Analysis

  • max time kernel
    179s
  • max time network
    190s
  • platform
    android_x64
  • resource
    android-x64-20240514-en
  • resource tags

    androidarch:x64arch:x86image:android-x64-20240514-enlocale:en-usos:android-10-x64system
  • submitted
    22-05-2024 12:09

General

  • Target

    Modiseh.apk

  • Size

    9.3MB

  • MD5

    a13c2f362c81f4a7c7f306d00b774792

  • SHA1

    7c9404bdc85adebcadd60c22a544036e181668d1

  • SHA256

    70c0861ebf2fd815ac4896b3595e24b1297d76368d568ca391ba25e17663124a

  • SHA512

    91c80d8c6c4f43360df19392e5e19456f03c00bcb207585ff25713a577301add34e22fec330cd70fd9b7f7160d4a902f7cb722b8983aed864b5cfa7dd6fa9fc0

  • SSDEEP

    196608:dK2Zn8NyUX6sCBa/ZCBjuYSSsxn2oFyumIiO8LJWTmneeoLcQSZ:EW8sUX6E/IBjuYPKhgbIv8LJWTmh4c

Malware Config

Signatures

  • Checks if the Android device is rooted. 1 TTPs 2 IoCs
  • Checks memory information 2 TTPs 1 IoCs

    Checks memory information which indicate if the system is an emulator.

  • Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
  • Acquires the wake lock 1 IoCs
  • Checks if the internet connection is available 1 TTPs 1 IoCs
  • Checks the presence of a debugger
  • Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

Processes

  • com.golestanec.modiseh
    1⤵
    • Checks if the Android device is rooted.
    • Checks memory information
    • Registers a broadcast receiver at runtime (usually for listening for system events)
    • Acquires the wake lock
    • Checks if the internet connection is available
    • Uses Crypto APIs (Might try to encrypt user data)
    PID:5186

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/data/com.golestanec.modiseh/cache/image_manager_disk_cache/af93d6827e485323417455f93c8b7d41d30058de2431cebc5033ea2a2e591340.0.tmp
    Filesize

    175KB

    MD5

    94f5d5ad797f0ce61c025c921941b164

    SHA1

    f69fb0240d37b5bc299e26924a5a45e6e8085373

    SHA256

    63c6682436da565690db9d602d317e68fc886568fbe23cd13215936b570b3d07

    SHA512

    ea71c1875a8aeb866727743247b2bd77996725219b9c163483a88906b1f8edd99182e66742ed23ab302bb0f7a631fd9e67b9335531cb9e96b9b52a1140a77f30

  • /data/data/com.golestanec.modiseh/cache/image_manager_disk_cache/journal
    Filesize

    180B

    MD5

    3194b95c350f7b9ce60fd40e42855e5c

    SHA1

    8fd4e6eb3bf75e63c439232877295a5ea02ef6c8

    SHA256

    6332880c51427a168079dfe402a9d8cc2b8ad324d7e3190db26c092ca9bfa26f

    SHA512

    eb7451fc4cbafd881338c23c68ceb6b598040a1007597288c9d45d2d2e25011f84aa01bc43384c2a832a2748d7663f4d7eefdaec3f3e77884a3bdbb07ae65b35

  • /data/data/com.golestanec.modiseh/cache/image_manager_disk_cache/journal.tmp
    Filesize

    31B

    MD5

    8c92de9ce46d41a22f3b20f77404cc1d

    SHA1

    8671a6dca00edb72be47363a7071be65cf270373

    SHA256

    68bb33ddeed9200be85a71f70b377985f9ee68e91578afbde8321463396f1274

    SHA512

    30f45fe9954215d6adafcc8f0a060a7ff41963a64f9b849a37f0d18fe045038d429ec13bf15226769c4ba78dad3c52f3d9e0dbbb4fcdea4828a1efe956e48f56

  • /data/data/com.golestanec.modiseh/databases/com.google.android.datatransport.events
    Filesize

    32KB

    MD5

    ad7bbdcce258ba21d0a07659a3849e3f

    SHA1

    887e17f38cf736cc82125092f6cadd5753184286

    SHA256

    a6417906596802ee2a80cd22ef848d832848a6f36f4e45d320e9b98633a5c456

    SHA512

    4519d5aec86a163c9c2c97d1cf9862cc9b421749c0d78c0f4ceee31c9fe07ac557e736d5b3f72942e2d5d44b578fc8a6789f2e7a3ec98ec2199fdc50dd3ac45d

  • /data/data/com.golestanec.modiseh/databases/com.google.android.datatransport.events-journal
    Filesize

    512B

    MD5

    0f9bb6d7e2b30fe7d66047e8f4696c87

    SHA1

    c4508e3b20b37951f18b9c5f7d8d3c9345f495cd

    SHA256

    c5f174ae7988349c304489ae2e970e1ea992551b20f60660141d68e15a7281fd

    SHA512

    169b723854503cf445f53f485fab76eef319f498effd20f5bf66091a8c9043a64e90489ecb3720010e783b404db284d5b62439e1b839f7a2f8c6ee8cf4a76138

  • /data/data/com.golestanec.modiseh/databases/com.google.android.datatransport.events-journal
    Filesize

    8KB

    MD5

    b3e246bed84ea216bd891acd33b4f2a6

    SHA1

    31e05cda4bfe2670a6f1d53cc3d18d8d05b4a162

    SHA256

    4e0c442dc96565fc6c7aa37d72cf53d6149b617e66a4c816a1e5b7be17484a9a

    SHA512

    082c87dfa4764ab56b8a03bd57b5579fc6c533ec97565b41ef436cececa09a28f40be3d5d08b6b7ff176201c29d969ed2fc0574f1c944708187fd7de7c70f169

  • /data/data/com.golestanec.modiseh/databases/com.google.android.datatransport.events-journal
    Filesize

    8KB

    MD5

    b562e5e88295ff14eae776dda22582e4

    SHA1

    c9072d48a6f734aeb818327ead386642688d4ff4

    SHA256

    f32f8f64d3baa4de93fbfc022b27e646a08d0759b5e9e24c2c94c16df4e982bd

    SHA512

    82a83a7d87ed423a8f6c4334c28f04b844ed600c48eae4b0657924f4c644c6e515556e2e7b9102f78668952ac44b3b3b8aa8ee49413ef53207474c87f7028518

  • /data/data/com.golestanec.modiseh/databases/google_app_measurement_local.db
    Filesize

    16KB

    MD5

    eb52a90bb70b76e946b62f50b6f7fb85

    SHA1

    42d767b5d1faa7dcef4cb4e1432a5f47ec2e9ee0

    SHA256

    48472f593a3e9cf9e91ee5f7d66dd9ff291bfb247eb6b46778c710fc24e8d3c4

    SHA512

    b356c858cadd14b6ecddf134f1c494c0107a1d36be9387984fc53dcb00e6779d944f058f4ac99d0fc2fe3a427cd1c2921c6fc38ecad53909fc4b5b6f04459b5c

  • /data/data/com.golestanec.modiseh/databases/google_app_measurement_local.db
    Filesize

    16KB

    MD5

    11d2b71b172b65c6c8ee5e6a3122393c

    SHA1

    46facba8cd505403070e9e85cd9faf040bf65440

    SHA256

    b4a73378813072ded4204956068784c418395b726bad4cdd83866c4939756eff

    SHA512

    dd9911ab5f784d64731165ff9d834132f19912838008ec1ee261cd231155330df3e94e2d068c94ebf1548b9883bc375ae51dd97878e278e044c86314ce1f5670

  • /data/data/com.golestanec.modiseh/databases/google_app_measurement_local.db
    Filesize

    16KB

    MD5

    35127b1ace3de2f1e7c1774d5a8de3f5

    SHA1

    42a3dbf8b3aba21d88a7470cceaf14a593364466

    SHA256

    111a2f51b0f76f5617b19071e618c77380baf781b9ac6d8b92bcc62dac3d50f7

    SHA512

    8f8462151063835e528c276c8f038a43bf18db3dd9ca255a7ab3b1e4c21eb9bffdc3c325253c8feca5fd3477e117057a2a00d7ff7819f59a4a7ebfb45fa558ff

  • /data/data/com.golestanec.modiseh/databases/google_app_measurement_local.db
    Filesize

    16KB

    MD5

    cb89249ff5c4eeec148db922d2b9e2be

    SHA1

    ec6f47643d7c4b8ce3163a4763fc80e5a080e799

    SHA256

    b9fcb591fd1c4143419db09cc4ed9d0ff8f8643b2abffb89e6482f3107de7ae6

    SHA512

    308b922b764fa4795afc109e5f1e2d24636b952533cc12f32a59a6442f7e729dd66f5ec29b955e01b1aee8c3af24728cdbd98241571bb68eee794bd8bf20ad8a

  • /data/data/com.golestanec.modiseh/databases/google_app_measurement_local.db
    Filesize

    16KB

    MD5

    7d99f6c0e1cf9b81ec75e22c1ebbbf00

    SHA1

    d258170bea894f7469e19731c3ca6e0deaa6d899

    SHA256

    f9353844de03f9d20aedc9ccbf172f48fa8eafc95eb58cc3b6ef0af35c27b137

    SHA512

    9fd0508a73480b271e81e15c2802c0d26d35abded8140fbad0779089a464c76c3012156053394bf8c5010d3cdf0f69c6b6a86aefd6dade5b885b0653f131a9b2

  • /data/data/com.golestanec.modiseh/databases/google_app_measurement_local.db
    Filesize

    16KB

    MD5

    1fd548b64cb2d59ccdf49ce436ce0f8e

    SHA1

    f953d3c7b485f1021b5f6624cae5ba779068590e

    SHA256

    95884b1255fb06b3609ba8eaa00fde3ae1ed390f147e7ad411b55b7a04b2c804

    SHA512

    ddb2ac9796fc4d9fb2bab034baee4d7f55b498e0935b06e9105c6a88b4dbeb39cbea96afb3b1f52d52f225dae6b221e83fef5e6816c117a4ead412ac88735c4e

  • /data/data/com.golestanec.modiseh/databases/google_app_measurement_local.db-journal
    Filesize

    512B

    MD5

    300d60072dcd85550e20769f38d7d1e8

    SHA1

    480cbc36486b2d7814ad95f6e05118250785fc54

    SHA256

    b1aa347cbed017cfbe7576045d2fa60ed1cfae6d492f273473bf47a691db137f

    SHA512

    03317a3b2088a2e626ed01d665c056be4c6c14b70de2ad96692f722a16212f38e9747002e8f147eaa9e43a841d705d3d13eaa71489b2615be3c4e68d106f3025

  • /data/data/com.golestanec.modiseh/databases/google_app_measurement_local.db-journal
    Filesize

    8KB

    MD5

    6b3f357360b8fb5c7edd1eea9761464b

    SHA1

    3ae1a1cc34e156c62d8524811ce983b897ee574c

    SHA256

    9952613bcf964ea8befc857d05764a100bdf3efa35c772b0019aec736c017563

    SHA512

    63f95b6aa087975d71f017dc8177a858a98a265440f1dbdb97491e200481e132bc4967f20694a95cf544121c289f10ca689f0403745a6feb94995084ed07bb7f

  • /data/data/com.golestanec.modiseh/databases/google_app_measurement_local.db-journal
    Filesize

    4KB

    MD5

    988b14240d336cd5e50ea7150f394cbe

    SHA1

    27b82a49e8b8b6f4a527f9df8ac163fa9c9298f4

    SHA256

    b75ccdd75a4752750ff2f4ccb5df417cc6bf7914d35c4db84f94cf4809df370e

    SHA512

    2e40b06d71079b5d7c1a16bc16f3e15f7a1a330176fa39a766cd3ed869d079b909951c5f9e4ee1396335244d8090b029da3ee8129d58bbc160df82b9b1a9e639

  • /data/data/com.golestanec.modiseh/databases/google_app_measurement_local.db-journal
    Filesize

    8KB

    MD5

    fd4ae0d2c165cb83f923c90e48302530

    SHA1

    c1910bd7bcdf692192b243d6c6d320a2746be958

    SHA256

    b67780c0861468df9b3888c936b5fb32685a67048f1df3873e522256b4708f45

    SHA512

    83b4fe55f31cf2dd6ad8fa9d979ae846373ffbd08b64677da61088ae0fabbb81f168c2951b265420e11ba3fb86bf184d7be23356463405d2ec190af78bf6e0b9

  • /data/data/com.golestanec.modiseh/databases/google_app_measurement_local.db-journal
    Filesize

    8KB

    MD5

    92e29910c8bcd265bfe17af7216b4dd8

    SHA1

    3ddc7451214dca735ac50374ce7913e65778bf5b

    SHA256

    c338974b9aecc94519a895e8ac250df3469326d6bfc4d7fb4fabe8280035ea23

    SHA512

    35d9e21ed5c6b576a80b6ac3954f454d160a66ada21f82284ea84a847115798343822e16dc9ae20b358fbd4003e5f1413fc39bb9fd179a22a43252237864b4b9

  • /data/data/com.golestanec.modiseh/databases/google_app_measurement_local.db-journal
    Filesize

    8KB

    MD5

    d7b46cfb48a262245b9b2c0d3321215e

    SHA1

    9165e0384a4bdfba5545c4f673c410a4dd36e8ba

    SHA256

    3351391990fd83dabe2bd5dd15032c6aecd239d228576d189f7fa188e3ab62dc

    SHA512

    11dab5ce20f356fe4f58a3582836ce2ff638100993e94da0ceefa549249278a116cee1e9c1c75120f1e0deec03ff76c68ba927c07ab0d5110288b1e4887a1714

  • /data/data/com.golestanec.modiseh/files/.Fabric/com.crashlytics.sdk.android.crashlytics-core/664DE8F70084-0001-1442-05470631F42EBeginSession.cls_temp
    Filesize

    77B

    MD5

    492d2fe1a7b4e00c9ec79f3461d0a3ee

    SHA1

    6701e090fdfd0dad115ceb3177433fb613ee92d8

    SHA256

    e31508f5783a1760f93baa456229cf82c6ea87e994b9b8038b58ca0f3ee256f4

    SHA512

    ea136fcf4269113fb042b6a84cb9dc25a16dc141ff97142d762276a8bd7376843a2b9ac667871bf0c521cfc91680b3623c86c77ee52ed8011649777d9bf7efde

  • /data/data/com.golestanec.modiseh/files/.Fabric/com.crashlytics.sdk.android.crashlytics-core/664DE8F70084-0001-1442-05470631F42EBeginSession.json
    Filesize

    132B

    MD5

    850758e3c9adc2b91ff35848bae6c7ad

    SHA1

    ae4bda30cb511dda3b6256b22c6a2e1b8e689ff4

    SHA256

    2252469f49058cae9f32a4e6c395433acca3e6f8af6ac491257411aef8a64b7c

    SHA512

    8c35dbca7f8906459974186f4ffd8b1447f5892195fb56d119e4174bed295f402798b7ad38910d546506f3fb43790588a70efd260cfbbdb402ba7ad2febea321

  • /data/data/com.golestanec.modiseh/files/.Fabric/com.crashlytics.sdk.android.crashlytics-core/664DE8F70084-0001-1442-05470631F42ESessionApp.cls_temp
    Filesize

    117B

    MD5

    c43ea793df4af4378250552951815ad2

    SHA1

    2f2dccb8e5540c7cff704f62a839a11038604691

    SHA256

    2551dbce6dc1d0b905fad72277e1ebb85f6c5642b6c1d758e5ffa6245d914385

    SHA512

    3e772a86d6f1cd377e2c0fdbccc83483cbd96b8c28008170e44cdd9e606c2ec83c201f81ba3369829a1d5f7621af636f5c12194fd8d6c327b5915fb5c4c9b1d8

  • /data/data/com.golestanec.modiseh/files/.Fabric/com.crashlytics.sdk.android.crashlytics-core/664DE8F70084-0001-1442-05470631F42ESessionApp.json
    Filesize

    231B

    MD5

    7ae734477e9f5074a311705a3bed43f3

    SHA1

    f86115fcfb54bcfbc89ab36f0aab79c590d4ef08

    SHA256

    7af78179d7ab2439d7be9d52c90862d93c5b9d7070c70341f708130a3ba4677f

    SHA512

    00e3e8350b587742e9e98516713ecd83373e1f7cdebe538381aff920acc495e1e24adac95326b0bf335fa79273757bb248a8bb5f136436e71c5c13831c35e54e

  • /data/data/com.golestanec.modiseh/files/.Fabric/com.crashlytics.sdk.android.crashlytics-core/664DE8F70084-0001-1442-05470631F42ESessionDevice.cls_temp
    Filesize

    48B

    MD5

    2390c1f21db00b20c07107e3ec7275fe

    SHA1

    e663a646460acc071aebee942cc1776c23d77655

    SHA256

    d348072a01496839cfcde3a18866423aee74aefd613fa3bf1ff4a203ef46a699

    SHA512

    43ff60754eb60795ca1c318f44dcfe49194add26cc3d92c2eac7bef538fd65b6290f2e5953b8f1693b9425ebbcdd022ab16a18280146ee0b0c2eefe27bc0bd63

  • /data/data/com.golestanec.modiseh/files/.Fabric/com.crashlytics.sdk.android.crashlytics-core/664DE8F70084-0001-1442-05470631F42ESessionDevice.json
    Filesize

    202B

    MD5

    afa07370d07ed0a8ac9554ee7001bb72

    SHA1

    d1e9de22fda1295087525ff3a377f7d7dd410ac7

    SHA256

    8d4b99fc4968c9cdff4626ff6c1467cdb427f7a597b153f03b4bfb62dde6c07d

    SHA512

    a7a974b1c4ca3d7ca92e1449dc9718d5ea2af7f8e4c605d25c731fb4bbe891fdf340835e2a4e3a363558744e5ee30aec22542f377eb5bffc0097c70d24f241d1

  • /data/data/com.golestanec.modiseh/files/.Fabric/com.crashlytics.sdk.android.crashlytics-core/664DE8F70084-0001-1442-05470631F42ESessionOS.cls_temp
    Filesize

    15B

    MD5

    2566d27ce8c28d8961f082c375d7535e

    SHA1

    92fe585b1a2c9c523d2fa1f65ab5c1b6a1a6edaf

    SHA256

    5acdb54ddba2e264f6822fbdbc4e9b5158f57d43785c2f01d981956b18f7a90a

    SHA512

    1c70679bbd25a57f9ac02083d5af0fe72b1417cf3070a195497f03d6f492e87b1ed3f570de7ea7c814c995a1530e32610d9570f31a480648f4062e8d3287be8f

  • /data/data/com.golestanec.modiseh/files/.Fabric/com.crashlytics.sdk.android.crashlytics-core/664DE8F70084-0001-1442-05470631F42ESessionOS.json
    Filesize

    55B

    MD5

    5caea4b68c57072f7f52a5a41720566c

    SHA1

    4d9712f1702c7238949da43f7d8ae6efb233a666

    SHA256

    3223857b618b924c2b0fbc7bfb373a1aacf300a7b5ab585e18fffcf19039f363

    SHA512

    fe1455d21c521aeae3292bdcc386f6d2005dc253930c03e44dbcb972f96b849670d2aba039ea59e1a5ebc0350e6315151d17bcda55c161a62987d4bb01e91f9f

  • /data/data/com.golestanec.modiseh/files/.Fabric/com.crashlytics.sdk.android:answers/session_analytics.tap
    Filesize

    404B

    MD5

    dc8f2c75b76bc4ea5b4e11deb49901da

    SHA1

    e48a741bc5c8ea2369586cf7ecf03083a29ff213

    SHA256

    615f75348c9408b4a98ebd39901a2b0fc7389dac93f4fedc5f5801c8c6e7e056

    SHA512

    d3c578c355bcc9661f57d34b7f84c1cbe1318487e1a3e2cb090a1d1c56a103b00e4f8b00912f4876c7ef2c0a0fbf66034e28b19be83a0457164fc586b2b86342

  • /data/data/com.golestanec.modiseh/files/.Fabric/com.crashlytics.sdk.android:answers/session_analytics.tap
    Filesize

    859B

    MD5

    43918b3dc68960983ee5b622481b77dd

    SHA1

    dc56a4c501badf891513367cc4f20b6cf493d203

    SHA256

    8e49d7fa569ed8fbbec4f8df5016a86441a00feec9b99b34d0778a52554e601a

    SHA512

    27146353d5fa4990edaa123c113da622e687f6de9ff826ec1dd04d9a524822b218b465a0304ebf6654e83a8f94b056cf6059d71a6c3fee20f7fd139275f34974

  • /data/data/com.golestanec.modiseh/files/.Fabric/com.crashlytics.sdk.android:answers/session_analytics.tap.tmp
    Filesize

    16B

    MD5

    c33583fae4e0b61cde1c5b9227963237

    SHA1

    fe2ebe4d27469af1460f7e852031a04208ef629b

    SHA256

    35c6d6e5b93657e4a741a1cec71c21813fe05aab219909ebbb0f62fb0ae648dc

    SHA512

    fa09047004bec791b23f0dade0b64f8ab9bbd67555505e0d0818f6e89dfe56f474df80db0786d081d36adf23a5bacea40275ba043444a3a85d3d9612575bdd1e

  • /data/data/com.golestanec.modiseh/files/.Fabric/com.crashlytics.sdk.android:answers/session_analytics_to_send/sa_e5fa26bd-a6a1-472c-927b-849a99d8bf26_1716381945523.tap
    Filesize

    327B

    MD5

    9ca84d47f2449bfdeaeb3b7b4d10a9bc

    SHA1

    0822a7cbad7e6728e3302ab2da2bd03f996b6f20

    SHA256

    c82eb1682b29d2a40e826358173a75addad2b7355ccaaabade6c0df1dc243f2d

    SHA512

    e4f8ddf811b35192dd128f8325aa51f5fd78145707d92c8922cef632ef084332bd09864a19195997fd8c20c0a91181f0941e39b0f7c44ba1a9e164b669ec3793

  • /data/data/com.golestanec.modiseh/files/PersistedInstallation7515776948195287829tmp
    Filesize

    561B

    MD5

    25e7530c64ccf97df17b9a6d28ecb2f5

    SHA1

    305762567e9c0f37c0817b417b5c16954249f5c1

    SHA256

    0e9a06ee465225aeaf46e0ef180817330b61cf9287d2b67fa22df66b9d9dc4af

    SHA512

    ee5c720890ddb079d2d76320313fbda46e36a4fe5bb1608e3adcc273b7ab1f440352ba51cba810cb3acd7d56ef65cf06f0b7c5fecfc2d84eb82cc2f85602e94e

  • /data/data/com.golestanec.modiseh/files/PersistedInstallation964912211505829885tmp
    Filesize

    90B

    MD5

    5054a26d5e2c35928b5812f9f1cf3332

    SHA1

    fb4f7a8876200a5c80a027f96a25f6baa82c98c2

    SHA256

    ed3093196adb71c99f6188d79ba73d2030939dab8fa60f894573d8de307d886d

    SHA512

    6bc2b8ba86d7e7d63a7a5cc2865485bf0806e31bab85097f4cbcbf3abc723a3aef014e7675ef1e9932e141ea37ba5832e2abecf8ba91300962ac7afbd00d8f92

  • /data/data/com.golestanec.modiseh/files/UserProfile.json
    Filesize

    2B

    MD5

    99914b932bd37a50b983c5e7c90ae93b

    SHA1

    bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

    SHA256

    44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

    SHA512

    27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

  • /data/data/com.golestanec.modiseh/files/headerObject.json
    Filesize

    23B

    MD5

    612b2def1cc7be077923a20ce80ecfbd

    SHA1

    b3544521e8a028834cd6705a50b642b66df00e00

    SHA256

    c125685c371cb6a67e924f97c98657cd1966e660d6ca8d072be70f812f6e0cd4

    SHA512

    bf0564ddfe01faceb5a5f4a95a7282483cd56ad604300674d80faa28adb4cb603a55bf995b6473af55fb27a7fa9aba492f8f4991f3bf8e7df52cf5cada6a0ab5