Analysis
-
max time kernel
47s -
max time network
130s -
platform
android_x86 -
resource
android-x86-arm-20240221-en -
resource tags
-
submitted
25-03-2024 13:05
General
-
Target
b7992aa1d3d2be479a66a5372aea9502a0d428aa6a5bc214fda1b1c719b4cbeb.apk
-
Size
11.2MB
-
MD5
9bcd2fad27f65df41819765594301f67
-
SHA1
cff0c1f644d8ebd6856e45aae503ab0be74d2627
-
SHA256
b7992aa1d3d2be479a66a5372aea9502a0d428aa6a5bc214fda1b1c719b4cbeb
-
SHA512
441f5f16b59e1efeac3c5359e5135ccbb9eab3efdfa4b3f7b9c150aaae2fa4a69a4946f084cce214fb32634a36f1101661c3fc448fba950f9e630e928fac8049
-
SSDEEP
196608:32ia+iqz8phqk75ONMpeRjO34+DsCTdKfNv03AztYzSD:Eq2hqu5ONo3fsCT8ykL
Malware Config
Signatures
-
Loads dropped Dex/Jar 1 TTPs 17 IoCs
Runs executable file dropped to the device during analysis.
-
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
-
Reads information about phone network operator. 1 TTPs
-
Uses Crypto APIs (Might try to encrypt user data) 1 IoCs
Processes
-
com.maxhealthcare1⤵
- Loads dropped Dex/Jar
- Makes use of the framework's foreground persistence service
- Uses Crypto APIs (Might try to encrypt user data)
-
/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.maxhealthcare/app_6l3gh6jp8owu3bwc23xr/maxhealthcare.ext.jar --output-vdex-fd=51 --oat-fd=52 --oat-location=/data/user/0/com.maxhealthcare/app_6l3gh6jp8owu3bwc23xr/oat/x86/maxhealthcare.ext.odex --compiler-filter=quicken --class-loader-context=&2⤵
- Loads dropped Dex/Jar
-
-
/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.maxhealthcare/app_6l3gh6jp8owu3bwc23xr/maxhealthcare.dat.jar --output-vdex-fd=51 --oat-fd=52 --oat-location=/data/user/0/com.maxhealthcare/app_6l3gh6jp8owu3bwc23xr/oat/x86/maxhealthcare.dat.odex --compiler-filter=quicken --class-loader-context=&2⤵
- Loads dropped Dex/Jar
-
-
/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.maxhealthcare/app_6l3gh6jp8owu3bwc23xr/maxhealthcare.uni.jar --output-vdex-fd=51 --oat-fd=52 --oat-location=/data/user/0/com.maxhealthcare/app_6l3gh6jp8owu3bwc23xr/oat/x86/maxhealthcare.uni.odex --compiler-filter=quicken --class-loader-context=&2⤵
- Loads dropped Dex/Jar
-
-
/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.maxhealthcare/app_6l3gh6jp8owu3bwc23xr/maxhealthcare.stp.jar --output-vdex-fd=51 --oat-fd=52 --oat-location=/data/user/0/com.maxhealthcare/app_6l3gh6jp8owu3bwc23xr/oat/x86/maxhealthcare.stp.odex --compiler-filter=quicken --class-loader-context=&2⤵
- Loads dropped Dex/Jar
-
-
/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.maxhealthcare/app_6l3gh6jp8owu3bwc23xr/maxhealthcare.irs.jar --output-vdex-fd=51 --oat-fd=52 --oat-location=/data/user/0/com.maxhealthcare/app_6l3gh6jp8owu3bwc23xr/oat/x86/maxhealthcare.irs.odex --compiler-filter=quicken --class-loader-context=&2⤵
- Loads dropped Dex/Jar
-
-
/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.maxhealthcare/app_6l3gh6jp8owu3bwc23xr/MOisWxVhz.dex --output-vdex-fd=45 --oat-fd=46 --oat-location=/data/user/0/com.maxhealthcare/app_6l3gh6jp8owu3bwc23xr/oat/x86/MOisWxVhz.odex --compiler-filter=quicken --class-loader-context=&2⤵
- Loads dropped Dex/Jar
-
Network
MITRE ATT&CK Mobile v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2KB
MD507c8f4dd24bcf6cdf3ce864528ae3723
SHA1aa7295e6fcf6dbfcf3b1a16defdf29e9786dd261
SHA256123c9a56e5fe4dec5e4600e27389b13ed04d2263869464c9f935aeeb7106fda9
SHA5121508d4f9e1a53aa639cc26f6ac309e8559ed0a11c8a75ac75296abbc3496b94126a23ea41a5980e60b8fefb4c34aef9b081c7244c5da7f8ac52dbf5f64624773
-
Filesize
2KB
MD53960a604cd8c4e4eaf626e047ad855fa
SHA1b3cac8e55b48793373bc8df1f7f2ad85267c12f1
SHA2568fce488f36131b9131e0c6eb1d6df98c22207703bbaa3e8b56c3cc84606ec8e2
SHA512aa6b9181e72a71e9ab361b520b9104d76363928f7a7b112689c395b8e17f0c7af073c01db3f3a7f03fc18655f83dc369c7ae790045309cd670bb2e1cf8b47d06
-
Filesize
53KB
MD5299ae651cdbd8b2fe289f95887cc7e02
SHA1a740aeaac273be546b81e20b5e020c5c0d0aaeb0
SHA256831f3490a88322179cc43f164078c5d4ea2690b6523829dfe8b55a0be045edf7
SHA512058cccfe67ed2aabdb1240ed08f59ea04a90de18b1ffa06ed333f940cc3ccaa19562b470f8f26ee30f2df7feaa9d607b20e09148d67c1f0f81192344b267422e
-
Filesize
39KB
MD5d83da39541fb19f9174490edb3abcd37
SHA1175990fc6189db431496435ba246e2b8b1604609
SHA256828a0af69e3f40dbdbadda02caa1330e6fcb89ec02f5c452b8ad91bfef2d3f12
SHA512679c3802fd462a876df6d27f8f72885a993ea7266cf8663313bde6c5921b23ae52df551fd26d5de6f0cf8e4657802e03a00d140e95276f3a211f437bba98a28f
-
Filesize
168KB
MD5a39f5ef63f0bf5f500c401a80488a1bc
SHA1960d2d7da9977b7751312dbd61a67d4f00780ef9
SHA256bf42347c490fac228f1a9ac91358535bbc547c4f9351f1b2460109ad1c538f85
SHA51278dea4cbd3ebcfc284aa6a54bb96a9ce11a013ca2c11e143ffbcf53feb28992aab5c818284574dbfa923c5cadb76a8e0c5652542de44234d9d90d4ae01ed3eeb
-
Filesize
87B
MD5701070dee4802e29e2f3fd3e89d83f0e
SHA1dac227c7bf160df303e538e13e084fca584fbc7d
SHA2560aaa19939f7cc37479d5df6098b7ef310a360925182b66fb989c5e3a5cf16492
SHA51280fbfbf2273cacc1e827d4a8e26699bc095ef01f2b3ee07cfb332d066fc503e2b5a8059789b52e7038433cbb20720513e41a278db24e25f6c6b938aaa525d966
-
Filesize
796B
MD5ba0325be987878f3d8d80a4138e59d11
SHA1c09ad47e846fc188930055140071e4bf551932d9
SHA256cfa1a3b0cfa98586d515f34175c1d05c06fe19388395f50fade89ec91f205afe
SHA5126b840d936d41232ce6d051e3d372f5c6ea566fc93c43d7969126ea34421ffbc0d89e5ded9fb6085bc980d51198f4adfd9d02a325f8b9000f8ca89620bfdc256e
-
Filesize
4KB
MD5f2b4b0190b9f384ca885f0c8c9b14700
SHA1934ff2646757b5b6e7f20f6a0aa76c7f995d9361
SHA2560a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514
SHA512ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1
-
Filesize
512B
MD5a1a9b1de7a16bf0da87ac3842b677313
SHA1d37b28001768b58bfda85b9a4669ed149b5cc54b
SHA256e127378e435355510399710e6af2aa0d68fe84ad985a3f4c58a8eccd09e0311e
SHA512461ed42d0b1b7d1a39e5052f2f605cb20700a10cd8025e8b7b719e1d4bd9fb6220441aeb630ed8fd1675da027a3923e6ae045a002db61ca01008ef04cdcbb4ca
-
Filesize
16KB
MD51cfdcc841c8f7a6d13b79049dc66209b
SHA19c2063e15a5cb3e291057c94ec0192864f82c370
SHA2569f511e17baf063b49ec491a34d69e5af0750f8f3d3b88ded90e4ae514f91ba12
SHA51209adcf350022ceeaae2f0ee3d10b85cccc26e57ce6f44fa85af134702d45ef48988bdaf04cd4401c217ac13819c410f5e5b4e9462c5c983e4b439acefa496925
-
Filesize
1.4MB
MD512ce5b8ed6606b39a3a7828666889a6c
SHA13c7ac23083a0bbb8fff8d7d67026e8e5e3bc2662
SHA256bd6447fdb00848729f61dd9c436104e8ae9f84fd921ae18650335ba25ed6e898
SHA512c3aab76fd51c46197268a8ae936c1ad5eca4f35ee83c813c0b24cf1172f7d46660ce3f060acce01045f402492fedfaee837c5e4c860c0e8b78d5a346c7c0d24f
-
Filesize
4KB
MD520ad3af62764bd5913c58bffc037cf80
SHA13191c9ef1ab2e673b3e111db0f5f5060974e397a
SHA256f8178223bf6ed8f4d30502ee587e8a1396f253c414daa55f59d61c30cf7321b0
SHA512aefd7260dbe97a5ed3c30aef19f36b0c9bd36f93503f7b8257beb818374eac15a4f02d683eb79077aec0a8018a04a4152cb0f59009f20fcda874d2215e1133e7
-
Filesize
4KB
MD58572ea8f2a3b550df9bff6714a344d07
SHA14200cd478aff18846370c1367b665834dc4d40b3
SHA25691201dfba45288756615a8af49adf54fbf70086ce7c86ffcb2def9124f733ce6
SHA51216efd20fb57b90f160e422096746da8c947f9bd3b1c56dd8ab914c329621975807721eb322f80f27e0828aa7e54f9f34443ec479a0cc60865628a1e69f806d80
-
Filesize
6KB
MD58771b0215b9d7401df0a0cb568979deb
SHA1aa4818f0b9c7071c8ae2d96f560f1058ff3dd950
SHA2566ba7354a746c4c5a3d205d3e5777719c0f488d7ef6d7949bf42e4ac5f423a947
SHA5124212b0b6eae59e883d0483c04cfd1f57a63f0e315726e09b9ac0659b2a75584bd9278e3b4f21ccdccb79aed21f0deebf06eeb5226d5b2140c3b64f535528b13b
-
Filesize
6KB
MD5e7b062d3e5f2d1c471b2f61022f6afd1
SHA17c7af6ff6f4992f3ffe560e08fd746d606ae0ad6
SHA256cb5e31b456963564a7d536e344e2e1a8e9529738b53bc1de16241b2df6d1a990
SHA512f1fc7657f2874ea71c049749fb377be9d30b48051b1e8c2c09819b85eeb6a1073719ef6066c54cf09d994d4e154259b838731dcc7e6a8df3590b9516ad147d94
-
Filesize
4.3MB
MD5857ab66f53343de34852e094ca90e15c
SHA167726a763c0cda1a162862b23064fcd2d1329263
SHA25618c5a22b85aa033c5c8583f52e90748bd042b2fc373ed4b1ee0d6fae349f9a40
SHA51222def6e705f28980f4a0030cee2e7559e6052e26764b0209aaab0f29c703686f8ba371b52bfccd3264f3487e924d07afdb635eb281669ce5e7eee3c88e986603
-
Filesize
731KB
MD5f7459aedb84aca8d3eadd1a6205f765b
SHA1c0596ceaf4e990e20ecb644130e742f371ae5eaf
SHA256b95bbdf8cb33d2c4a5988a5d2522a6650a7f118643f292a47d4ea8dbe8acee22
SHA512436533e95fd56d7bdf776f48e220e6ac1dd19075268679971e04585acabb3a917a5ca29560f0238a7eb2dcf85f5548d9cd22efb66e93b9bbea71423894666d33
-
Filesize
3.8MB
MD5f1df3628d04e7997dc69d4cb44898f14
SHA1b0401cad72233ad08abf36d942b2b06ba9a0d438
SHA25623228e141d8e485e74f34c4e3d4784b47914f8078888abb58b725a2ac7d11b4b
SHA51230501618a0eae3d116a175f925360ea26560bce42de4729884156943d366a629946093e6ec91bd859c940d9fb01f611a07552076468d2e78f6e0eea0fab9db00
-
Filesize
257KB
MD517a83dbf4a665e50c5ffb576181ae21f
SHA1dff1a766b4e864f6edfa8d4c63bd9d30d6da1567
SHA256b0d007be54d24608cba2b1f1c1acec7ea405ff003c460905fc9092863b8b3fbc
SHA512b8870c300fa38d9c045c00d2aab9ecb73a7c6cfec0cf8ef3a17df10820a23d29ec6b726a6ef67043b65dd28acc6470cc7066ebd2cd89755159e69141f572f3db
-
Filesize
684KB
MD5c7405d03f169b980f10cea6f717cb6a9
SHA18847b0550640d8cadd2325d19f10c60f232f1166
SHA256c8ae0ce4f329bb0cd55672aaa5f8410bd27684aaac1b96085ed9bf54ebea3567
SHA5128e8dfe8e23bfa882fef6882fac5c60618c5f8bedfc13f42f3a34354f2874d379e4a6cdf1c80ff9c0063898c64371ebacc89888bcec29c69e5dc8990160633d22
-
Filesize
266KB
MD5fb8e4766a863ae2736e46218deb02f79
SHA1c6d8fbaae5f389eb7d0a6ac0fac7f6966f65d596
SHA256db99f6e8e3e0cb3c7a0fa1d066bafca65faf52ed023fa50b0ec2aa12d5547dbe
SHA512e59415f8d4445d7390dc6555eb4ed1185b82d5d8f1eb95218309761e7b7949206480e00b62411a9ec963c27bfb7a56ac463abdb5a0cef127cfeffc3092730b4d
-
Filesize
84KB
MD51d4b2b984be4814bdec922fa38ecbc1f
SHA162f4342e0f7c324546ea006d05518b9e600dc999
SHA25606c38df0a5964d33ba8b4f66a5631db9563c4675de4143af119d6390154d2e39
SHA512106a87b9b52bdd16c80433b1679872a4232aa173580a064b9855aeadd6395380dd7795fc5a6588f1f754db1dfc17e2807ff96689ae10ae3d1693d38cb7788f45
-
Filesize
222KB
MD57873bfb59004fe67c1df47e0882551f5
SHA14eacbf9b3941f430dbece80e85bda1649a94e0b2
SHA25643f6db56b0090b6f7fdfb7ebfa8ad25d6d17438c8449bd9a87c8b72fb0a51cb8
SHA512c93ab5eb582db6977cc4baef040ee8381004d2e2b2d881c9522599ae38bb24a1db0cd712bde7d3d355693a2f866bb5fa08e18049ad1cf7cc69591e7382ee06c5
-
Filesize
286KB
MD579899e0abb99abf095ea101c04399423
SHA1033c63d5feb447a67d6f76f02553c721c2242828
SHA25644d0567be0690633ec6461d14b4b7ea463d7b23d9c86d0d933ab76a132a6eb8d
SHA512a0d22f780a32a6ec7ca0455c4eeabde24bc095d67ee090f91371c9e7572e5b41b0995c16066776864173ba5d45b3bfa1546d6ede393dc1b5c5789f0f760da8b1
-
Filesize
113KB
MD5d707d7f1145521331550208f46f4ae35
SHA14b408c3fd4ffb0f04cc626bd16edb9daf4a70632
SHA25606b0263beaa72b2497772ada3f38608bd985fd33448f43a2aae5c7c40300fb4b
SHA512195a471051f79a144c3d8ee65e80de74ae77a9fb2404fd9f5bef6508479f3b7c4277b504ea1e738e201c5038e92ea2d3ca3418e5a3b7598b0340be19b5bc37fb
-
Filesize
72KB
MD5e9dfa85278d40a9fb67e9bad30ab23bd
SHA169b86fd2aa29940669841d45595f655ee2c7919e
SHA2564c4b9d091a9e5e3204bd89ce02e5a57cdfdb280d0f8bc5970c0f8b58035bf35b
SHA5121ca7c108a001642661a3dd25edc7e520cf38d32854ddc425b9deb51549a08a2c8932fc36bd036f89373bc9f8a32f70616a4610614992173a5ea3deeb00262acd
-
Filesize
225KB
MD5915a3c59b1cc2455219ef6d40ba809e8
SHA11421e091c0b8c587fa10e7cb64e829f2340c1770
SHA2563214d2ea1c698839a5ae84b594cea0eec348666ddcd921ec42f122aa9f8e5744
SHA5124bcc97d3e67d2e161179a56f41bf1be63f95ced99fab1855781a0029b0af2d8df2b5a031d8095705ee6e091390f265d3761a14600e952b21a2a9c8f4021ba3b2