Analysis
- max time kernel
15s - max time network
309s - platform
android_x64 - resource
android-x64-arm64-20240221-en - resource tags
androidarch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20240221-enlocale:en-usos:android-11-x64system - submitted
02/04/2024, 06:58
Static task
static1
Behavioral task
behavioral1
Sample
18832427a4a7dd1c2960a40fc13fc0dfc5357ecafdf7dae9f89d721f4138bc25.apk
Resource
android-x64-20240221-en
Behavioral task
behavioral2
Sample
18832427a4a7dd1c2960a40fc13fc0dfc5357ecafdf7dae9f89d721f4138bc25.apk
Resource
android-x64-arm64-20240221-en
Behavioral task
behavioral3
Sample
18832427a4a7dd1c2960a40fc13fc0dfc5357ecafdf7dae9f89d721f4138bc25.apk
Resource
android-33-x64-arm64-20240229-en
Behavioral task
behavioral4
Sample
18832427a4a7dd1c2960a40fc13fc0dfc5357ecafdf7dae9f89d721f4138bc25.apk
Resource
android-x86-arm-20240221-en
General
- Target 18832427a4a7dd1c2960a40fc13fc0dfc5357ecafdf7dae9f89d721f4138bc25.apk
- Size 1.6MB
- Sample240402-hrp13aae2w
- SHA256 18832427a4a7dd1c2960a40fc13fc0dfc5357ecafdf7dae9f89d721f4138bc25
- MD5 b8d3cd2eed88a3dbd30e1447c1add48b
- SHA1 c21e13d788b4c177829ac43b8bd4c71487fe41f5
- SHA512 fe012a29fc00b8d76f9c293ca42618edeca8e2eec41f8117513ed162b3e9a178d2ee5ca3e9abcab0cc423c03c2d0b9a3867f428b9ed9f75cb06bfcbc8ab540f3
- SSDEEP 49152:CyLC2HJXfWuJASAW5Gxxqa3j+SuqWTSMJR:7C2pXMSAWW3juI6R
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
-
pid Process 4373 com.arhmhjzr.qrcbiocw - Loads dropped Dex/Jar 1 TTPs 1 IoCs
Runs executable file dropped to the device during analysis.
ioc pid Process /data/user/0/com.arhmhjzr.qrcbiocw/app_files/nrjohko.jar 4373 com.arhmhjzr.qrcbiocw - Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
description ioc Process Framework service call android.app.IActivityManager.setServiceForeground com.arhmhjzr.qrcbiocw - Requests enabling of the accessibility settings. 1 IoCs
description ioc Process Intent action android.settings.ACCESSIBILITY_SETTINGS com.arhmhjzr.qrcbiocw - Acquires the wake lock 1 IoCs
description ioc Process Framework service call android.os.IPowerManager.acquireWakeLock com.arhmhjzr.qrcbiocw
Processes
Network
MITRE ATT&CK Mobile v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path /data/user/0/com.arhmhjzr.qrcbiocw/app_files/nrjohko.jar
- Size 224KB
- SHA256 9c67b44a54de4e031577592eab5b73cabf7d234ee7c4fedcf17b9f6e6c84134d
- MD5 c4588edd01e29f3d8ee7436176a456af
- SHA1 d3891818b4087d520f37477bccb93dd72811cc07
- SHA512 939617259aa77a8cc74004dc03ab45ed1a593c453c187a5dea803b56db201050cb0f83c238fa17fb2613480218399b912ebfa49b351472843cd2b4998d2f17dc
- SSDEEP 6144:yeMTfQbqquvZ25pLtiYD9xONf8WhM2JbPUnShd1:yeMjQbqBx0lxIb/8kL
- MD5 SHA1 SHA512 SSDEEP
- Path /data/user/0/com.arhmhjzr.qrcbiocw/app_files/nrjohko.jar
- Size 469KB
- SHA256 bda2af1c666433f5026692405a11b8a30646c7f95f86f27e2279002e51dbf302
- MD5 7961033a8ef99a9109afb5726e53e485
- SHA1 ba786fbec06875c048a375afa172c6f53a1d1687
- SHA512 69cccf064c1858541ab059c0b58aaabce8cdde3a6f6ae43edaaebc74cbf94f77c84842063dab5f0d722f41a608e9bf7a3b9c7d8b98a24e3769e5129d63a96323
- SSDEEP 12288:qHzVsfxTyvv7XcUzTCPdzcyGt0dlCd9bEjsh8QWt16MJv:0sJTyvv7XcUzGPdzcyaiCd9bus7Wt16a
- MD5 SHA1 SHA512 SSDEEP