Analysis

  • max time kernel
    87s
  • max time network
    130s
  • platform
    android_x86
  • resource
    android-x86-arm-20240221-en
  • resource tags

    androidarch:armarch:x86image:android-x86-arm-20240221-enlocale:en-usos:android-9-x86system
  • submitted
    14/03/2024, 10:21

General

  • Target
    7f2b749d050409f9081734c26e70eb47598aceea71ebdd85091a9f4607e588bb.apk
  • Size 10.0MB
  • Sample240314-mdt53she2x
  • SHA256 7f2b749d050409f9081734c26e70eb47598aceea71ebdd85091a9f4607e588bb
  • MD5 SHA1 SHA512 SSDEEP
Score
7/10

Malware Config

Signatures

  • Checks Android system properties for emulator presence. 1 TTPs 1 IoCs
  • Loads dropped Dex/Jar 1 TTPs 10 IoCs

    Runs executable file dropped to the device during analysis.

  • Reads information about phone network operator. 1 TTPs
  • Uses Crypto APIs (Might try to encrypt user data) 1 IoCs

Processes

  • ru.homeaccounting.spendingandincome
    1⤵
    • Checks Android system properties for emulator presence.
    • Loads dropped Dex/Jar
    • Uses Crypto APIs (Might try to encrypt user data)
    PID:4191

Network

        MITRE ATT&CK Mobile v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        ekzIpibaT.dex

        • Path /data/data/ru.homeaccounting.spendingandincome/app_y6y0iwca680n5in6d2t9/ekzIpibaT.dex
        • Size 2KB
        • SHA256 d49ca634b2d7149c4580005bb69a847c159a016af929cf44bca10d943707db2d
        • MD5 SHA1 SHA512

        spendingandincome.dat.jar.cur.prof

        • Path /data/data/ru.homeaccounting.spendingandincome/app_y6y0iwca680n5in6d2t9/oat/spendingandincome.dat.jar.cur.prof
        • Size 90B
        • SHA256 40018745a08e50101d38c53df0d6543aad4b35d526ddd26ba27116bc0b8b2430
        • MD5 SHA1 SHA512

        spendingandincome.ext.jar.cur.prof

        • Path /data/data/ru.homeaccounting.spendingandincome/app_y6y0iwca680n5in6d2t9/oat/spendingandincome.ext.jar.cur.prof
        • Size 791B
        • SHA256 b92abb5fc0f69124cf0d17b5f5c62321d537ba251b39ac749cb7ec68d4897cc1
        • MD5 SHA1 SHA512

        spendingandincome.uni.jar.cur.prof

        • Path /data/data/ru.homeaccounting.spendingandincome/app_y6y0iwca680n5in6d2t9/oat/spendingandincome.uni.jar.cur.prof
        • Size 132B
        • SHA256 262ba4601314d15b1426513848d9974e921157c6ff538e94356269c8145b9bac
        • MD5 SHA1 SHA512

        spendingandincome.dat.jar

        • Path /data/data/ru.homeaccounting.spendingandincome/app_y6y0iwca680n5in6d2t9/spendingandincome.dat.jar
        • Size 2KB
        • SHA256 cadecfa4eb81864aa8a81a73381248e518c24eda1e7170cc5b17f536829c6fec
        • MD5 SHA1 SHA512

        spendingandincome.ext.jar

        • Path /data/data/ru.homeaccounting.spendingandincome/app_y6y0iwca680n5in6d2t9/spendingandincome.ext.jar
        • Size 2.5MB
        • SHA256 acf86d713ee1267bda4169175893237addea1ac36956451c71123a6d41bef094
        • MD5 SHA1 SHA512 SSDEEP

        spendingandincome.stp.jar

        • Path /data/data/ru.homeaccounting.spendingandincome/app_y6y0iwca680n5in6d2t9/spendingandincome.stp.jar
        • Size 460KB
        • SHA256 57f308d0631319a36ae987584374182c4acfc7b04ebf225087eb1b43e0947f8b
        • MD5 SHA1 SHA512 SSDEEP

        spendingandincome.uni.jar

        • Path /data/data/ru.homeaccounting.spendingandincome/app_y6y0iwca680n5in6d2t9/spendingandincome.uni.jar
        • Size 168KB
        • SHA256 8a28c20664f529023074912f45fd08f5f0b70617451af9994cda5bd540f77054
        • MD5 SHA1 SHA512 SSDEEP

        1582435991586.jar

        • Path /data/data/ru.homeaccounting.spendingandincome/cache/1582435991586.jar
        • Size 9KB
        • SHA256 f809447486f89fcaa74f87e06d126d103d37eb2b3157e88f2c06d989b2c284ce
        • MD5 SHA1 SHA512 SSDEEP

        a

        • Path /data/data/ru.homeaccounting.spendingandincome/databases/a
        • Size 4KB
        • SHA256 0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514
        • MD5 SHA1 SHA512

        a-journal

        • Path /data/data/ru.homeaccounting.spendingandincome/databases/a-journal
        • Size 512B
        • SHA256 c0ba948108c38cbfb31d17cf5663f202325f52d812331c240ec28e9c7c006dec
        • MD5 SHA1 SHA512

        a-wal

        • Path /data/data/ru.homeaccounting.spendingandincome/databases/a-wal
        • Size 16KB
        • SHA256 7c2d779270f5ba04b15c109a75a626c25c363524b4e8697ede470f8c229b2013
        • MD5 SHA1 SHA512 SSDEEP

        allowListManager-journal

        • Path /data/data/ru.homeaccounting.spendingandincome/databases/allowListManager-journal
        • Size 512B
        • SHA256 92ef6ac471eb2c7080f7317204c9a08e3a171fae185bd10b051e082f6630c513
        • MD5 SHA1 SHA512

        allowListManager-wal

        • Path /data/data/ru.homeaccounting.spendingandincome/databases/allowListManager-wal
        • Size 28KB
        • SHA256 7731ba0694849125e4cdd79e42590674f19de9056d985943f599a16241309288
        • MD5 SHA1 SHA512 SSDEEP

        bookmarkManager-journal

        • Path /data/data/ru.homeaccounting.spendingandincome/databases/bookmarkManager-journal
        • Size 512B
        • SHA256 03cd9726f197a2326189417a5c8cb2a279c24edf874f23d7d036a14ff5c1ee8c
        • MD5 SHA1 SHA512

        bookmarkManager-shm

        • Path /data/data/ru.homeaccounting.spendingandincome/databases/bookmarkManager-shm
        • Size 28KB
        • SHA256 18619b678a5c207a971a0aa931604f48162e307c57ecdec450d5f095fe9f32c7
        • MD5 SHA1 SHA512 SSDEEP

        bookmarkManager-wal

        • Path /data/data/ru.homeaccounting.spendingandincome/databases/bookmarkManager-wal
        • Size 32KB
        • SHA256 ba01ac137a15df33a3ce527f1d6b8378a53545ccf7985f90c9dcec2042d65e42
        • MD5 SHA1 SHA512 SSDEEP

        spendingandincome.db

        • Path /data/data/ru.homeaccounting.spendingandincome/databases/spendingandincome.db
        • Size 3.3MB
        • SHA256 0bf9a2e2ba60b93885acc5133102d754d1818a846a82207a16e218c9b39a426b
        • MD5 SHA1 SHA512 SSDEEP

        spendingandincome.db-journal

        • Path /data/data/ru.homeaccounting.spendingandincome/databases/spendingandincome.db-journal
        • Size 1KB
        • SHA256 736f21c35ef69269cde3a9c4bb934864e592fee0c34f04a3fc427458facb1de4
        • MD5 SHA1 SHA512

        homepage.html

        • Path /data/data/ru.homeaccounting.spendingandincome/files/homepage.html
        • Size 3KB
        • SHA256 9083857723f9f6cb195a29583479b670be58e03162ebb1f85170f928fa4854f8
        • MD5 SHA1 SHA512

        ekzIpibaT.dex

        • Path /data/user/0/ru.homeaccounting.spendingandincome/app_y6y0iwca680n5in6d2t9/ekzIpibaT.dex
        • Size 4KB
        • SHA256 a07882c232965dee0bfda069ab7f7aecd101e3d4196d493972b48c3a4586a81d
        • MD5 SHA1 SHA512 SSDEEP

        spendingandincome.dat.jar

        • Path /data/user/0/ru.homeaccounting.spendingandincome/app_y6y0iwca680n5in6d2t9/spendingandincome.dat.jar
        • Size 6KB
        • SHA256 fdb7cd537a8eb2aea1fe440463acdcb4334b4ace26e1a4af41472c894dc2850e
        • MD5 SHA1 SHA512 SSDEEP

        spendingandincome.ext.jar

        • Path /data/user/0/ru.homeaccounting.spendingandincome/app_y6y0iwca680n5in6d2t9/spendingandincome.ext.jar
        • Size 6.3MB
        • SHA256 cd2966804df2089bde686ea41a3aa3c48f641f080633b28cc9f1978a6b3c0164
        • MD5 SHA1 SHA512 SSDEEP

        spendingandincome.stp.jar

        • Path /data/user/0/ru.homeaccounting.spendingandincome/app_y6y0iwca680n5in6d2t9/spendingandincome.stp.jar
        • Size 1.1MB
        • SHA256 31fdc6c48124540edf532fa66a36652f997ec505662320abc3738a8308c3fe4a
        • MD5 SHA1 SHA512 SSDEEP

        spendingandincome.uni.jar

        • Path /data/user/0/ru.homeaccounting.spendingandincome/app_y6y0iwca680n5in6d2t9/spendingandincome.uni.jar
        • Size 424KB
        • SHA256 adde7822a6f4b22b80e8348fe09d9d716e2f8519b8be926598a53463f43b569f
        • MD5 SHA1 SHA512 SSDEEP

        1582435991586.jar

        • Path /data/user/0/ru.homeaccounting.spendingandincome/cache/1582435991586.jar
        • Size 20KB
        • SHA256 2897b0812077c654a9b3fbb0b6303d5cde681eeba7ad9981de65716c7810d685
        • MD5 SHA1 SHA512 SSDEEP