9a1ad89234fbe8a6ad1eca73c15e1e9f784b770d0f5c8cc8f7d025eeaea3e61b

Analysis

max time kernel
8s
max time network
160s
platform
android_x64
resource
android-x64-20240221-en
resource tags

androidarch:x64arch:x86image:android-x64-20240221-enlocale:en-usos:android-10-x64system
submitted
16-03-2024 22:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

9a1ad89234fbe8a6ad1eca73c15e1e9f784b770d0f5c8cc8f7d025eeaea3e61b.apk
Size

1.1MB
MD5

e9742d2b7d663770ee70827b626c0cef
SHA1

6b4c56d0c3a6b067049bf93964cbb7e463e312dc
SHA256

9a1ad89234fbe8a6ad1eca73c15e1e9f784b770d0f5c8cc8f7d025eeaea3e61b
SHA512

3cb4e259da3aebc31dbdcfca93c56a363a59c5671a6b6badf1e9c6a66dfacc8b3e4e9d71b2d3d83a7417cb62b3aebae5550076c3bb856794221c1583abeeec58
SSDEEP

24576:UbChabE7bgPH3hqyGKb3lA1uojyw0ug/GRQG:UbChaA76sg3CuXJug/NG

Score

8^/10

banker discovery evasion stealth trojan

Malware Config

Signatures

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs 1 IoCs

banker discovery

Security Software Discovery

T1418.001

description	ioc	Process
Framework service call	android.content.pm.IPackageManager.getInstalledApplications	com.fimudidukira.soducake

Removes its main activity from the application launcher 1 TTPs 1 IoCs

stealth trojan evasion

Suppress Application Icon

T1628.001

pid	Process
5040	com.fimudidukira.soducake

Acquires the wake lock 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.fimudidukira.soducake

Reads information about phone network operator. 1 TTPs
discovery

System Network Configuration Discovery
T1422

Uses Crypto APIs (Might try to encrypt user data) 1 IoCs

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	com.fimudidukira.soducake

com.fimudidukira.soducake
1⤵
- Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)
- Removes its main activity from the application launcher
- Acquires the wake lock
- Uses Crypto APIs (Might try to encrypt user data)
PID:5040

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

T1628

Suppress Application Icon

T1628.001

Credential Access

Discovery

Software Discovery

T1418

Security Software Discovery

T1418.001

System Network Configuration Discovery

T1422

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.fimudidukira.soducake/no_backup/androidx.work.workdb

Filesize
4KB

MD5
f2b4b0190b9f384ca885f0c8c9b14700

SHA1
934ff2646757b5b6e7f20f6a0aa76c7f995d9361

SHA256
0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514

SHA512
ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1

Download Submit
/data/data/com.fimudidukira.soducake/no_backup/androidx.work.workdb-journal

Filesize
512B

MD5
4b04bbbe6f7b58bcdedae2449b89f9fa

SHA1
2efdbf8a7d3b0764e6752ad592ce5555bc0119d3

SHA256
dcf8262cd6ecfcf64688c99f09574933805a8528a30ce1884d59d21f570b3bb3

SHA512
0846c8be073e243a82db3e2edaf80d5e172c501bedcbd75b08fd0bfaa6aadc3446f0588a663b39b6aecc63b4f8ec95954f3a16843c818ec143b882a018448bf0

Download Submit
/data/data/com.fimudidukira.soducake/no_backup/androidx.work.workdb-wal

Filesize
16KB

MD5
9781f26097c8a045d5f3029e686d98c4

SHA1
1807fd62189fb0778d716952b3ddfb225dcf1dfc

SHA256
8b3ba7ce3f108458059802d46e1c836e602fcf7fe47d1a6d71011c0c3ace272e

SHA512
166b36dcac6bd9b5b2eb0f7c74b82a87b3fcd63626d4ac76f1867d3bcdad7f23f4d9c470a7e0b994982ec6eb151b64a92574136062a0d31073562da3fd9eebf3

Download Submit
/data/data/com.fimudidukira.soducake/no_backup/androidx.work.workdb-wal

Filesize
108KB

MD5
b530a9522b0ae8924f51be5096253ed1

SHA1
42fe2ff1a722ac55bfe1ef6c37180607c96e9a66

SHA256
5212787748433ed170ddb2de29799146b3f59612609d2e0f588fb4bb69a4ee3a

SHA512
fc9e151646d91d780fe7e3939b8c9aca64742eaa244d7c11ffcfab4b4a1c74bebfef30d83bb9be2dd0deffea12155f2fbe1148250fd43022ef3f6dceee414f44

Download Submit
/data/data/com.fimudidukira.soducake/no_backup/androidx.work.workdb-wal

Filesize
148KB

MD5
770b7812abeab186a8115aa89114536c

SHA1
329e5210df99d1e3de56711f4b9a1f56de3b4afb

SHA256
5b39421b171c367751c4e3dafe97282052272f0474f136f3db625773911d1a05

SHA512
9482066b235cf114f1a66ddfe7ebefd8f9fa2819948c2202e5768d85676b81b7c36b059d295d641b2522fa88f6ac5ba6f2bcbcaab84884e53493e8a082d9ecd0

Download Submit