Resubmissions

02/04/2024, 06:58

240402-hrp13aae2w8

13/08/2020, 12:07

200813-m8qffw1xej10

Analysis

  • max time kernel
    15s
  • max time network
    309s
  • platform
    android_x64
  • resource
    android-x64-arm64-20240221-en
  • resource tags

    androidarch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20240221-enlocale:en-usos:android-11-x64system
  • submitted
    02/04/2024, 06:58

General

  • Target
    18832427a4a7dd1c2960a40fc13fc0dfc5357ecafdf7dae9f89d721f4138bc25.apk
  • Size 1.6MB
  • Sample240402-hrp13aae2w
  • SHA256 18832427a4a7dd1c2960a40fc13fc0dfc5357ecafdf7dae9f89d721f4138bc25
  • MD5 SHA1 SHA512 SSDEEP

Malware Config

Signatures

  • Removes its main activity from the application launcher 1 TTPs 1 IoCs
  • Loads dropped Dex/Jar 1 TTPs 1 IoCs

    Runs executable file dropped to the device during analysis.

  • Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

    Application may abuse the framework's foreground service to continue running in the foreground.

  • Requests enabling of the accessibility settings. 1 IoCs
  • Acquires the wake lock 1 IoCs

Processes

  • com.arhmhjzr.qrcbiocw
    1⤵
    • Removes its main activity from the application launcher
    • Loads dropped Dex/Jar
    • Makes use of the framework's foreground persistence service
    • Requests enabling of the accessibility settings.
    • Acquires the wake lock
    PID:4373

Network

        MITRE ATT&CK Mobile v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        nrjohko.jar

        • Path /data/user/0/com.arhmhjzr.qrcbiocw/app_files/nrjohko.jar
        • Size 224KB
        • SHA256 9c67b44a54de4e031577592eab5b73cabf7d234ee7c4fedcf17b9f6e6c84134d
        • MD5 SHA1 SHA512 SSDEEP

        nrjohko.jar

        • Path /data/user/0/com.arhmhjzr.qrcbiocw/app_files/nrjohko.jar
        • Size 469KB
        • SHA256 bda2af1c666433f5026692405a11b8a30646c7f95f86f27e2279002e51dbf302
        • MD5 SHA1 SHA512 SSDEEP