Analysis
-
max time kernel
28s -
max time network
130s -
platform
android_x86 -
resource
android-x86-arm-20240506-en -
resource tags
androidarch:armarch:x86image:android-x86-arm-20240506-enlocale:en-usos:android-9-x86system -
submitted
12/05/2024, 12:10
Static task
static1
Behavioral task
behavioral1
Sample
APK Editor_1.8.20_APKPure.apk
Resource
android-x86-arm-20240506-en
Behavioral task
behavioral2
Sample
APK Editor_1.8.20_APKPure.apk
Resource
android-33-x64-arm64-20240508.1-en
General
-
Target
APK Editor_1.8.20_APKPure.apk
-
Size
9.5MB
-
MD5
e538dd06ca86150d6ee88b0a7e051cb6
-
SHA1
990e7077c7a4d9bcf0682fc2de8c15acc3a685a1
-
SHA256
c8e5cfe61b7c274120ee803564fd70783e5ac3bc6c1d5e1668356180fe97ea14
-
SHA512
fee04fc1bf8226a26d54ab9e9e99f900cdcc236597f6af604302c55bfdb812682cec01a008749626664bf680346995afd1bd771a31ce0614f0ca424bed1ae876
-
SSDEEP
196608:tES/GDith4A0Tdrsha70k1eGvzlXsQFhiC67Xc/UFsJ:tES+DiX4A0TdohaFzeIhip7XCUFw
Malware Config
Signatures
-
Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
-
Checks CPU information 2 TTPs 1 IoCs
Checks CPU information which indicate if the system is an emulator.
description ioc Process File opened for read /proc/cpuinfo com.gmail.heagoo.apkeditor -
Checks memory information 2 TTPs 1 IoCs
Checks memory information which indicate if the system is an emulator.
description ioc Process File opened for read /proc/meminfo com.gmail.heagoo.apkeditor -
Loads dropped Dex/Jar 1 TTPs 2 IoCs
Runs executable file dropped to the device during analysis.
ioc pid Process /data/user/0/com.gmail.heagoo.apkeditor/cache/1582435991586.jar 4409 /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.gmail.heagoo.apkeditor/cache/1582435991586.jar --output-vdex-fd=115 --oat-fd=116 --oat-location=/data/user/0/com.gmail.heagoo.apkeditor/cache/oat/x86/1582435991586.odex --compiler-filter=quicken --class-loader-context=& /data/user/0/com.gmail.heagoo.apkeditor/cache/1582435991586.jar 4260 com.gmail.heagoo.apkeditor -
Queries information about running processes on the device 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about running processes on the device.
description ioc Process Framework service call android.app.IActivityManager.getRunningAppProcesses com.gmail.heagoo.apkeditor -
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
description ioc Process Framework service call com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone com.gmail.heagoo.apkeditor -
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
description ioc Process Framework service call android.app.IActivityManager.registerReceiver com.gmail.heagoo.apkeditor -
Acquires the wake lock 1 IoCs
description ioc Process Framework service call android.os.IPowerManager.acquireWakeLock com.gmail.heagoo.apkeditor -
Checks if the internet connection is available 1 TTPs 1 IoCs
description ioc Process Framework service call android.net.IConnectivityManager.getActiveNetworkInfo com.gmail.heagoo.apkeditor -
Reads information about phone network operator. 1 TTPs
-
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
description ioc Process Framework API call javax.crypto.Cipher.doFinal com.gmail.heagoo.apkeditor
Processes
-
com.gmail.heagoo.apkeditor1⤵
- Checks CPU information
- Checks memory information
- Loads dropped Dex/Jar
- Queries information about running processes on the device
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Acquires the wake lock
- Checks if the internet connection is available
- Uses Crypto APIs (Might try to encrypt user data)
PID:4260 -
/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.gmail.heagoo.apkeditor/cache/1582435991586.jar --output-vdex-fd=115 --oat-fd=116 --oat-location=/data/user/0/com.gmail.heagoo.apkeditor/cache/oat/x86/1582435991586.odex --compiler-filter=quicken --class-loader-context=&2⤵
- Loads dropped Dex/Jar
PID:4409
-
Network
MITRE ATT&CK Mobile v15
Defense Evasion
Download New Code at Runtime
1Virtualization/Sandbox Evasion
2System Checks
2Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
9KB
MD5e8e0527a01aefdb89afd2c508f131da1
SHA1f1103e6b260c657ceb3d95f1b023af3fda8b133a
SHA256f809447486f89fcaa74f87e06d126d103d37eb2b3157e88f2c06d989b2c284ce
SHA512fb53683a83f1068d0f94567b156e6a8910c45b1b5f33db919f7e0b9c55eab28507a235ef76d44d5b549599ea3b54dbc00496a633339d276a80f395da938d6d34
-
Filesize
512B
MD559c4289cee0a013e373fbc16f95cf6fc
SHA17c2bbbe4b74b86d6bfe4d7acf9ecae1a4aee9ac8
SHA256f3728055f750753c395c3b59becb6c5fa89d97e5958ad70dff91338ba0cc3080
SHA5120429dba244e698596054c0adc62babf862709a0533fba5154591ebf55630671504a654b11bd67f9becc41d94ee744b085a5f09616dfd8ab54bbd6e7724786811
-
Filesize
173KB
MD59cb7cf3a743cbb88c799413b17bf8004
SHA1381f42dd78485fcdad8e7b3e15572180dbdc0927
SHA25610c6a4b05395bcb2b50c1cc6220144e25e2f466d9b6c254b71ef262b3e4079de
SHA5126b1be547bf3d586c5de2f2f46a9498ab36571eed031e4431110fd7beb3613731e5805587b0e8b967690c6574d4c5874cde22dff24306a58ca4f6dbfff4415e4c
-
Filesize
16KB
MD5eebc7fa6823d96c0429cea17cd015629
SHA156f07d5527a5d1c3d54ee580dbed5422767eeb41
SHA256230c3e69b71078bb264f4daec995fff9d87020425870d0d798338c92f7a2ff67
SHA5129a5bf50cf46826a114797898ad26eae475ac7f724aaba95cc585d253961596a596bc8b74fa27fb881c9219a5f165f4c132ca9c7b5061a2a674db8d2b5c7b4d6d
-
Filesize
16KB
MD5f9ca3dd8ed9bb69c0aaad4822c552eb9
SHA1cb6fa6382c40d3e0db767a3608ebf6b088320c95
SHA256688f734e3ab5f02ea2e65b746ffe58174f07519da99cc1bc727814e511875d96
SHA5122eb146a93f108a4fd4fe3089d0692617772ee6fc178e0a81726de2e8d385bdee3c8014d783de119ab2aa72971d95614ca21e7e49b2518bd1086ef909b8dbbe9f
-
Filesize
16KB
MD5fcdb540656d9ed4bb73522c29f7a6fce
SHA155efede71d02b4b4e1aa284863fdd7bafa681a7b
SHA2562e73bfa9f782938e74f8fed7ca8ac8a1628f3a4cdaa7d9818b41cab6c223d319
SHA512a80ed6c9f6d1f101a657961f38c1a062ad973adab1e21cd7bde87a4c3c73869f8c7fdafb56a69cf601ba9b259a8613b4c1ccd7323d2780c5b6c58c881357ea6d
-
Filesize
16KB
MD59b7d74ac3c715b625b0bd896b910b3bf
SHA17d417a93c677053a57c63ac412d3e4c910895cfa
SHA256a971a765d2fa3af47e7260f44225a32edfe55ae05af140c4c8310317189d0cf9
SHA512022297ef8741b08c4934dc99ad38e2e4b8d42ad0713d813272c62ae88ba3ee034dda1d5a5e5e48fce579c5a164c159f45a4e4c3d2fb05ee9f0f011f39ee4bf10
-
Filesize
16KB
MD505e2a4de207e5743e46c567b76c043bd
SHA1a58dc91546cc8b8d6c2c1e70f0f4bf658da42adf
SHA256c564040c0ed9dfb24c2c7f32f28d82172c5633fd9a712ce823c56af994bcac0a
SHA51249a08fb130711371c52cbf970deb066706628ef1d23525465a8e0c862b73cca1734d0e61e98548cf08bdf521a1c726f9ead60d850676bdcc48dbc3043bee15ae
-
Filesize
16KB
MD5813fcf2f3955c3bf4900535d6975a084
SHA19dbc2ed44e4dcae1925c12b04baef27417dedabe
SHA256941b42faf57caaf2898c7a9c7ecd7fa18b5d7b995158f52e50731bb81c1b301f
SHA5121a8d441f6231619424ccc8eb154e295ab7abc245d7951050c6eff134b83f40c6eae5d6197fe1f024597127da0fd06a04427e590ecc65dc062b80f969fba768c1
-
Filesize
512B
MD5f6d244df01ee4db225fcd1d5d6f2804a
SHA1eb623d1ef796d0e7e65296a85b41803ad384ae96
SHA2564f79be177abb7bdcb8cdff6263a91f96ac5f600ad210899b49fb174b98979444
SHA512b47118739b41b3b656004814bc96e8ee118375dec144d07b199c0d9aa7fa779e39bc2a5668a415e1eee6e31d8b11661a9641505a9f0e26581b7466b626add025
-
Filesize
36KB
MD5c233828a0e627e2d5e2c7e3bc96ac29a
SHA19574b222e7bee55612eb394dfcd9e02195b9d7db
SHA2565dc5b6e699b5ee2b0f2c5415fcd0914d8034bf7551e19bc24f5f5cd60edace65
SHA5123ee768890623f9e4f43a5bc1d802482162ac804e91b3a5edb54c23d7243300e10b3ee3337bb7a13fd8d7a3bb14f5d32e51ba711bee1daa9f4a3fdabece36049e
-
Filesize
4KB
MD54971c6278819b06ae13a85fda3023217
SHA1ac04fe493cd6770098fd2a6e4a07371b6424bde1
SHA256dd403363da9b373f06094c7a14e5e3c7aa9496f50d0566eb364d5dfcc3e2d566
SHA512f8c1699250d1f8b8910e1f8f530993b17ba13dd1c05d11d8138aa92e75e96a697fa4f486b9264cff2f91c306abcee66bebd64b7e4523cb1ea0cdfb0612c92689
-
Filesize
4KB
MD5fb26d1b86ad1187347ad4c8c0bb221f7
SHA12c4e86782357f04cb7d6c33d908771081065da64
SHA2561d601f72e6764ee04c2de7831ff3c32114385e3b536462502bc8ab966b57453a
SHA512aca88081a7687debe0830f9621fff7bae99ab0d3ce5b673bf95ef716afc961c409cff11eb453566c1d7df54f21ac642900d3d986847123dda72c8f78503f3e97
-
Filesize
4KB
MD502584918fcf51630550d724dcf4e3dda
SHA1992f65236b87917c156df6ef0e8a836954e9e48b
SHA256b46b66d1217c5419fd7c62fa43257b58134939d9a57c80086456c6ac1fc2d57a
SHA512c4f0aa67f830c5cfc7d4e7e4a54ab85fb91e359b68515eca0bf2d7b90a474232ac0689ea8284004dd8647a89e68f2186e3f607fd06d2c3f1cb59711f68b15186
-
Filesize
4KB
MD540530e92f8d4ad2161393e0e8d5489b3
SHA17f41be75f08126ce5f0609470f2a3245754bb401
SHA25681e3d964c21741c9965b8c8a93ffbb84af7de54bd3ee293e68b0b8df5d54c936
SHA512d9ce270b424f5b9e173491fef2e90e61c054f0d3beb5e6106f585009740fc81e0a20d6d22e7cc4295550445dc5e0c0cdf4032a6eef6d9fa33eda6b18e91cf124
-
Filesize
4KB
MD59c4203f514ce022fd6a9ebd62a274d11
SHA13ce8d41e316484737308f84065cf47f15ea41330
SHA256cf26cfff4f3dd986fee2b50b09a6bc4e5adb4a5da4826a44cdce2e4ae842f5e5
SHA5122cdb2e097bdb8c494bbdc5bf59793775218747f7e852f470a2e55a4d0e57ad66ca3d4fc6ebdb6dd8c592b033f63f1d617715011afb5cacf9a184a814ede4b853
-
Filesize
4KB
MD5f2b4b0190b9f384ca885f0c8c9b14700
SHA1934ff2646757b5b6e7f20f6a0aa76c7f995d9361
SHA2560a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514
SHA512ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1
-
Filesize
512B
MD56172b1507c150b977e84a7a921622062
SHA1030c9bb04b4c7795fc3457817a87b5607972a440
SHA256a5813e608db05ab27593aa0b2c512a778cb5fc78e9a910d065318853758d16a4
SHA5121eebaa016570d64b4965ba5becc339d7c381b52a07d7319cec6be860cdbb7625623e24f7b5ef0af31b5273c3937fdbd740c781004341db7eb3ff6fa0636cf31e
-
Filesize
32KB
MD5bb7df04e1b0a2570657527a7e108ae23
SHA15188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA256c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
SHA512768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012
-
Filesize
32KB
MD5845f575f006d8125bbdf7e919ca2897f
SHA1ca47196033c1cfd2ede5a146c46b29b9a0abe735
SHA25624f3a0d746449118e5adcb38382f5ab39c0f5b36209cb1bba09584e064879224
SHA512500ecd40164abd1e3ea4e0bcb72188805cfb82cf6013be81c973f76df61798d16c082e7ea0a69a15d75efca499aeaa690fc42711dfb009bb942deaf397ca8a8d
-
Filesize
332B
MD57a3d8f93175c6f643f8304a715519ef3
SHA1b02973923879cc0d85e721d4e5f30e5b870bf7eb
SHA256c7b6f17b4b37740904bc797c843e563c58f4754210230c7972adce89492ada14
SHA512c84d8520563cee36e8c94e1917244c3041aa007bb25b58c82e75a3c9fb3086ac33f530c54d8dfe84b4780e58a98a75f6e2c19990f24868ff9943e1ff48afde27
-
Filesize
3KB
MD54da499549eeaa5e59c7ae343abe0a1bf
SHA1ee798a6265bacb06729f73497a2fdd1b58103a7c
SHA25631df58221ceb3ce3e31c2786ea1f238529960fcc7a5b4f6a111303f22b371fdf
SHA512b79220c33c766554d2e6d46eaea7ad83a65120bcf7df3eee9a948e5be12bede3ca5957cc02cad5f1d4bc3998ff4b3e7aec59eae7f3e5b0afed2b6ba368170981
-
Filesize
4KB
MD5c172b6ac27d6fc771b14db8d8a6f5cd2
SHA194c51c0a67862d23612488e036f0d59d9ab4e615
SHA256e5b7c7cc5683b2d0cc414e4f9806608d4855962b715c11bb56732246a341d938
SHA5125ab49e2b2b085e8dc051eeb5238cc11ab300911bf235c9740cf11e7696291070af2b5ae97b99a86b77867bbe5e1d2280dc062d542a8c8bfb25cf8c6bc15a6f63
-
Filesize
3KB
MD5cb777df652f8c26319d2e30fc7674785
SHA115df795840ffe17ddbf191cd08a0c4fed107ac89
SHA256818e1624e9e2e9dc4de286e98f7aa3754c2ed59c5c737d046fbde9b851ecfcf7
SHA512c2ea5b75d05cead41a25df4c4032ded815942eaa56d2571e53c0e7cfa8a92dc1ed30189aa186869c20270b55518957b0cb557e61e8bc5c148515006704fcc17d
-
Filesize
4KB
MD52af91ab6fd8ef6abcae4869bfc783eaa
SHA13d8ff36c6e17a05d3317c76192facb8ad558c4da
SHA25620afbf5ce2fd823a14030dd975aa1cfffa5173e28c3d0db2603bc8b295538d73
SHA5127c7477b03918f2fff69315f851813a03fda51043b25b08c3f83a56a2fefe92e36e8fab03ce007e040ff46beeec43eb2edb3aec0d50ce94dd804347c02fd1b5d5
-
Filesize
222B
MD5224de776e916d342500eb2488a128f94
SHA1ed822cbf1115cac063bcfc8217e312f7029daa6a
SHA256f215ae486c66e87871a417391e3aa6a56e6006ff2ab2a44e204cbec68f385d51
SHA512f3bf846ceaea79598a5c0cec61502e63472e6c74a79850963d689a6fcb3070a1c42d7c5f9e60cbc71c830209c1befcdc11503214005b9cf1bf9d5057bac5a748
-
Filesize
2KB
MD58f7aef3b9d9263bd1373cb3e44d88dcd
SHA1968c76cf2b76085631ab3745eb745f89292f0bff
SHA2560679785e50271789089f075f9ee80334f8041a61664b69dc01d19ba078763bc2
SHA512a161b013d6b41a790b516ff25432e07e9821f4f68fa0142e4119b6e81bbf3635b05ae2724043021cbf3276e19ba742675893f38331b4db6c04bde29d9ae91598
-
Filesize
707B
MD52f2fd6b8e6532e670ce67fade77a5536
SHA1ac7e004668819b9228bc5d4f4451f3e11ed0beea
SHA25636dc32bfa02d90533c6ca4de69a448c63e51166df670e1f2a2782ae0a582c612
SHA5127046da2bd088acf8ab2cf8e7606af842e23d9645df05f38852ce895f3fc35b00ab90e1c61e03db3a0f5d4f5af5a979bc201b8cc3e0b535a321f918539775e500
-
Filesize
223B
MD51467e5561efce06467784eef669d4bd5
SHA108a5a85bd94cb10d43dc8ede73a2de80a5e1305c
SHA25606795a258ceba3b343635860cac86c612ec3da610f3ff7b65184b84e66bdd733
SHA5121b11274c9806c70048cfaa203c4b463ec535a2908953f1c55797f0addc92697964e6671fd55dba4b01f520909e7540be152a60974f869639a4db89235e918114
-
Filesize
20KB
MD52048eb6124a452540ee51dae4145aadf
SHA1d05005b2cd7fe4cd652b0d7fd1bdac2c19d51451
SHA256105c54b6fe3f25350e92187467761598e4c21d62b1091b77d091f65f3bd98864
SHA512bb6cb3853dd2a5d0701e20607d4e153ae201268dd2e5e2d06cc2df208b3b4dc50132a4ab428251b1644d2399fcc717662438d082ff14203387bab8794109d44d
-
Filesize
20KB
MD5fde2ee00cbd121cfab5290b078aa3ceb
SHA1e2b77d5320e155e413d040a8c20020962065b2f8
SHA2562897b0812077c654a9b3fbb0b6303d5cde681eeba7ad9981de65716c7810d685
SHA512a9326aff8e454a2b4ac09984ef2a65fddd4dc146b4c44d839035549bff8c9fdaae490326d0b018f76c1ca2e4fb25426d74f550ca0950982fba632a023af99a56