Analysis
-
max time kernel
36s -
max time network
159s -
platform
android_x86 -
resource
android-x86-arm-20240221-en -
resource tags
-
submitted
25/03/2024, 12:43
General
-
Target
be0de09be38f20ec2943d5a2c1cea00bd484c9f99ea81a960a83ecfc80e7a7ab.apk
-
Size
9.7MB
-
MD5
db34bf331c8a928debce191808de2bae
-
SHA1
a644fd040f372e20ada23f3ce74d94e22d65ec95
-
SHA256
be0de09be38f20ec2943d5a2c1cea00bd484c9f99ea81a960a83ecfc80e7a7ab
-
SHA512
d4582a6e9263f73927ab41c6c336c81b926397cbf28c1313889a24524d14079ed5dcddc6452f1fc3b042193e23860b58d574154e8e109dc4e87c66c414bfe146
-
SSDEEP
196608:z+DsCpNMpeRjO3Jvk9+M5CoMU+AhpYB0ak1tmvehmjXt6pPGfTIK:esCpNo3Jvk9NCoMUlh6B0twb2PGfTN
Malware Config
Signatures
-
Loads dropped Dex/Jar 1 TTPs 17 IoCs
Runs executable file dropped to the device during analysis.
-
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
-
Reads information about phone network operator. 1 TTPs
-
Uses Crypto APIs (Might try to encrypt user data) 1 IoCs
Processes
-
in.cleartax.consumer21⤵
- Loads dropped Dex/Jar
- Makes use of the framework's foreground persistence service
- Uses Crypto APIs (Might try to encrypt user data)
-
/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/in.cleartax.consumer2/app_dlwp7brnl6h1mncxflxr/consumer2.ext.jar --output-vdex-fd=51 --oat-fd=52 --oat-location=/data/user/0/in.cleartax.consumer2/app_dlwp7brnl6h1mncxflxr/oat/x86/consumer2.ext.odex --compiler-filter=quicken --class-loader-context=&2⤵
- Loads dropped Dex/Jar
-
-
/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/in.cleartax.consumer2/app_dlwp7brnl6h1mncxflxr/consumer2.dat.jar --output-vdex-fd=51 --oat-fd=52 --oat-location=/data/user/0/in.cleartax.consumer2/app_dlwp7brnl6h1mncxflxr/oat/x86/consumer2.dat.odex --compiler-filter=quicken --class-loader-context=&2⤵
- Loads dropped Dex/Jar
-
-
/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/in.cleartax.consumer2/app_dlwp7brnl6h1mncxflxr/consumer2.uni.jar --output-vdex-fd=51 --oat-fd=52 --oat-location=/data/user/0/in.cleartax.consumer2/app_dlwp7brnl6h1mncxflxr/oat/x86/consumer2.uni.odex --compiler-filter=quicken --class-loader-context=&2⤵
- Loads dropped Dex/Jar
-
-
/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/in.cleartax.consumer2/app_dlwp7brnl6h1mncxflxr/consumer2.stp.jar --output-vdex-fd=51 --oat-fd=52 --oat-location=/data/user/0/in.cleartax.consumer2/app_dlwp7brnl6h1mncxflxr/oat/x86/consumer2.stp.odex --compiler-filter=quicken --class-loader-context=&2⤵
- Loads dropped Dex/Jar
-
-
/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/in.cleartax.consumer2/app_dlwp7brnl6h1mncxflxr/consumer2.irs.jar --output-vdex-fd=51 --oat-fd=52 --oat-location=/data/user/0/in.cleartax.consumer2/app_dlwp7brnl6h1mncxflxr/oat/x86/consumer2.irs.odex --compiler-filter=quicken --class-loader-context=&2⤵
- Loads dropped Dex/Jar
-
-
/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/in.cleartax.consumer2/app_dlwp7brnl6h1mncxflxr/TitmVNxzG.dex --output-vdex-fd=45 --oat-fd=46 --oat-location=/data/user/0/in.cleartax.consumer2/app_dlwp7brnl6h1mncxflxr/oat/x86/TitmVNxzG.odex --compiler-filter=quicken --class-loader-context=&2⤵
- Loads dropped Dex/Jar
-
Network
MITRE ATT&CK Mobile v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2KB
MD5f335ff0d1ef0760ef92bb655345d6073
SHA102fdb48374ed4f5b64938f5cede28ace4d7e7db1
SHA25648dbb22b76f11d2a521a84410c999e0c03fb9ce2df24f339a15f77a9b9a24fda
SHA5129c4bd5ca905eff9e0f5bd74ef3fe263508e91782b3ecf91faa5564ebb5452e036172b3aef816b211ea7cb904c922cb955bd264f49e08571da3ac4f4b62d66325
-
Filesize
2KB
MD513b31f234aaf8d396e17f2c8a782632f
SHA16861dc9de0825a64633c6c528725fe182b878260
SHA256c00ea7376432cb078a50b7f965fdf96035998f3e11cfab7e66f1a581b7089288
SHA5123184cf7bc870e993261cefcb31d5d5b30e1931319236043ab9a7f6cc017cf4740d4244819b85f65e4731053f3e9c571aeb7508f403387cdc8cb08ac83daeb6a2
-
Filesize
2.5MB
MD59e9b1f99510e8a99a74882a6527da90e
SHA1f86ad0ce94ef2400bc6930de7d9136da9a63b864
SHA256b7ed63756869c055a05cfe8cb062450cf66880c4dd1a6ffa563da77f57f68258
SHA512f46bb489424ef07a5d2d86ec1b7428699c67be17e174c1371f041534f1445b902751996061362a72841493a7f81a63d782bf579d53cf4ca1d745ef32903fb734
-
Filesize
276KB
MD5a96d1248a375c375c7a215669e186ecd
SHA1fa308485cd614a3d5bb9b8a5cb9ed13bcf565952
SHA2561ab8d9cad5be7faaf96c09882ef5d1031b055359fe3d89739e2c239ac18fb6ba
SHA512d1c823965838dc471a12ef8b387099e53b689a6d618e8e40641c063ecdbd630126e33925c09aa88ab8385782252a98f810c1366da7bc9c44ec22bc73afbe9b83
-
Filesize
460KB
MD5013edd7b4ff3baf90f74add2ee0f11ca
SHA1875bc52dac65d12841ef06a77e05bceef591c267
SHA2566e3cc8b0da01abbd188c9b7e09c9633e32fd3e92e3092f719ecd4a3238bbc653
SHA512d97b968af1ba7290548de40483b0ab53a3dcdcc74087099cbfa87654b54b26644c0f428455043962455b0c1aa5f2550b28965bbceace6aa01ecd564e685c75bd
-
Filesize
168KB
MD54022376f36563cb642c2b4d2eaee9574
SHA16bffc6860f3d7de849ade57de607c65191c03df6
SHA256de99771a5e4d8cd6afc23f1e5886c32ea0829269a2204219e68f3aa51bd784dc
SHA5126e9fd8e0556d40961a32ccc0fa132822c32b68ee9dd8045439cfd67dfa0b77957a47de4eccdf2b88a3192fe59c87029e41b77486e919a2a313e2b4d43a5d1ac0
-
Filesize
4KB
MD5f2b4b0190b9f384ca885f0c8c9b14700
SHA1934ff2646757b5b6e7f20f6a0aa76c7f995d9361
SHA2560a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514
SHA512ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1
-
Filesize
512B
MD50540c31ca7a71e994d635596de69b9ad
SHA1ee5f17a6242e5c1fda6766cd39767ae56088c7ad
SHA2565f6e9d3a0caeb2b403c546fb792c54c3fa84e091f1ab2d5d53a4260f08af5f14
SHA512ed2b48b0eed2db4cd7b21a8b36afb5b7706a763b207624b5b55a5b5ae706887e1a9edb261a15e7ce61e2dfe10068c75b1558f87b04f9ed4c6a1e2f9da61a730f
-
Filesize
16KB
MD5294cd21c68aa1a638da50870a86da0ad
SHA157e86254586fad0c1f893e7f21322dde40f3e862
SHA256c84aca358d7bde2a359beeab1ec7bb12aeddb5e297478257ab387493c0a23278
SHA512cd4cf4542872524bf14b966619ace38d4facbbd24a1962d0715f9b277da3bf5bb7cd501fde9f226b1c4ef9404459fd99b2a9ef2acb455c9db90cbdee11639a37
-
Filesize
3.6MB
MD540b26421d43916228d1f221122f077f4
SHA170da66d6800c9fe1d273bf88a674923fc02e01f7
SHA256477c5d55443ea48714cf1207d29353cde26f5ad65f5b552660dec12a80f96ff2
SHA512a01074e65edef262fbb355a08bac3d08ae123d454b0c146a834b91261f234b7d11a5f34b6607adad753fd5a1ce8398ed489c15414573e90944e34cac46f56a5d
-
Filesize
1KB
MD5bc7fadada3468cb0ddeba359096ceff9
SHA1b0d63e99c0f00acd01b17675c683c86a84366eed
SHA2565120e23cb5859035fee1bda213170b276ef01d4b49fcd19d17a1bcd579d15968
SHA5127cdd4339850f12fda4601b7c3fb315cdbd329c7286ea9f5358ede50876180f203c9f77272b30e5643ee643d08ee9b8e919b4273886d5ee3b4d9a41f72abe883f
-
Filesize
4KB
MD59e775591aa235128710894959dab036c
SHA1f06694f6c2ec91f89406142fd7b81216ff528f57
SHA256e3e0facfb3eefeea535fb3d8d96e4efc62c6cfa34e47642461dbdb0bd2b1418f
SHA5121f9a3f5305b2042354e3351839fc2d5ef630cd50f19ba18d09bcfac4f90c18ce7b790f150c23c91d9c69121a17ff4557cdc3806e5a5efbe47856fd0c808aa572
-
Filesize
4KB
MD5634ca507eb0ce45a672d27a0f8ccb6f1
SHA1dca1580106896d4f417df7dbcccfc8c7288d4d5e
SHA256bfc841a23a0e4fb600436aa7606c0bcacc15d64a8b7f9e8bc21654321fc131e4
SHA51239bd7cbb7370ad830e3087014a24864b00269b4b62c116ac9b257df3c862d0bf0866c0e371b9c45ae6f19f673b59632cc32576dd3dc7fa13c23744355003d1b4
-
Filesize
6KB
MD528dc3ca4e75773a8cbd257a8ce8296ca
SHA18e043936cd708fddc96495f540ab25d87dd22822
SHA2566eb15abdb9a92564e5545bdf5d3c19cc895b97bdd9e5337f3e633fd28f513c2c
SHA5126b1ce921096c00f6d0a4532d8102d8b5c43e2e4d5cb07c573ceee2898d7cd08cb7fcf240f1afd12f2d7781e4131899779e30f2e47495bba86f5d9030d2eee99a
-
Filesize
6KB
MD5ff2dbf38855bd3142b6df895395cd6d7
SHA1ccb094c6b8e6c0d85ef5c8da3a602998bdde3b33
SHA256a150d7193023079a991696e7258e17a881ccaf25a77395eecef5bb41696ed740
SHA51200f1b634e022065f91140fbccd1e61a1f2d3800505794c2589b601a91f30d927e328df038a081011116b23deb624970ec70df415f3dd08d15fa83ae25c3ff878
-
Filesize
6.3MB
MD5b085c8682cde0d137ecf41df64e07925
SHA197b2f99432397ba40b74c8002aaf6a9a3f2e6faa
SHA256f9cc81e6d71505baa45c3fe95bf373bc51834d60c28a1edf609d9639599bfa45
SHA512ac6e4bc0f1c0c6937c9ad998054b37b5733f502497c6d0e251d5174c0ba3cc483c2b51cdd7bf51b5fd432c55a7e5a93b1ca903d68cdfa0fdfba03abfdd482f02
-
Filesize
5.6MB
MD5b2e8475d43fa66ed26d6769e1c460fc4
SHA19e302878fb594acf77269c5005187951fc7749b1
SHA2563014558902baa20f1212e40ee2af4442cf1518df08e965020f37de22e1154e86
SHA5122856761cc5330e8f548f50c2f7440089f537348d3a4bc37b7e862a1b21730cecb56cc0a38f5d65d7de364a41bbab36cb3f24831d0b7fa90734108007b35cc0a6
-
Filesize
5.8MB
MD5e628204b00beae0c65adc145bc160420
SHA14d1b9a87ed54b3a63a3043f8af8de9a89ce96b32
SHA256a5723e87e858039c4e8d546cead8117f72619e1776ec6b61835a73709d58dafc
SHA5120b0c1fa2789c37b3eb2fab339fe3d5e48f661eb86f8f94e9174dac1b775285675a4db6c3c4ea3519d8c21a110b7e42f2e2775a8d345f276767af1f2604eac1db
-
Filesize
684KB
MD5c7405d03f169b980f10cea6f717cb6a9
SHA18847b0550640d8cadd2325d19f10c60f232f1166
SHA256c8ae0ce4f329bb0cd55672aaa5f8410bd27684aaac1b96085ed9bf54ebea3567
SHA5128e8dfe8e23bfa882fef6882fac5c60618c5f8bedfc13f42f3a34354f2874d379e4a6cdf1c80ff9c0063898c64371ebacc89888bcec29c69e5dc8990160633d22
-
Filesize
684KB
MD56263092a4066cc703fba3c43d7ccaaee
SHA1dd29ff70f4a0c4efadf810b605ccf3217dd02c6b
SHA25660db470efa19a143065f88eb485ad31ee9afb169b852b42a7d87a790eb051758
SHA512122f8819c0268f5bf6dadacdc6586b7509c0ece6155e8d2eccc897afea84ec246a7f193ce2975ddc134107b64fd51ecf56ed0f14dc443823759d6b76d61fae4f
-
Filesize
1.1MB
MD504296351293b42196f66aecc1afe172e
SHA153fa9577e740e587499c8556ae31aa7e18d75b8b
SHA2569fa88a0783507c316e66336d37fc16ad8e8cf45ba701478c1bbbda52596e87ef
SHA512d116890fad4112a62da9dceddb02e0be43a29847aa23721f5bd7168329fbd4a3994921ca3c2a0851e233366d37601c43eac977819f892122540aea438c1e2502
-
Filesize
614KB
MD5c3219292dd20f7b72292526c4ca32782
SHA191acaf06d766a286f6a30a7d04758deb715f4040
SHA2563adc1f155dc57d2ea8198b7e7d9b159452ddd3ab34e961d28a00a75ac43eb833
SHA512d2cec311fe5914b93eb7a6d0673b5e22372f2b877449f773783f1d04d836025b4ec5d8b779deff498c4f76f78c2d4971ca68d4b2760be405ffbd81a37e222da1
-
Filesize
1.1MB
MD549b91e17f8168f2d406b5cd32e34c9b4
SHA196054ee16e5dccae6de5b42395813fe5cbae0a4a
SHA25631fdc6c48124540edf532fa66a36652f997ec505662320abc3738a8308c3fe4a
SHA512d4117115f9e6fdef2ace6724d984f60e7e054f7423195bd2cac22c22101052070c29e1350c9dbe5869b067d64c5e29fe86671757f484ac04db2102e712115193
-
Filesize
424KB
MD55281c31bc937e0486df57682e61c5c86
SHA1ce34b2893d203c76bf90cb67d5a1d56e957fa315
SHA2562f6654f61f0ab758f6825a38f078cf4a1bb1cbed1a99819ea18ae96634171401
SHA5126219e0f2a04232ae6aec1736eefd00f696d1badbbaeb68dbff5254370281b2b82fbaf10c256e982004bca2fa3f4259106bc1fe6562850d420bcf283c1c8c80a9
-
Filesize
63KB
MD58ba0b832caf79bd8a5e02b83f6f6f6d1
SHA1b16ac81699b7324039ee09146296677c9ae95e5c
SHA256c5f1f2752c100ba44fb55e85d9c7c8df426453b122d113ddfdb174b1e3f3386c
SHA5129a118a05ea8be81632ab241c550fd911c09c8cf68cc0791a407d4692ada1d1d4a91090a8517a4cc9ab15187dca79ebe6ecde873bc9f633a6cbe4351cd306d0e3
-
Filesize
424KB
MD53f5d5ab5cc80ae55dca1719549dc3627
SHA1fc1a5e8b43ddd46c4d301127f9c2e07a613809f5
SHA256adde7822a6f4b22b80e8348fe09d9d716e2f8519b8be926598a53463f43b569f
SHA512885988fb4fb5b0a0b4c9b5f067c5b36a7fb7b731def6bbd3860832da215f19911b9a064973f74180461bace2bd04a2735142bb770783cb46e1b1d87c728497dc