Analysis
- max time kernel
167s - max time network
1663s - platform
android_x86 - resource
android-x86-arm-20240514-en - resource tags
- submitted
18/05/2024, 04:03
General
- Target Crunchyroll_v3.56.2_mod_apkdone.com.apk
- Size 52.4MB
- Sample240518-emcndsbb95
- SHA256 2dc73483ebee01fd7876f231319810a3f7a7f40eb4c3b3b9babe4b303f0c836b
Malware Config
Signatures
- Checks if the Android device is rooted. 1 TTPs 2 IoCs
- Loads dropped Dex/Jar 1 TTPs 2 IoCs
Runs executable file dropped to the device during analysis.
- Queries information about running processes on the device 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about running processes on the device.
- Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
- Acquires the wake lock 1 IoCs
- Checks if the internet connection is available 1 TTPs 1 IoCs
- Reads information about phone network operator. 1 TTPs
- Schedules tasks to execute at a specified time 1 TTPs 1 IoCs
Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.
- Checks the presence of a debugger
- Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
Processes
-
com.crunchyroll.crunchyroid1⤵
- Checks if the Android device is rooted.
- Loads dropped Dex/Jar
- Queries information about running processes on the device
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Acquires the wake lock
- Checks if the internet connection is available
- Schedules tasks to execute at a specified time
- Uses Crypto APIs (Might try to encrypt user data)
-
/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.crunchyroll.crunchyroid/cache/f39d5a0aea5fcef350bb7ec1d01bd3098995dae9aab120e15e6026049cfafe074b1444cff24b39e88995dae9aab120e1a9c97d70be7069ade63b52e87a5d38bdxz.apk --output-vdex-fd=47 --oat-fd=50 --oat-location=/data/user/0/com.crunchyroll.crunchyroid/cache/oat/x86/f39d5a0aea5fcef350bb7ec1d01bd3098995dae9aab120e15e6026049cfafe074b1444cff24b39e88995dae9aab120e1a9c97d70be7069ade63b52e87a5d38bdxz.odex --compiler-filter=quicken --class-loader-context=&2⤵
- Loads dropped Dex/Jar
-
Network
MITRE ATT&CK Mobile v15
Replay Monitor
Loading Replay Monitor...
Downloads
wSgiSNwwTtjusY4M1GugEJ3I3kBxgBvU
wSgiSNwwTtjusY4M1GugEJ3I3kBxgBvU.tmp
100997207.otf
150344859.png
191704424.png
195828962.png
210883936.jpeg
257422798.js
399024307.png
43200495.png
453613751.jpeg
469856650.png
540327622.jpeg
657030261.png
667088958.jpeg
685346262.jpeg
78575841.otf
994822341.otf
journal.tmp
f39d5a0aea5fcef350bb7ec1d01bd3098995dae9aab120e15e6026049cfafe074b1444cff24b39e88995dae9aab120e1a9c97d70be7069ade63b52e87a5d38bdxz.apk
network_information
user_information
13eef64e7f7cff54ca0163ba919adbcb.0.tmp
13eef64e7f7cff54ca0163ba919adbcb.1.tmp
197015fce073456c7e9ca5d7f83689a5.0.tmp
197015fce073456c7e9ca5d7f83689a5.1.tmp
28e19613f5346bf411f6dab5c8040269.0.tmp
28e19613f5346bf411f6dab5c8040269.1.tmp
39d6218fd52bd7449efa877bb67d0ae2.0.tmp
39d6218fd52bd7449efa877bb67d0ae2.1.tmp
4c98a0dd59359e4c82682af5dd6ba5bd.0.tmp
4c98a0dd59359e4c82682af5dd6ba5bd.1.tmp
journal
journal.tmp
com.google.android.datatransport.events
com.google.android.datatransport.events-journal
com.google.android.datatransport.events-shm
com.google.android.datatransport.events-wal
exoplayer_internal.db-journal
exoplayer_internal.db-wal
singular-1.db
singular-1.db
singular-1.db
singular-1.db
singular-1.db
singular-1.db
singular-1.db-journal
singular-1.db-wal
singular-1.db-wal
singular-1.db-wal
singular-1.db-wal
singular-1.db-wal
singular-1.db-wal
singular-batch-managerx-1.db-journal
singular-batch-managerx-1.db-wal
com.crashlytics.settings.json
keys
keys
keys
keys
keys
keys
app.json
device.json
os.json
session.json
report
PersistedInstallation6598710439986821375tmp
PersistedInstallation7007666712022144847tmp
firebase_session_Y29tLmNydW5jaHlyb2xsLmNydW5jaHlyb2lk_data.preferences_pb.tmp
firebase_session_Y29tLmNydW5jaHlyb2xsLmNydW5jaHlyb2lk_settings.preferences_pb.tmp
firebase_session_Y29tLmNydW5jaHlyb2xsLmNydW5jaHlyb2lk_settings.preferences_pb.tmp
firebase_session_Y29tLmNydW5jaHlyb2xsLmNydW5jaHlyb2lk_settings.preferences_pb.tmp
firebase_session_Y29tLmNydW5jaHlyb2xsLmNydW5jaHlyb2lk_settings.preferences_pb.tmp
firebase_session_Y29tLmNydW5jaHlyb2xsLmNydW5jaHlyb2lk_settings.preferences_pb.tmp
games_metadata.preferences_pb.tmp
viewership_attribution_chain.preferences_pb.tmp
profileInstalled
profileinstaller_profileWrittenFor_lastUpdateTime.dat
androidx.work.workdb-journal
androidx.work.workdb-wal
androidx.work.workdb-wal
primary.prof
primary.prof
primary.prof
f39d5a0aea5fcef350bb7ec1d01bd3098995dae9aab120e15e6026049cfafe074b1444cff24b39e88995dae9aab120e1a9c97d70be7069ade63b52e87a5d38bdxz.apk
f39d5a0aea5fcef350bb7ec1d01bd3098995dae9aab120e15e6026049cfafe074b1444cff24b39e88995dae9aab120e1a9c97d70be7069ade63b52e87a5d38bdxz.apk
crash.txt
crash.txt
crash.txt
crash.txt