d2b5dd74b5950953028cabf5d62c40366b14a2e803fb091500c6b6826f03f95e

Analysis

max time kernel
6s
max time network
145s
platform
android_x64
resource
android-x64-arm64-20240221-en
resource tags

androidarch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20240221-enlocale:en-usos:android-11-x64system
submitted
02-05-2024 02:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d2b5dd74b5950953028cabf5d62c40366b14a2e803fb091500c6b6826f03f95e.apk
Size

1.4MB
MD5

74c96a71cd95e6fab924deb1ddb0a498
SHA1

7420f8e52a6f890531cbe3e3c4adf2c15e9e423b
SHA256

d2b5dd74b5950953028cabf5d62c40366b14a2e803fb091500c6b6826f03f95e
SHA512

288ffaa98b853942847367a7ec4f48863d14aa4355234be9b45791a69c88e83f3248a725c0243637cb2a8b1dc62f14346a6b807a5218325a35e8598a6f0287be
SSDEEP

24576:Bc1LRTK8hDfBWjuWgMJbJ1VVmw63d+KGZtWSF9ymB7R8uQzgpjbM/4zgdS:BKNzhj4jjg87VVmw6NpGZoSF9nxnQzgF

Score

7^/10

discovery evasion persistence

Malware Config

Signatures

Loads dropped Dex/Jar 1 TTPs 2 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/system_ext/framework/androidx.window.sidecar.jar	4378	com.zejapizehiyuki.yijoro
/system_ext/framework/androidx.window.sidecar.jar	4378	com.zejapizehiyuki.yijoro

Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

Application may abuse the framework's foreground service to continue running in the foreground.

evasion persistence

Foreground Persistence

T1541

description	ioc	Process
Framework service call	android.app.IActivityManager.setServiceForeground	com.zejapizehiyuki.yijoro

Queries the mobile country code (MCC) 1 TTPs 1 IoCs

discovery

System Network Configuration Discovery

T1422

description	ioc	Process
Framework service call	com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone	com.zejapizehiyuki.yijoro

Acquires the wake lock 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.zejapizehiyuki.yijoro

com.zejapizehiyuki.yijoro
1⤵
- Loads dropped Dex/Jar
- Makes use of the framework's foreground persistence service
- Queries the mobile country code (MCC)
- Acquires the wake lock
PID:4378

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Foreground Persistence

T1541

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Foreground Persistence

T1541

Credential Access

Discovery

System Network Configuration Discovery

T1422

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/data/user/0/com.zejapizehiyuki.yijoro/no_backup/androidx.work.workdb

Filesize
4KB

MD5
7e858c4054eb00fcddc653a04e5cd1c6

SHA1
2e056bf31a8d78df136f02a62afeeca77f4faccf

SHA256
9010186c5c083155a45673017d1e31c2a178e63cc15a57bbffde4d1956a23dad

SHA512
d0c7a120940c8e637d5566ef179d01eff88a2c2650afda69ad2a46aad76533eaace192028bba3d60407b4e34a950e7560f95d9f9b8eebe361ef62897d88b30cb

Download Submit
/data/user/0/com.zejapizehiyuki.yijoro/no_backup/androidx.work.workdb-journal

Filesize
512B

MD5
bfd4a9ecc1bcfc4a5034c2ca4f38a160

SHA1
06351fab8951257d630ebae2e6ae1f1135524079

SHA256
2cb1cd59ebf184dfbbbbea66dab8087f7dc823cb52f2c70d0278a957ab578986

SHA512
2fb4b2a093db469924914e5b78bf8dff017fd2875169912e2ad95e5250501273f00e2fa919f790c25032355f79b4663211e56c198ed6fb92138f919898f8c4a8

Download Submit
/data/user/0/com.zejapizehiyuki.yijoro/no_backup/androidx.work.workdb-shm

Filesize
32KB

MD5
bb7df04e1b0a2570657527a7e108ae23

SHA1
5188431849b4613152fd7bdba6a3ff0a4fd6424b

SHA256
c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479

SHA512
768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

Download Submit
/data/user/0/com.zejapizehiyuki.yijoro/no_backup/androidx.work.workdb-wal

Filesize
16KB

MD5
01e198eb03a3fa0cc79ce5fc8b7e752c

SHA1
7ac59f4cdc22afeb8ad7f0a94b7d19b0bbdae281

SHA256
7f02d62515309fd2a5421767fcc2370ea6fe04d6015414b7e0f6ee1e2c52940b

SHA512
c0d86420d8ab0e98eb02f36944eb5d94a14abdc4b57092cd262d1b6e7741d749fba423596ddfabdabb4a1e6c8a3b677b4de8f0ac286df9e50bf333489616be84

Download Submit
/data/user/0/com.zejapizehiyuki.yijoro/no_backup/androidx.work.workdb-wal

Filesize
112KB

MD5
4e61b2d44075d0aee232efc97bf0c1be

SHA1
292c4f41505d5da132a10ccf90e4b78fdca1a3ad

SHA256
9fede1d68edfda270b8bbbfc19a74d00f5459b0d184e728643ea0fd5702564b9

SHA512
7434bf80b7f2d33ebf20589ba7e9994fab8183f26ac7451c84865f5a89c361140f0e77ca434f73935b91444641383739156d0777c05df4604971b0a1d37638bc

Download Submit
/data/user/0/com.zejapizehiyuki.yijoro/no_backup/androidx.work.workdb-wal

Filesize
177KB

MD5
a93e7a4abee557e36d0707249a7cb5f5

SHA1
b52f5ea92e1ee5ce04e5053d6bd050b367fe659c

SHA256
2810f9af11cf0695a074091f161c064dbc720fa24c6351777f8b420be230b039

SHA512
e27693f2d413e575765151b8d653af5bd1253f8b9e201c2a4e6fbe5ebe72aaaab1b51054303fc7a3e38e8bb6a2a1d8eaf3ae48f68d80091a55ca66374b9230a8

Download Submit
/system_ext/framework/androidx.window.sidecar.jar

Filesize
12KB

MD5
bdf3529e80318eb14e53a5bf3720c10d

SHA1
25c9ace4b1af6e80ebb2572345972c56505969ba

SHA256
bbc8300dd1e9cd08de8f66560c1ac2c928615b72b51cef9649f88974f586d64b

SHA512
48b9c2d01171bb651b9b54826baa51f4add48431a3efd8ceb5f7cc3bcd6f8f37edf47fabb24349dd15b3a02329cd450f90a8d164bf4f8dfae554bf3b35a8a55b

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads