Analysis
-
max time kernel
151s -
max time network
155s -
platform
android_x64 -
resource
android-x64-20240221-en -
resource tags
androidarch:x64arch:x86image:android-x64-20240221-enlocale:en-usos:android-10-x64system -
submitted
29-04-2024 16:21
Behavioral task
behavioral1
Sample
dimond_free.apk
Resource
android-x86-arm-20240221-en
Behavioral task
behavioral2
Sample
dimond_free.apk
Resource
android-x64-20240221-en
General
-
Target
dimond_free.apk
-
Size
789KB
-
MD5
aade91cf3cf4c46f64a02f97e93b0d2d
-
SHA1
1c92d900ebab95c730f7bf8598a46661723e2cc9
-
SHA256
517d243ae971f0bd724466676f2ed7f6397fa647791e5018f82126d7c863c723
-
SHA512
ac164f4457ff22379eab7cb25e013faa95def38b1ba7ca48af6e98b8d44cdff96402b3ae06f21404f8f46b9df63bc3e010df0026cb887a0feb0c491b17792067
-
SSDEEP
24576:WTJkVAo5cmjthrKBOkJCQUsGEqGEbGEhGEtc:WTyGObIJCRLsrVD
Malware Config
Signatures
-
Loads dropped Dex/Jar 1 TTPs 2 IoCs
Runs executable file dropped to the device during analysis.
Processes:
com.lololpioc pid process /data/user/0/com.lololp/cache/natives_sec_blob4612956379034096035.dex 5049 com.lololp /data/user/0/com.lololp/cache/natives_sec_blob4612956379034096035.dex 5049 com.lololp -
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
Processes:
com.lololpdescription ioc process Framework service call android.app.IActivityManager.registerReceiver com.lololp -
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
Processes:
com.lololpdescription ioc process Framework API call javax.crypto.Cipher.doFinal com.lololp
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
/data/data/com.lololp/cache/natives_sec_blob4612956379034096035.dexFilesize
407KB
MD5e400b315488068e409c0a67ec54b5cf9
SHA1ebf22b074a669a1f964d0203f27c2ed31f76da7e
SHA256cc0c12987c9bafac45177af0c4cfbf10e9ea1a780d63edb7cfad35e6ffb7dbe6
SHA512365f0c7ef1c819fe16ace7def1a17eeac93aeb0295b74e04adeb6370a9be8187737c9667d97f2ca43bc56a2d9924643bb3740981288f878c97864438d677c634
-
/data/data/com.lololp/cache/oat/natives_sec_blob4612956379034096035.dex.cur.profFilesize
362B
MD506adf5da75e7aeec9680c98cfc762855
SHA142c5d1d131d8e48d2cc7ccf4fb5f37971c7dec39
SHA256abd11f8f0165cc4879def0a0450ad5416cf27b6c372f15d4731a229d778d9c5c
SHA5128f5b09fdf68fec3657da206c8f7b07e24aee223c57e5cef2a08b9b3ecf1f05a2a2d12db20846986284f2c6105ecad13374ba1727fba56baff6407da846abdbb6
-
/data/data/com.lololp/files/cloneSettings_234229880.jsonFilesize
8KB
MD5805779ff4b324f2e7bc966226712c511
SHA175ee544449e478d09e7d01ae378a278677e578d8
SHA2569f5f3b22e9fed87358b21071efcd0d60ef36f38c0552e3c5f0a0d602e4f33247
SHA5129ef8f501150982f8db49a7fa20179b2943d45d616b4fd9cc4de5040cd7f5e735c92801510bca5e7c1a258ccaaec754dbabb1c8f59da92f0d7a640b4dfe27833f