680n5in6d2t9/spendingandincome.uni.jar
- Size 424KB
- SHA256 adde7822a6f4b22b80e8348fe09d9d716e2f8519b8be926598a53463f43b569f
- MD5 3f5d5ab5cc80ae55dca1719549dc3627
- SHA1 fc1a5e8b43ddd46c4d301127f9c2e07a613809f5
- SHA512 885988fb4fb5b0a0b4c9b5f067c5b36a7fb7b731def6bbd3860832da215f19911b9a064973f74180461bace2bd04a2735142bb770783cb46e1b1d87c728497dc
- SSDEEP 6144:+t3vhBN8jp2fROWKWHokDdkXk1k5cYsbb2LFucXs9Ww+6AfeDFiZeb6JKxwr90:svZryXbiAMcXsNAfeQAf+C
- MD5 SHA1 SHA512 SSDEEP
- Path /data/user/0/ru.homeaccounting.spendingandincome/cache/1582435991586.jar
- Size 20KB
- SHA256 2897b0812077c654a9b3fbb0b6303d5cde681eeba7ad9981de65716c7810d685
- MD5 fde2ee00cbd121cfab5290b078aa3ceb
- SHA1 e2b77d5320e155e413d040a8c20020962065b2f8
- SHA512 a9326aff8e454a2b4ac09984ef2a65fddd4dc146b4c44d839035549bff8c9fdaae490326d0b018f76c1ca2e4fb25426d74f550ca0950982fba632a023af99a56
- SSDEEP 384:Za0jn+huC5sMvRuvypj6f2ZzJgm+poK+l8m4qxXpj/7wyxBLBiok+9VQ3AKm8:ZU5sMvu/f2/gm+pDAPzj/Dip+9y3AK7
- MD5 SHA1 SHA512 SSDEEP