Analysis

  • max time kernel
    6s
  • max time network
    153s
  • platform
    android_x64
  • resource
    android-x64-20240221-en
  • resource tags

    androidarch:x64arch:x86image:android-x64-20240221-enlocale:en-usos:android-10-x64system
  • submitted
    02-05-2024 02:11

General

  • Target

    d5ca7ba75cfb8fd76929c1b8f6547780d8305a6654b6423124d380ff59b0d1c9.apk

  • Size

    1.4MB

  • MD5

    dbf98b9b54fdd429ceb18b35158e44d4

  • SHA1

    ae15f0e4c2c299adf52de17b51400fcf25479184

  • SHA256

    d5ca7ba75cfb8fd76929c1b8f6547780d8305a6654b6423124d380ff59b0d1c9

  • SHA512

    b8e7838627cd0346480aa456be863ecc6c56ce4b43fd408be9e104c1183b3d6c3b6fdc5f329e9f4e4421fec3599232e887803ba01959fe56c6a8b30da4fa1079

  • SSDEEP

    24576:My/WPvDL4292BzHVFYixHq9bYHfumO9dRuKKiwBUH27m8AdWeUR1uffgpABG/4zb:F/W3f4292Bz1FYsHq9bYHfumscKKipw6

Malware Config

Signatures

  • Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

    Application may abuse the framework's foreground service to continue running in the foreground.

  • Queries the mobile country code (MCC) 1 TTPs 1 IoCs
  • Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
  • Acquires the wake lock 1 IoCs

Processes

  • com.camavoyaxiwokocu.huvusuwi
    1⤵
    • Makes use of the framework's foreground persistence service
    • Queries the mobile country code (MCC)
    • Registers a broadcast receiver at runtime (usually for listening for system events)
    • Acquires the wake lock
    PID:5040

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/data/com.camavoyaxiwokocu.huvusuwi/no_backup/androidx.work.workdb

    Filesize

    4KB

    MD5

    f2b4b0190b9f384ca885f0c8c9b14700

    SHA1

    934ff2646757b5b6e7f20f6a0aa76c7f995d9361

    SHA256

    0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514

    SHA512

    ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1

  • /data/data/com.camavoyaxiwokocu.huvusuwi/no_backup/androidx.work.workdb-journal

    Filesize

    512B

    MD5

    0ef9d81637895131c7198ac9b2bbb91c

    SHA1

    dfb30dc6335e7e837b78c59ecce7d1ce06417562

    SHA256

    6b742d6d712f6e353c4cfea610c1e7915408e15ed024ebbcb293baa20ecff7a2

    SHA512

    1fcd075680aa4ba96985c719fbcf3f0b64b539d25943b5bc5f0ac9fd694d9f19c7ecf28b4042f95cf97f9b25f0595489c00bcd584fe7adf02421c86dcabd44d6

  • /data/data/com.camavoyaxiwokocu.huvusuwi/no_backup/androidx.work.workdb-shm

    Filesize

    32KB

    MD5

    bb7df04e1b0a2570657527a7e108ae23

    SHA1

    5188431849b4613152fd7bdba6a3ff0a4fd6424b

    SHA256

    c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479

    SHA512

    768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

  • /data/data/com.camavoyaxiwokocu.huvusuwi/no_backup/androidx.work.workdb-wal

    Filesize

    16KB

    MD5

    a4b9c94c04e4253b291c24973fd1376c

    SHA1

    76d1c1896a55c6a24bc90a2e93d898c2694e6f25

    SHA256

    1fa2d0adbc229a914e0ee6edcbc1f8cb36105850b4a0de59dbbf1ab5cc726424

    SHA512

    76523f210dc47b7feba4bc744a48d2e5ae99c3d2fd740bb44e3bebfdf4b2bd43f15900f65c623343fe8cf31fba3e7e1db9ea8a2589325b9abc911ab6fb3da241

  • /data/data/com.camavoyaxiwokocu.huvusuwi/no_backup/androidx.work.workdb-wal

    Filesize

    112KB

    MD5

    accd9ee74ee87e8a112c305db774e5b7

    SHA1

    dd307cce413c101edd937b7555650510c6e290d8

    SHA256

    85fbd1e59a39d7db093d6c8993aee51f076bdbbe00b7f98c7e899bcb52137101

    SHA512

    efbdbaa6a93c49fc3af6d29a0c70bf4609c47d29a5d29dfe2e5add23d8b42ab99061e5e7c5aca30ccc140631d49337df758929c5b818c0d057e621929b6a2b8e

  • /data/data/com.camavoyaxiwokocu.huvusuwi/no_backup/androidx.work.workdb-wal

    Filesize

    185KB

    MD5

    73f9e1c02a7b68436c9065e52f5ccd06

    SHA1

    06be2dd7e5b9ccea1dce37df8558bc4ba433cdca

    SHA256

    8821f3797ce4495e0dc636e444142f11b53d1d401d9d219fb7fe20b8609a0c18

    SHA512

    a370163bd77c3a5057e1fb74eaba8821bf960929d995a294e5c60321f0ea9537818d934c02becf10dbda357e23586381fc3ef94d581506494b8acde35be1aa8a