Analysis
-
max time kernel
58s -
max time network
130s -
platform
android_x86 -
resource
android-x86-arm-20240221-en -
resource tags
-
submitted
25-03-2024 13:07
General
-
Target
b2cc94f883468d46aaa1acf2283bbcfd2973b75d08ffbc3fa08c59b7c9dfda9c.apk
-
Size
10.8MB
-
MD5
72c2cb8269ad0783487a6db8ba29a6a4
-
SHA1
d9a8aff0ae760e83bcdc448896c9f16c8a09bb6b
-
SHA256
b2cc94f883468d46aaa1acf2283bbcfd2973b75d08ffbc3fa08c59b7c9dfda9c
-
SHA512
8c8e4128d808357a1813aa445a851a44cdef8d449e6a0384ac83e8da3e5fbae04839a033150b7a1c247e2f1811ddbf8a7669bef5792fd07e41c281dd86fcebfe
-
SSDEEP
196608:xk9g3BF8xWLK1X1WFf1RP9NMpeRjO3p+DsCCE1hG/0aHxGQYMUbUU:xGgeWLi1WB199No3QsCC4SQQEbX
Malware Config
Signatures
-
Checks Android system properties for emulator presence. 1 TTPs 1 IoCs
-
Loads dropped Dex/Jar 1 TTPs 17 IoCs
Runs executable file dropped to the device during analysis.
-
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
-
Reads information about phone network operator. 1 TTPs
-
Uses Crypto APIs (Might try to encrypt user data) 1 IoCs
Processes
-
com.volcanoforce.lost.beta1⤵
- Checks Android system properties for emulator presence.
- Loads dropped Dex/Jar
- Makes use of the framework's foreground persistence service
- Uses Crypto APIs (Might try to encrypt user data)
-
/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.volcanoforce.lost.beta/app_onal59bhkael1xvwjyvi/beta.ext.jar --output-vdex-fd=51 --oat-fd=52 --oat-location=/data/user/0/com.volcanoforce.lost.beta/app_onal59bhkael1xvwjyvi/oat/x86/beta.ext.odex --compiler-filter=quicken --class-loader-context=&2⤵
- Loads dropped Dex/Jar
-
-
/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.volcanoforce.lost.beta/app_onal59bhkael1xvwjyvi/beta.dat.jar --output-vdex-fd=51 --oat-fd=52 --oat-location=/data/user/0/com.volcanoforce.lost.beta/app_onal59bhkael1xvwjyvi/oat/x86/beta.dat.odex --compiler-filter=quicken --class-loader-context=&2⤵
- Loads dropped Dex/Jar
-
-
/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.volcanoforce.lost.beta/app_onal59bhkael1xvwjyvi/beta.uni.jar --output-vdex-fd=51 --oat-fd=52 --oat-location=/data/user/0/com.volcanoforce.lost.beta/app_onal59bhkael1xvwjyvi/oat/x86/beta.uni.odex --compiler-filter=quicken --class-loader-context=&2⤵
- Loads dropped Dex/Jar
-
-
/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.volcanoforce.lost.beta/app_onal59bhkael1xvwjyvi/beta.stp.jar --output-vdex-fd=51 --oat-fd=52 --oat-location=/data/user/0/com.volcanoforce.lost.beta/app_onal59bhkael1xvwjyvi/oat/x86/beta.stp.odex --compiler-filter=quicken --class-loader-context=&2⤵
- Loads dropped Dex/Jar
-
-
/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.volcanoforce.lost.beta/app_onal59bhkael1xvwjyvi/beta.irs.jar --output-vdex-fd=51 --oat-fd=52 --oat-location=/data/user/0/com.volcanoforce.lost.beta/app_onal59bhkael1xvwjyvi/oat/x86/beta.irs.odex --compiler-filter=quicken --class-loader-context=&2⤵
- Loads dropped Dex/Jar
-
-
/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.volcanoforce.lost.beta/app_onal59bhkael1xvwjyvi/QccmHUVGG.dex --output-vdex-fd=51 --oat-fd=52 --oat-location=/data/user/0/com.volcanoforce.lost.beta/app_onal59bhkael1xvwjyvi/oat/x86/QccmHUVGG.odex --compiler-filter=quicken --class-loader-context=&2⤵
- Loads dropped Dex/Jar
-
Network
MITRE ATT&CK Mobile v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2KB
MD54d3b18b530b8f25b8dc3f0aa79354069
SHA102150c9bc84c5baa1d1b87d35f2eeb6c998c0a12
SHA256795e4ddebd05d7546110f41f3f9893d5f9409ca381d359fc2fa054164c9a9905
SHA5122b3965b4120935cfd79b364cb3557929bba96603f4801cb9f36b0e9650ea6856e6cb8355b88c2ae94b58266b751c7cd50cee1a40fe19450e30e86832f88aeb69
-
Filesize
2KB
MD5b30edf4ca525e0f635f392571027e960
SHA1f52d6906604eb95b9f4577651d0c052cc9738d2c
SHA256fc4814ec1f3d88cce069066413e7c17bb4dfcdcabc3165c67489f86e29af0d0d
SHA512e7c7c69eaa988e74c6ec39e43fe9a1cf37ce5fa461c65c1b480df94a88384efe5b9b9845c87b6d1cde315ffc2513241532967918c3dfe10051fac9d75084467c
-
Filesize
100KB
MD5efdb6c78fc245ed91292fe9594235274
SHA1730ffff14497957595bad33ba350ab2f97b28c06
SHA256d9be28c9de47fc6e09456ea7cf045b59c6507e08dfce7a90aae64bf84fad84c2
SHA5126173047335418035d8fdfca412c66f26c5eb9070b8c2cfd5794b47c5b00dcdffba2e68a2a242df0eb3d60f4f9283dc52b348effddffb7f2faa120645173beef5
-
Filesize
31KB
MD52f5801dce368363bfe418db9c9b3ca96
SHA1b0cdf8a0c8c4e4b4d8c1c1bd8cad99651bec8c97
SHA25631391a37376ccc085608c39e5901c663ed871015eb3e7f2ff15b91ec08140fc1
SHA5121f75f8c7b71db4d976ad566d2d3f30146daba1f1831cd46ca9202ab9dd1afb7087433abeef236f9ac2ffad9dad88e44a0d94c56e47ce8141ca1ffa722bd20054
-
Filesize
168KB
MD569fe51c1a844d5e92e740ade82a66379
SHA18503d619286c9d46da31498eed1311c6881b7f17
SHA256d73c3ea493f1a829283c4d3d52d16b1c90077bb0366f7e38195a3ff2bbe0b738
SHA512740718860c708bbd6476bc168c5b8ebdeb1bde0faec1e6e52b645bd4631108ffada22e6085435d3fde8783a07b5de59e215529b8c906066c41b73a4ac20efc57
-
Filesize
77B
MD5725be1e6766cf5bccd0cbe714c882d33
SHA1be388beb3201d5dbfd8edd25a0894b02b7b81a09
SHA25652ea681ce63e966e1c7e9cd6ee4b58077b2994021baac05b39e0cf2653379cdd
SHA5129c78935d7b257b1800d40de6ab239ac306065415fd8dd6943cfd8cddc02a9475a76748fea7779452fa88a4d224e8db0e4cf61bf245d756aaea3722d46a004d22
-
Filesize
817B
MD5e3a179d443fc06d973176c96e2c0c132
SHA187a700abea28cf71dc82e3e124f3e3c75a3695be
SHA256a5b080af4f822f2d1741384568b1487068faa44605b68c6cd5e34d4228cbd76c
SHA5121364691fc1f4f707fb560124418c3eebd092e72c556945933f354864bbcabe4bacf310308f32a18aceb74070b2750c89e579cd39babf872fff28dd94dfe1f1e8
-
Filesize
9KB
MD5e8e0527a01aefdb89afd2c508f131da1
SHA1f1103e6b260c657ceb3d95f1b023af3fda8b133a
SHA256f809447486f89fcaa74f87e06d126d103d37eb2b3157e88f2c06d989b2c284ce
SHA512fb53683a83f1068d0f94567b156e6a8910c45b1b5f33db919f7e0b9c55eab28507a235ef76d44d5b549599ea3b54dbc00496a633339d276a80f395da938d6d34
-
Filesize
4KB
MD5f2b4b0190b9f384ca885f0c8c9b14700
SHA1934ff2646757b5b6e7f20f6a0aa76c7f995d9361
SHA2560a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514
SHA512ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1
-
Filesize
512B
MD592dd48da1d0d3770f3ca1c811d3e4eab
SHA16939aeaa9c58eb3c22a2a24c2e1188f56d56908d
SHA256881f7f55fa556284c87255035f94ea33f567276c2e5857d6876580c3f31167de
SHA512bda2a1651a91fc811c7cce24faecedc4553ff7f4307577a1d4a4ba8a5f8460774afee61375ca4b93637dbdc440b7308f4b5e3cff2e3976ada7b423118430639d
-
Filesize
16KB
MD59fabd862b2059a5e0f1925f38b6ed21d
SHA18bd4164a3fdcf562a750b8384fa6190bec9b6338
SHA256790bad9fda287c01353eb0a28bcab4e3d0be999eeb08bf73e4b24006cd6ddd69
SHA5128cecdf0b5bcb86606950a255e81cebe1ddfccd3d3b8be5bb0210eb0508124dcece0925c2f3bcf307b45d39538fb99b0d87d696bc3888b3a88fcaec07124c4e6c
-
Filesize
544KB
MD5c18be036808801e9301d68049de20e2e
SHA177ebb0cc232158bc20127734143ad21990ae84c4
SHA256d645055521e7bed7be5917d25386658143a7ea277e6a549d4be2f0f41e9c6c34
SHA512574732be988aaa1be0de88e4a97ea4f6b5cbe63ad83d7c2308e7f7cd337b2f4714542197351c42b55d980648997a259778d3b1e46501e81a52052969223769df
-
Filesize
4KB
MD51a590e49419ff8bca19d51cafee9cb33
SHA19090fc84bf2aec4154d97a0e589b076db7bcaa0f
SHA256fa8d943fa604b0408e2c59d947bca3368b4cbcb2e0059749e8b932f93b3d3b58
SHA5126829012279b3a95994cc01e3a3cf2e91211877ee373c5d45c82bef1420486d857583ee52dc91eb2f64fc616c239df02b4b314723ec12dde5e9e5094642603a65
-
Filesize
4KB
MD5f48d43762adf245dc2be7449f61601cd
SHA1557a7ff8d490e423ed17e70c9d1aaf19a573db6d
SHA256a4b466ca049c1b48012a21c601f1caccb665c57eb14ece28a10af0fd554d7f5b
SHA512417dd19c3ba62c4e25c9b7e7dc593be947fd285e7f4358af4ddb1122d26b60eff7454bc51bb1aeb08fa27e2e6f54718e8b1e130141a5f2dadbcc0084816a83c6
-
Filesize
6KB
MD58f8417815026185473cd6037e14ba808
SHA1217ed749ed35c1cb0e86b1f0005693715babcbb7
SHA256a01a6cec57260c64060256f0190c448842a7e34b4bb2fcf5f45307cb505e3e05
SHA5124a2350cbc4ad86ec8ff6afdd296ba641dd4baa3070558293edd3bd4b675eaffc58e3d2c0d427a12689d4502dfd4502a1aca0304e1f0d3f278d7e133658c4dc17
-
Filesize
6KB
MD5d3e853c944f03d38790ef9da90f88ed8
SHA186cd3cdbecb4902adad21709d9da89e7bb69b24f
SHA2569bedc1a279c2b2348fb61fa55b4703f8708fc2c16d31ab6067ac604596b137e4
SHA51278c34795e4ea5a53789fb3cd82090f433d8b3e6e659d22a7a1d55bcc0f0c949257e5a1b3ca97c87884e098d6e70efb0bfa36eae55b0e2af57ab46aaeee598da0
-
Filesize
1.1MB
MD5d21c754bb22ccefc3b87d6c41fc48d9e
SHA15fe6ae341a34cf9caa1482282a96d42e1f671d64
SHA2560dc54ca2ccf529c3a9a1966fad22a240ea2a1bfb2e1fd00741a307256a127810
SHA512b0d5b987caa395a9c3e46ebe7277b34f48e62488273381579dff6ce5acee690abcb3c786092c68139df9c9033b492418f1954229dfa84bd195ba1f0feed09d99
-
Filesize
3.7MB
MD5af0e79a3cdf9a3f4bd2b94778cfd9e6b
SHA1992c83534eaa8f7cd6dae0b01cfd4a95ffd2de04
SHA256a9083d61b3bcbf9d602ef41a026a4abf483d0107550d3baccc20bfc1bd13ebd6
SHA512948924fff2c443afac2e4a95664407f8edc53840d74087f3094a805d47be199859d230a3652bb66c826d8ee1a311a6ad602c4443a57d40969c828a43eebf29e0
-
Filesize
2.2MB
MD56d933c1070abcf89574e04acddcd71f1
SHA1ca476d64cb73c2171e3f8c93a8bae34d28234cfa
SHA256ccea6de0cf358b8768557834fb3e99797b77658a77601403b0f8b42b5334ad77
SHA51210a485620968878ed83bd0155ef8801a8901de1e61e0aac166c0c545cf67bd96ccf5e796fb79ebfe15a4ae7cac4ddf82f89d72fe346c59ae8a38f226959ac415
-
Filesize
684KB
MD5c7405d03f169b980f10cea6f717cb6a9
SHA18847b0550640d8cadd2325d19f10c60f232f1166
SHA256c8ae0ce4f329bb0cd55672aaa5f8410bd27684aaac1b96085ed9bf54ebea3567
SHA5128e8dfe8e23bfa882fef6882fac5c60618c5f8bedfc13f42f3a34354f2874d379e4a6cdf1c80ff9c0063898c64371ebacc89888bcec29c69e5dc8990160633d22
-
Filesize
518KB
MD5612d74297f92f18df2160b91a992ec20
SHA1f5f8c122b84e55559769b6cb2d496be807b81186
SHA2568aa19e6be293299b033ca1e376676b1e19b7ac396f56c087793a8b386c991ca4
SHA5126f07520ad8508d732ad22082851a21d8bd8502e07b3892a0e3cd9890309c733e24fdb8f189fa0cdb9a7c0f86ea29b3a641c4daaed8d4cad21ab612216f448876
-
Filesize
684KB
MD56263092a4066cc703fba3c43d7ccaaee
SHA1dd29ff70f4a0c4efadf810b605ccf3217dd02c6b
SHA25660db470efa19a143065f88eb485ad31ee9afb169b852b42a7d87a790eb051758
SHA512122f8819c0268f5bf6dadacdc6586b7509c0ece6155e8d2eccc897afea84ec246a7f193ce2975ddc134107b64fd51ecf56ed0f14dc443823759d6b76d61fae4f
-
Filesize
250KB
MD50bd21526be1cb4e6c3b7d1749bd15037
SHA169736ed019fa97bbf6fedbbefe1326dd0b045cc2
SHA256ac0714b736ed53a80169e9e847824fae03e47dc3665baa5455b0bb3a6c840d0e
SHA51207212372e51aed6ff86e729adaa50849cb8a7903aa6f6743fbb005d11227862a09f23db694a8712353829a06565ee18a8853e4c6f777499a23c52568f9ee6503
-
Filesize
1.1MB
MD5a93f93d8a04247c6a7e953abc29e50b3
SHA139a1e11dfecf851f92adc4e983aa83f7f209a575
SHA2561b3085f54221c89e2ef722447393abb5ba252a5bd94c6cae7996106eeb2fb517
SHA5129bc00569837a94a570500d3a8988f4e10515e9af56af994b32559fb0c823046021ccf8b7714993cc551bf6afb9f382e86b408fd25b4f0c7b830d3ae0d34d688a
-
Filesize
1.0MB
MD55092d93091d53034eca35055c4b08b63
SHA1d106600cc1f51f57ba63b92c5d9a689bb3e34711
SHA2569fcc7f7a4cb9d8929ba0e18579da888c94561aab766ac38cabd47b13292e3c5a
SHA512289e36e4d343de576dbec44ad4677b404c283d0be58aee08b21f4e30c221b74c65c63d403f24ed1b47afdfc84773ebb59d2b329a16a707f6f52aab9b016d39fe
-
Filesize
407KB
MD52aa216621aa7bb12927a4ca8b23631c8
SHA1f4c2714aed5663012951ad7fd923bfd798601fcf
SHA256a6909ebdb4e875f57474a4c6850cf756e6ddf75588120a3a422f9f4d76aa4c43
SHA512e7ca67aed1be1f3e983416f704785e2d4fb855fdc23dcf6d6ded4cbc2c8b4bce7ae66eb262e2462c0f048bebaa878760cc67b1fc65e6c3615f24c148fca5e6ac
-
Filesize
231KB
MD5db95ab91704cf53b86b2873f096336f7
SHA11603647d7db463a23eb807eafe0cfd5172ed639c
SHA256edbe38643a78cb70c5b35fa268d4f5a2c1d5bc377d6bfe4f27e8effc0f1796db
SHA51229a8c756ecfd0aa63c914b3e2636f2c26b6d9744e5d3a7e18abe6ba792884454abe38d05b961ec10581d6143dd8244afa6e804e728aaba27503fc9a1f8d6033f
-
Filesize
424KB
MD53f5d5ab5cc80ae55dca1719549dc3627
SHA1fc1a5e8b43ddd46c4d301127f9c2e07a613809f5
SHA256adde7822a6f4b22b80e8348fe09d9d716e2f8519b8be926598a53463f43b569f
SHA512885988fb4fb5b0a0b4c9b5f067c5b36a7fb7b731def6bbd3860832da215f19911b9a064973f74180461bace2bd04a2735142bb770783cb46e1b1d87c728497dc