10e76f9b66d07947eefe1e515379b278fe824c9b51a66b84bd5004f78e52702b

Analysis

max time kernel
7s
max time network
131s
platform
android_x86
resource
android-x86-arm-20240514-en
resource tags

androidarch:armarch:x86image:android-x86-arm-20240514-enlocale:en-usos:android-9-x86system
submitted
18/05/2024, 16:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
lib360.apk
Size 416KB
Sample240518-va9qcsdc96
SHA256 3dd3f5fb3f3caf48f3dd99410102f804aedfdf42582f7a9f12c9d26a60649a04
MD5 2f78d0967ca568ce8ca499048621c4c2
SHA1 a8c72bad930b1aa6aa4eaa9de2ba5fcdda28f06d
SHA512 75c45a2781f73932cdbd9e2119cd927e38612d7ca48bf7293ab679ac386e8b75718a929d81b8c5a2e1db6cede036c207b4da13c3403b0ee4bad5858313a50b58
SSDEEP 12288:Rr/mv1+q62vD3+chmTzd4jRAt5ZITrS3Dy:RqXrL3+3TzyjRM5+j
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

discovery evasion impact

Malware Config

Signatures

Loads dropped Dex/Jar 1 TTPs 4 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/com.androids.setting/files/tqperf.apk	4304	/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.androids.setting/files/tqperf.apk --output-vdex-fd=43 --oat-fd=45 --oat-location=/data/user/0/com.androids.setting/files/oat/x86/tqperf.odex --compiler-filter=quicken --class-loader-context=&
/data/user/0/com.androids.setting/files/tqperf.apk	4276	com.androids.setting
/data/user/0/com.androids.setting/files/1716050927582.apk	4329	/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.androids.setting/files/1716050927582.apk --output-vdex-fd=46 --oat-fd=47 --oat-location=/data/user/0/com.androids.setting/files/oat/x86/1716050927582.odex --compiler-filter=quicken --class-loader-context=&
/data/user/0/com.androids.setting/files/1716050927582.apk	4276	com.androids.setting

Queries information about running processes on the device 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about running processes on the device.

discovery

Process Discovery

T1424

description	ioc	Process
Framework service call	android.app.IActivityManager.getRunningAppProcesses	com.androids.setting

Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

impact

Data Encrypted for Impact

T1471

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	com.androids.setting

com.androids.setting
1⤵
- Loads dropped Dex/Jar
- Queries information about running processes on the device
- Uses Crypto APIs (Might try to encrypt user data)
PID:4276
- /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.androids.setting/files/tqperf.apk --output-vdex-fd=43 --oat-fd=45 --oat-location=/data/user/0/com.androids.setting/files/oat/x86/tqperf.odex --compiler-filter=quicken --class-loader-context=&
  2⤵
  - Loads dropped Dex/Jar
  PID:4304
- /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.androids.setting/files/1716050927582.apk --output-vdex-fd=46 --oat-fd=47 --oat-location=/data/user/0/com.androids.setting/files/oat/x86/1716050927582.odex --compiler-filter=quicken --class-loader-context=&
  2⤵
  - Loads dropped Dex/Jar
  PID:4329

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Credential Access

Discovery

Process Discovery

T1424

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

T1471

Replay Monitor

Loading Replay Monitor...

Downloads

1716050927582.apk

Path /data/data/com.androids.setting/files/1716050927582.apk
Size 145KB
SHA256 4ae153b5628f411cb93526ca14153c65fc18577b4d1346fdb167f7d65de9e946
MD5 d5eadbed0fb12243d0e9699595e79375
SHA1 2a26c32c127ac8453b16a9f1334a52f417c2286d
SHA512 8704c8deba4b89a4b19b2c3a480901a7d1f611cc2914db7889a4bea5c453ca1d7a2e8ce3d91524a280e7b2779eb23b8305cc0df81ef5b94842568015cb75cc2c
SSDEEP 3072:GffebVcHJwAXsF+7s4J1I0osZMjMhqN8rpv3wwI1:UeGpxcYaJIqyrB3wF1
MD5 SHA1 SHA512 SSDEEP

Submit Download

jhjioj.so

Path /data/data/com.androids.setting/files/jhjioj.so
Size 145KB
SHA256 7904011a7419cafb8d57780095d937897104dd3fd77e8eacc57972364ab745ef
MD5 6dbc1b78a8c62bdedbf2d5746258561c
SHA1 5a4bd3f1ce669f5afb316d74637e53097298704f
SHA512 4856aef8e11cb28faeff368dbc1a349e610662fff50d6eff7f4ebbd0b58ebff4846950e69ad697a9f2a5892f9553387bf08b734e3f7e9f51f39b098b8a1c721d
SSDEEP 3072:c/J2OyEtSCRyEMbXv2k+qwne8Hjv3Zj8Bfk2NVD3WU29cc/chmm:c/mEgXv3+qwe8HK62vD3lc/chmm
MD5 SHA1 SHA512 SSDEEP

Submit Download

tqperf.apk

Path /data/data/com.androids.setting/files/tqperf.apk
Size 19KB
SHA256 31388e1402fbf69d6fdf40c4182c43cfaf5c9770fa1006b67e5c25dbb39ee47f
MD5 28a6c7f14f97ba35010bba02405b8dba
SHA1 0f5b8eb5c3d5f48da6d747300f6fe4bd9144ca76
SHA512 a075b2e155ab41293b47d76ad11c2d1571426ce8e0f8c407489690995afed3d99e1eb2212946966c54bf891f22c50db4bab81b1cd6d5916f999c3a960251ee50
SSDEEP 384:PC9NPjg4wtiP7OEkNe1nZDr5nZFwDLKu4e7XzyFvmIAl9AAs:PC9RUl47ge1xrXFWLKxe7X+Fu9y
MD5 SHA1 SHA512 SSDEEP

Submit Download

1716050927582.apk

Path /data/user/0/com.androids.setting/files/1716050927582.apk
Size 337KB
SHA256 54f7dfd75127d18b41625b312dca9a51a35e33a3854e2817e71c17766fe3d213
MD5 5f8f9820efec6fde11218082bd11c911
SHA1 1f6aa362574a57cc209c8313f9915053a142faaa
SHA512 191ac84450d2954cffb2c2af6cf30df659f3a15bad22edb6d321448de0f379b3566fb2b18f7291834b58269b37d252d546a0049944934d2f2c6a98e830f3dbbd
SSDEEP 3072:VK69pcx/XPw/sKscekZ6u8kMaPkAygcS9LsZWpDG7kmINPYhqwldVfXkUcGbWVC5:Vl9p9EK/bOAGwPYhqeftHbmHOB
MD5 SHA1 SHA512 SSDEEP

Download

1716050927582.apk

Path /data/user/0/com.androids.setting/files/1716050927582.apk
Size 337KB
SHA256 db04598f8e1504a048a8bc932cfa48175c3c69ac0fd563371ded17448b098167
MD5 fce41716a0de9c16648e13375fdd86f7
SHA1 eabffef974007d1b0fb40e5958af49a88ec55012
SHA512 121ce39c15fdfbc66df44270ac17c756010667c94f133eca2a55ff5229304bc4d37b699b36f59fbfb9a228227489a6ba0c7759349074a625ae68ac48665673c4
SSDEEP 3072:VK69pcx/XPw/sKscekZ6u8kMaPkAygcS9LsZwDv76mINjg+K/KnCVBMbDlNoxL5z:Vl9p9EK/bOAv+GVBGD9HOB
MD5 SHA1 SHA512 SSDEEP

Download

tqperf.apk

Path /data/user/0/com.androids.setting/files/tqperf.apk
Size 13KB
SHA256 ad1f179bb396a353b4d76e89015542fc120f18c652571fcd565c1bfb376ccb46
MD5 81ca2d539dd94bff547b8303a1badc35
SHA1 0efded518f956b09ac4d3735e792b03b2585611d
SHA512 a909f838dae3bff5392c212f5f0acccef35267ad0054049b2a166f7902d88248630e019375257041765835cbbc1fa3930690852ce6aa9566e69d3826db559208
SSDEEP 192:oI2vQgBQ/1CpzBxtEh7PJNPeoTD9ZYy/um9D1iMLunss509F1d0OV/:XKvnfO9R9TZaCum9D12sE09F1dJ/
MD5 SHA1 SHA512 SSDEEP

Download

tqperf.apk

Path /data/user/0/com.androids.setting/files/tqperf.apk
Size 13KB
SHA256 c8307965e4c0d8f0cbfb853e9511ceba326cc0b58a6449cee3e6024122bf1a9a
MD5 6d15fa35b0f6c73c95cd2fced082b679
SHA1 7fb166529820a0b553c78bd51d5f4c8c490501aa
SHA512 f96dc8faf94748e5646a1495edca3bb360af91ed6a741f3bb9cf94e28c6e1d99481b2a13bb4e6aea64e9cb559ef3bb023d4cf14d470783db8a9b7e8fa6510258
SSDEEP 192:oI2vQgBQ/1CpzBxtEh7PJNPeoTD9ZYy/um9D1iRwyi8ZILyvc24R2/:XKvnfO9R9TZaCum9D1oisuyvc244/
MD5 SHA1 SHA512 SSDEEP

Download

CrashLog_20240518164850_4276.log

Path /storage/emulated/0/PluginLog/CrashLog/CrashLog_20240518164850_4276.log
Size 3KB
SHA256 f9f5b40f70eed0c740e24e7de6fab4476ea68e036acdbf454c7e023cb921b6aa
MD5 241166f6a21da8ec015dcebc23d3a811
SHA1 1a818dc0c4222fa3ea208c9f6d99b4e5534e0a90
SHA512 ad3e205312885ca5d2f0c99a79f67565e42aea705a5a0794658480ca5491285ed15eb829a44f283799089fd705daeffc391faf4a475bdbb7256d737273e14956
MD5 SHA1 SHA512

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads