Analysis
-
max time kernel
47s -
max time network
130s -
platform
android_x86 -
resource
android-x86-arm-20240221-en -
resource tags
-
submitted
25/03/2024, 13:11
General
-
Target
f407febcef0872ba3dcc4de04a91b1ae3afa0981bbd6a92ebf9169e71857e68e.apk
-
Size
10.8MB
-
MD5
7c9aaad375d87e0f5d80d65f48a64d29
-
SHA1
ccdcb9f4faa92fed491bfa64662743d3bc339f15
-
SHA256
f407febcef0872ba3dcc4de04a91b1ae3afa0981bbd6a92ebf9169e71857e68e
-
SHA512
8ace5684caa6f5a82a4d8123faa92d9f1e817778bf24117ccc721c92e1fb1d6df5f1a5a0eadfaf3a91b81b65e781c4b1fdbce71d2ea221f88f41af5bbbaaa3ea
-
SSDEEP
196608:rAsKZ9wr5C+LxRFanXgM1xMXat+DsCeNMpeRjO30BHFpvAQ1dL7nYWCDo01:rAt9IP49xSaksCeNo30BHFpbpYWCEg
Malware Config
Signatures
-
Checks Android system properties for emulator presence. 1 TTPs 1 IoCs
-
Loads dropped Dex/Jar 1 TTPs 19 IoCs
Runs executable file dropped to the device during analysis.
-
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
-
Reads information about phone network operator. 1 TTPs
-
Uses Crypto APIs (Might try to encrypt user data) 1 IoCs
Processes
-
com.volcanoforce.lost.beta1⤵
- Checks Android system properties for emulator presence.
- Loads dropped Dex/Jar
- Makes use of the framework's foreground persistence service
- Uses Crypto APIs (Might try to encrypt user data)
-
/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.volcanoforce.lost.beta/app_149hu9okwymq4rvygb9/beta.ext.jar --output-vdex-fd=51 --oat-fd=52 --oat-location=/data/user/0/com.volcanoforce.lost.beta/app_149hu9okwymq4rvygb9/oat/x86/beta.ext.odex --compiler-filter=quicken --class-loader-context=&2⤵
- Loads dropped Dex/Jar
-
-
/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.volcanoforce.lost.beta/app_149hu9okwymq4rvygb9/beta.dat.jar --output-vdex-fd=50 --oat-fd=52 --oat-location=/data/user/0/com.volcanoforce.lost.beta/app_149hu9okwymq4rvygb9/oat/x86/beta.dat.odex --compiler-filter=quicken --class-loader-context=&2⤵
- Loads dropped Dex/Jar
-
-
/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.volcanoforce.lost.beta/app_149hu9okwymq4rvygb9/beta.uni.jar --output-vdex-fd=51 --oat-fd=52 --oat-location=/data/user/0/com.volcanoforce.lost.beta/app_149hu9okwymq4rvygb9/oat/x86/beta.uni.odex --compiler-filter=quicken --class-loader-context=&2⤵
- Loads dropped Dex/Jar
-
-
/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.volcanoforce.lost.beta/app_149hu9okwymq4rvygb9/beta.stp.jar --output-vdex-fd=51 --oat-fd=52 --oat-location=/data/user/0/com.volcanoforce.lost.beta/app_149hu9okwymq4rvygb9/oat/x86/beta.stp.odex --compiler-filter=quicken --class-loader-context=&2⤵
- Loads dropped Dex/Jar
-
-
/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.volcanoforce.lost.beta/app_149hu9okwymq4rvygb9/beta.irs.jar --output-vdex-fd=51 --oat-fd=52 --oat-location=/data/user/0/com.volcanoforce.lost.beta/app_149hu9okwymq4rvygb9/oat/x86/beta.irs.odex --compiler-filter=quicken --class-loader-context=&2⤵
- Loads dropped Dex/Jar
-
-
/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.volcanoforce.lost.beta/app_149hu9okwymq4rvygb9/ECkkrMnzF.dex --output-vdex-fd=45 --oat-fd=46 --oat-location=/data/user/0/com.volcanoforce.lost.beta/app_149hu9okwymq4rvygb9/oat/x86/ECkkrMnzF.odex --compiler-filter=quicken --class-loader-context=&2⤵
- Loads dropped Dex/Jar
-
-
/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.volcanoforce.lost.beta/cache/1582435991586.jar --output-vdex-fd=58 --oat-fd=59 --oat-location=/data/user/0/com.volcanoforce.lost.beta/cache/oat/x86/1582435991586.odex --compiler-filter=quicken --class-loader-context=&2⤵
- Loads dropped Dex/Jar
-
Network
MITRE ATT&CK Mobile v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2KB
MD554b890af87f90b945ed7141b1e03b8b0
SHA1d50cb8eb6ae71856fb16e917b4993f07189524c3
SHA256a5b4c4a6edd065cf45d4d406dca6909cb452e7d8f353507c068db6c62cb61180
SHA512dae68c5b1b9ec5cda785392f989f8a93df5c38f99540fdd7d5e5991724e11137a7a33f0ba6c66d7c901a6fa15881dc8ffb43411d24f1c27eeb37577625d1dbba
-
Filesize
2KB
MD5ffe07ab696442f182b0268b74d9ff0ef
SHA161f572220ec8743229198630aaea228c9c4ff235
SHA25665385ff81153bbe7573fa61ee49daaddfc3cf931bdd4c453126a56ac2754f077
SHA512155d47deff17ffa98ebc4e5a8c51710956d7941c555240b86b564e86d7c8d100aaf6a31d6bdd003073698dd899409be860ddd57e0a682ae6533744610cb4d4cb
-
Filesize
1.3MB
MD5ee6b3c53d6d7983574fc27b90c25e69b
SHA1424455d5370b288ede8928f425cbe95908dee9e5
SHA2566e245ae86fff6991b4a83814fce949adec49b1cb207e7fefd32a1814f3686d10
SHA512853069d8c5b51a9b585daae09d36d17db62c473fab566304a5fe5ed537d71a74fb672da759c9c9b3905e96b611148df84ed06500718a8a2bab84acab5532265c
-
Filesize
276KB
MD5dd8e090c64927079ecb193b6ce8a8e2d
SHA1ddf9c3694c03c2c6973d8e8e3c7ee5264b783a21
SHA2565305ed93474859dee18991dc64bafb4c67009a30a824c102b0d453786e2b1b50
SHA5121a96eeb0202b18aae99c62d5d28ea312a90489313869338491bf3aa8ff91e649a2194d20ade920caf0be9375f4d7272d478e5617cb7912324f66bdd3dfe8397e
-
Filesize
460KB
MD50a9f182c1c084d2d827ac1200d06829a
SHA1d0a97cb8174635aabe1159e539b0b5654f39bda9
SHA256cf8a65ccafaa01fa67172974929cd7b5c0dfb445f26c1027404fd58004ccbba9
SHA512a9bff007cf3ace654543206a69c0321e39467da70c1e23907a073a77124d1acc791ade9d465941b22b44734f2015a540c6a2d6a3175f297ca6d36b4b66e654e6
-
Filesize
168KB
MD5deef01fcb391ca246f280bde62e6b3cd
SHA1c19be3ff3e54f422b017a3096021be885ab43da8
SHA2560a8cfce946d836ae94b9d97fac78e9ccb3a556c3c9121a500a84e6615a7799b2
SHA512bc85f4f55a8e06a076a64d7f826466215c68a21c5728ea764bac96574d180a209aabc6930bb3c9cd383a14152c85b8db1290a43071104ea6372900fa059f082f
-
Filesize
76B
MD5d86ac199c86ca1758aa5bdfc6a0cd643
SHA1fe21718fa7e11ef357d6f0d01e036aa857a6f83f
SHA256f7d0c2bf9aa298f91b7e2bd9e9e4c76f9a00a0309518e3801d93ed27e1e96487
SHA512425d0b5db2bd47c6bb0504fbffaeea6e723165a0b7a300cd0fc53fa628441d0c66d48a0da8fd4cc52fc58dedf7c4c4e3461aab99801b98dfaaadb365dc0831c5
-
Filesize
835B
MD58b0b46e78cadb9530461829e6076b9b2
SHA1c5654bc4bc1ee8726069c40b9ea5f61f20d7d78b
SHA25660e66d0031403304f0eae7fc2e11ae9d9b9973f4f232fff9452de46efdac7f76
SHA51278f62a0a0e9ebdd7c39a11c04988fd57bd55884e7590d86ec3b70df79a8038ea647fa4c638f0878f081cce6001ba259b8e8b7e618503b3a34efd9be22b84a92b
-
Filesize
9KB
MD5e8e0527a01aefdb89afd2c508f131da1
SHA1f1103e6b260c657ceb3d95f1b023af3fda8b133a
SHA256f809447486f89fcaa74f87e06d126d103d37eb2b3157e88f2c06d989b2c284ce
SHA512fb53683a83f1068d0f94567b156e6a8910c45b1b5f33db919f7e0b9c55eab28507a235ef76d44d5b549599ea3b54dbc00496a633339d276a80f395da938d6d34
-
Filesize
4KB
MD5f2b4b0190b9f384ca885f0c8c9b14700
SHA1934ff2646757b5b6e7f20f6a0aa76c7f995d9361
SHA2560a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514
SHA512ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1
-
Filesize
512B
MD5cfb39dc97c253414a2f71d28ee7c50df
SHA1b4cd67525bd79bd55991a2ab8cd733091afdf538
SHA2567b9f1859ffe6cbe52d8d24e544cf142a843d11df4c5e0799bb1e9b554f83b9d3
SHA5128f7558a4dc4bdf3927740cce196a2eb7bd3ba3211da4a553fc955e18d8446adb0a483e8b57ec8a2dfadefce949443009e90544bc7230680efc72ea52121bab50
-
Filesize
16KB
MD52f23585f857702e37a51b24378d0c12f
SHA1c4d0ce333ed599b7e8563db52a409f147937cc66
SHA25622a9e2911fa042f46a7fa8b0f56059d3ff1590b65983677b1792aa9a8a8f037b
SHA512748f36fb3903ecf2025c6bfcc00ca95772d4e386dc01755037882632b9c5a5e601ed39310d3c8f58803d4db53803a6f3f47eb457f2360e198346df2b7ef01942
-
Filesize
3.6MB
MD5a717e86d123e9d1bdb3e837ffdec49cf
SHA131e1fb35ee36247298c5180219c05bc07e5504bc
SHA2568bd40fd5b21316e784673f5d9af3530f12b68362e0ea850e6e79dd59686e577c
SHA51234b200fb466f9cfe4a3fb4d1775cf3356c2d10cfbf66873a1a128846d3abef14804d34b3b0dacba907a8418d111f6dcf5337f15781a9e49dda8ba54e3301c074
-
Filesize
1KB
MD5ca59baa6bc8501bf5d01eb6794528722
SHA1f4329b68933cf0f6b05d62047433994d42135131
SHA256d0acfe84131fd32ef219e009c6bd6aeb74c02b27d793a7ecf3878c1ffa9e9d1b
SHA51214e83835fc9b645c3e411ce68b4c2b9a824d453fdcfcd452fa30f5a0260fbf56db4daf72710bb79cb54512b4e862314af51212479e57508a56c17450e074e68c
-
Filesize
4KB
MD5c4274b83a39a2e96a9d6873058e25504
SHA1a97b170f29a9430e484e70177021737d7d82124a
SHA2562e348835c23b07f231a4930f06ca23ad5e64ac4b3a76842a983e688cfb140323
SHA5128cc65d354cc599c4b3e0e2eeeac0eee93161d7dfa4d04cbadb5bbf84cdb6ac5558aa8c7f2801dbaca36dafa3232918f0520f48584e2ba6b91cd5d654ab955c2c
-
Filesize
4KB
MD5d62c31fe9e10484b973376e54a491add
SHA18b16e46f7ada9dc117f661cea669ce322d47ddbf
SHA256fd0fdca81a5a5ad858581d92e064b4bf06aabafdbbb22ee8c6573f3a5c19307a
SHA51263924558a9045cbbf570dfe756068b6f156a333ef57a40437eea8b059ce5a7b3a7f261843069018ae019f28f0a73e7d0f819a072745a3444d4a4226d7c85434d
-
Filesize
6KB
MD545ad0360647bf948acda3f062a3b3079
SHA12fccc66b64e6640186bea3e172603d001b3db08e
SHA2560c75390c41be208ff311ba6e69694aa793206255513f5558ca9a24078163981a
SHA512f177b4d50358deb7e2e59f4ccfce2a4b02e517ab234575c578bc36db97dd5479d46169dcff75286357e949fa50ecda417dc22592831f8392c4e5a33f55248d89
-
Filesize
6KB
MD5c6815ab371a68494fcf6c6adc70e8cfc
SHA166afde8801e02f36bd31e26980067561573b33cf
SHA2560fe96269ffdf1fb5b936a2d790da8b06c2613d17eb4e71fa31193a7bb1b9973d
SHA512f706954c92c4f21f52405f80843f3ce8df9388e91309ac91e394ebc5778737f0316fc218ca4bf8075effe49bf24903af200dcdfc424de365568d4652ec6b1a5f
-
Filesize
6.3MB
MD5ac8451596112a20f73301657b8228f87
SHA13d6482c7304ca7a84f68308c3372d5454597f382
SHA2568d7bf693ab27f4bc821db6208b8656bad20586cb8a126d706f0ff62b9f975625
SHA512255be7e97eebb98bb137567a607be2a7564018ae1742915e4612cbc1f1a826ecddc45c9248a25bc3666a63ee13874d1a6632c59fad6d33c2bf7a405a7de7b30c
-
Filesize
4.5MB
MD58fb5d3f4ef638d1e5cc36583dd11e866
SHA18f4ed64cd7a60b5e5a217d45de0eb82a2f6fc91a
SHA256af6a9aa014e31f1992acb490331b46a9d89b0bd8ef35e1f59f00a660dd12c5e4
SHA512b5d2fa0964c6d01617a1fc94b999614b96097b18283d168dda501b3ee1fe697c5b07340196d2f77862e2d36f4c54fd4c7238171e4512ffde054171e2d887f561
-
Filesize
6.3MB
MD56561643f3d37a226508361fe0a193756
SHA11d22edbd28d84b2ed75a2f2d51a6852c9ffe1310
SHA256519d6c34b3557b70de7fd29b44dae9eafa63a89bc5d767b3c8676a432e2d47ec
SHA5128bcd097defa113a46da79b7e0796735001b7d0d89331fb9921b971381c6d17ae06833eb0eb262952703bc155eca8be071cba51940bd58cb265d3f1eeacede416
-
Filesize
684KB
MD5c7405d03f169b980f10cea6f717cb6a9
SHA18847b0550640d8cadd2325d19f10c60f232f1166
SHA256c8ae0ce4f329bb0cd55672aaa5f8410bd27684aaac1b96085ed9bf54ebea3567
SHA5128e8dfe8e23bfa882fef6882fac5c60618c5f8bedfc13f42f3a34354f2874d379e4a6cdf1c80ff9c0063898c64371ebacc89888bcec29c69e5dc8990160633d22
-
Filesize
684KB
MD56263092a4066cc703fba3c43d7ccaaee
SHA1dd29ff70f4a0c4efadf810b605ccf3217dd02c6b
SHA25660db470efa19a143065f88eb485ad31ee9afb169b852b42a7d87a790eb051758
SHA512122f8819c0268f5bf6dadacdc6586b7509c0ece6155e8d2eccc897afea84ec246a7f193ce2975ddc134107b64fd51ecf56ed0f14dc443823759d6b76d61fae4f
-
Filesize
1.1MB
MD504296351293b42196f66aecc1afe172e
SHA153fa9577e740e587499c8556ae31aa7e18d75b8b
SHA2569fa88a0783507c316e66336d37fc16ad8e8cf45ba701478c1bbbda52596e87ef
SHA512d116890fad4112a62da9dceddb02e0be43a29847aa23721f5bd7168329fbd4a3994921ca3c2a0851e233366d37601c43eac977819f892122540aea438c1e2502
-
Filesize
1.1MB
MD549b91e17f8168f2d406b5cd32e34c9b4
SHA196054ee16e5dccae6de5b42395813fe5cbae0a4a
SHA25631fdc6c48124540edf532fa66a36652f997ec505662320abc3738a8308c3fe4a
SHA512d4117115f9e6fdef2ace6724d984f60e7e054f7423195bd2cac22c22101052070c29e1350c9dbe5869b067d64c5e29fe86671757f484ac04db2102e712115193
-
Filesize
424KB
MD55281c31bc937e0486df57682e61c5c86
SHA1ce34b2893d203c76bf90cb67d5a1d56e957fa315
SHA2562f6654f61f0ab758f6825a38f078cf4a1bb1cbed1a99819ea18ae96634171401
SHA5126219e0f2a04232ae6aec1736eefd00f696d1badbbaeb68dbff5254370281b2b82fbaf10c256e982004bca2fa3f4259106bc1fe6562850d420bcf283c1c8c80a9
-
Filesize
424KB
MD53f5d5ab5cc80ae55dca1719549dc3627
SHA1fc1a5e8b43ddd46c4d301127f9c2e07a613809f5
SHA256adde7822a6f4b22b80e8348fe09d9d716e2f8519b8be926598a53463f43b569f
SHA512885988fb4fb5b0a0b4c9b5f067c5b36a7fb7b731def6bbd3860832da215f19911b9a064973f74180461bace2bd04a2735142bb770783cb46e1b1d87c728497dc
-
Filesize
20KB
MD52048eb6124a452540ee51dae4145aadf
SHA1d05005b2cd7fe4cd652b0d7fd1bdac2c19d51451
SHA256105c54b6fe3f25350e92187467761598e4c21d62b1091b77d091f65f3bd98864
SHA512bb6cb3853dd2a5d0701e20607d4e153ae201268dd2e5e2d06cc2df208b3b4dc50132a4ab428251b1644d2399fcc717662438d082ff14203387bab8794109d44d
-
Filesize
20KB
MD5fde2ee00cbd121cfab5290b078aa3ceb
SHA1e2b77d5320e155e413d040a8c20020962065b2f8
SHA2562897b0812077c654a9b3fbb0b6303d5cde681eeba7ad9981de65716c7810d685
SHA512a9326aff8e454a2b4ac09984ef2a65fddd4dc146b4c44d839035549bff8c9fdaae490326d0b018f76c1ca2e4fb25426d74f550ca0950982fba632a023af99a56