Analysis
-
max time kernel
179s -
max time network
190s -
platform
android_x64 -
resource
android-x64-20240514-en -
resource tags
androidarch:x64arch:x86image:android-x64-20240514-enlocale:en-usos:android-10-x64system -
submitted
22-05-2024 12:09
Static task
static1
Behavioral task
behavioral1
Sample
Modiseh.apk
Resource
android-x86-arm-20240514-en
Behavioral task
behavioral2
Sample
Modiseh.apk
Resource
android-x64-20240514-en
General
-
Target
Modiseh.apk
-
Size
9.3MB
-
MD5
a13c2f362c81f4a7c7f306d00b774792
-
SHA1
7c9404bdc85adebcadd60c22a544036e181668d1
-
SHA256
70c0861ebf2fd815ac4896b3595e24b1297d76368d568ca391ba25e17663124a
-
SHA512
91c80d8c6c4f43360df19392e5e19456f03c00bcb207585ff25713a577301add34e22fec330cd70fd9b7f7160d4a902f7cb722b8983aed864b5cfa7dd6fa9fc0
-
SSDEEP
196608:dK2Zn8NyUX6sCBa/ZCBjuYSSsxn2oFyumIiO8LJWTmneeoLcQSZ:EW8sUX6E/IBjuYPKhgbIv8LJWTmh4c
Malware Config
Signatures
-
Checks if the Android device is rooted. 1 TTPs 2 IoCs
Processes:
com.golestanec.modisehioc process /system/app/Superuser.apk com.golestanec.modiseh /system/xbin/su com.golestanec.modiseh -
Checks memory information 2 TTPs 1 IoCs
Checks memory information which indicate if the system is an emulator.
-
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
Processes:
com.golestanec.modisehdescription ioc process Framework service call android.app.IActivityManager.registerReceiver com.golestanec.modiseh -
Acquires the wake lock 1 IoCs
Processes:
com.golestanec.modisehdescription ioc process Framework service call android.os.IPowerManager.acquireWakeLock com.golestanec.modiseh -
Checks if the internet connection is available 1 TTPs 1 IoCs
Processes:
com.golestanec.modisehdescription ioc process Framework service call android.net.IConnectivityManager.getActiveNetworkInfo com.golestanec.modiseh -
Checks the presence of a debugger
-
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
Processes:
com.golestanec.modisehdescription ioc process Framework API call javax.crypto.Cipher.doFinal com.golestanec.modiseh
Processes
-
com.golestanec.modiseh1⤵
- Checks if the Android device is rooted.
- Checks memory information
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Acquires the wake lock
- Checks if the internet connection is available
- Uses Crypto APIs (Might try to encrypt user data)
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
/data/data/com.golestanec.modiseh/cache/image_manager_disk_cache/af93d6827e485323417455f93c8b7d41d30058de2431cebc5033ea2a2e591340.0.tmpFilesize
175KB
MD594f5d5ad797f0ce61c025c921941b164
SHA1f69fb0240d37b5bc299e26924a5a45e6e8085373
SHA25663c6682436da565690db9d602d317e68fc886568fbe23cd13215936b570b3d07
SHA512ea71c1875a8aeb866727743247b2bd77996725219b9c163483a88906b1f8edd99182e66742ed23ab302bb0f7a631fd9e67b9335531cb9e96b9b52a1140a77f30
-
/data/data/com.golestanec.modiseh/cache/image_manager_disk_cache/journalFilesize
180B
MD53194b95c350f7b9ce60fd40e42855e5c
SHA18fd4e6eb3bf75e63c439232877295a5ea02ef6c8
SHA2566332880c51427a168079dfe402a9d8cc2b8ad324d7e3190db26c092ca9bfa26f
SHA512eb7451fc4cbafd881338c23c68ceb6b598040a1007597288c9d45d2d2e25011f84aa01bc43384c2a832a2748d7663f4d7eefdaec3f3e77884a3bdbb07ae65b35
-
/data/data/com.golestanec.modiseh/cache/image_manager_disk_cache/journal.tmpFilesize
31B
MD58c92de9ce46d41a22f3b20f77404cc1d
SHA18671a6dca00edb72be47363a7071be65cf270373
SHA25668bb33ddeed9200be85a71f70b377985f9ee68e91578afbde8321463396f1274
SHA51230f45fe9954215d6adafcc8f0a060a7ff41963a64f9b849a37f0d18fe045038d429ec13bf15226769c4ba78dad3c52f3d9e0dbbb4fcdea4828a1efe956e48f56
-
/data/data/com.golestanec.modiseh/databases/com.google.android.datatransport.eventsFilesize
32KB
MD5ad7bbdcce258ba21d0a07659a3849e3f
SHA1887e17f38cf736cc82125092f6cadd5753184286
SHA256a6417906596802ee2a80cd22ef848d832848a6f36f4e45d320e9b98633a5c456
SHA5124519d5aec86a163c9c2c97d1cf9862cc9b421749c0d78c0f4ceee31c9fe07ac557e736d5b3f72942e2d5d44b578fc8a6789f2e7a3ec98ec2199fdc50dd3ac45d
-
/data/data/com.golestanec.modiseh/databases/com.google.android.datatransport.events-journalFilesize
512B
MD50f9bb6d7e2b30fe7d66047e8f4696c87
SHA1c4508e3b20b37951f18b9c5f7d8d3c9345f495cd
SHA256c5f174ae7988349c304489ae2e970e1ea992551b20f60660141d68e15a7281fd
SHA512169b723854503cf445f53f485fab76eef319f498effd20f5bf66091a8c9043a64e90489ecb3720010e783b404db284d5b62439e1b839f7a2f8c6ee8cf4a76138
-
/data/data/com.golestanec.modiseh/databases/com.google.android.datatransport.events-journalFilesize
8KB
MD5b3e246bed84ea216bd891acd33b4f2a6
SHA131e05cda4bfe2670a6f1d53cc3d18d8d05b4a162
SHA2564e0c442dc96565fc6c7aa37d72cf53d6149b617e66a4c816a1e5b7be17484a9a
SHA512082c87dfa4764ab56b8a03bd57b5579fc6c533ec97565b41ef436cececa09a28f40be3d5d08b6b7ff176201c29d969ed2fc0574f1c944708187fd7de7c70f169
-
/data/data/com.golestanec.modiseh/databases/com.google.android.datatransport.events-journalFilesize
8KB
MD5b562e5e88295ff14eae776dda22582e4
SHA1c9072d48a6f734aeb818327ead386642688d4ff4
SHA256f32f8f64d3baa4de93fbfc022b27e646a08d0759b5e9e24c2c94c16df4e982bd
SHA51282a83a7d87ed423a8f6c4334c28f04b844ed600c48eae4b0657924f4c644c6e515556e2e7b9102f78668952ac44b3b3b8aa8ee49413ef53207474c87f7028518
-
/data/data/com.golestanec.modiseh/databases/google_app_measurement_local.dbFilesize
16KB
MD5eb52a90bb70b76e946b62f50b6f7fb85
SHA142d767b5d1faa7dcef4cb4e1432a5f47ec2e9ee0
SHA25648472f593a3e9cf9e91ee5f7d66dd9ff291bfb247eb6b46778c710fc24e8d3c4
SHA512b356c858cadd14b6ecddf134f1c494c0107a1d36be9387984fc53dcb00e6779d944f058f4ac99d0fc2fe3a427cd1c2921c6fc38ecad53909fc4b5b6f04459b5c
-
/data/data/com.golestanec.modiseh/databases/google_app_measurement_local.dbFilesize
16KB
MD511d2b71b172b65c6c8ee5e6a3122393c
SHA146facba8cd505403070e9e85cd9faf040bf65440
SHA256b4a73378813072ded4204956068784c418395b726bad4cdd83866c4939756eff
SHA512dd9911ab5f784d64731165ff9d834132f19912838008ec1ee261cd231155330df3e94e2d068c94ebf1548b9883bc375ae51dd97878e278e044c86314ce1f5670
-
/data/data/com.golestanec.modiseh/databases/google_app_measurement_local.dbFilesize
16KB
MD535127b1ace3de2f1e7c1774d5a8de3f5
SHA142a3dbf8b3aba21d88a7470cceaf14a593364466
SHA256111a2f51b0f76f5617b19071e618c77380baf781b9ac6d8b92bcc62dac3d50f7
SHA5128f8462151063835e528c276c8f038a43bf18db3dd9ca255a7ab3b1e4c21eb9bffdc3c325253c8feca5fd3477e117057a2a00d7ff7819f59a4a7ebfb45fa558ff
-
/data/data/com.golestanec.modiseh/databases/google_app_measurement_local.dbFilesize
16KB
MD5cb89249ff5c4eeec148db922d2b9e2be
SHA1ec6f47643d7c4b8ce3163a4763fc80e5a080e799
SHA256b9fcb591fd1c4143419db09cc4ed9d0ff8f8643b2abffb89e6482f3107de7ae6
SHA512308b922b764fa4795afc109e5f1e2d24636b952533cc12f32a59a6442f7e729dd66f5ec29b955e01b1aee8c3af24728cdbd98241571bb68eee794bd8bf20ad8a
-
/data/data/com.golestanec.modiseh/databases/google_app_measurement_local.dbFilesize
16KB
MD57d99f6c0e1cf9b81ec75e22c1ebbbf00
SHA1d258170bea894f7469e19731c3ca6e0deaa6d899
SHA256f9353844de03f9d20aedc9ccbf172f48fa8eafc95eb58cc3b6ef0af35c27b137
SHA5129fd0508a73480b271e81e15c2802c0d26d35abded8140fbad0779089a464c76c3012156053394bf8c5010d3cdf0f69c6b6a86aefd6dade5b885b0653f131a9b2
-
/data/data/com.golestanec.modiseh/databases/google_app_measurement_local.dbFilesize
16KB
MD51fd548b64cb2d59ccdf49ce436ce0f8e
SHA1f953d3c7b485f1021b5f6624cae5ba779068590e
SHA25695884b1255fb06b3609ba8eaa00fde3ae1ed390f147e7ad411b55b7a04b2c804
SHA512ddb2ac9796fc4d9fb2bab034baee4d7f55b498e0935b06e9105c6a88b4dbeb39cbea96afb3b1f52d52f225dae6b221e83fef5e6816c117a4ead412ac88735c4e
-
/data/data/com.golestanec.modiseh/databases/google_app_measurement_local.db-journalFilesize
512B
MD5300d60072dcd85550e20769f38d7d1e8
SHA1480cbc36486b2d7814ad95f6e05118250785fc54
SHA256b1aa347cbed017cfbe7576045d2fa60ed1cfae6d492f273473bf47a691db137f
SHA51203317a3b2088a2e626ed01d665c056be4c6c14b70de2ad96692f722a16212f38e9747002e8f147eaa9e43a841d705d3d13eaa71489b2615be3c4e68d106f3025
-
/data/data/com.golestanec.modiseh/databases/google_app_measurement_local.db-journalFilesize
8KB
MD56b3f357360b8fb5c7edd1eea9761464b
SHA13ae1a1cc34e156c62d8524811ce983b897ee574c
SHA2569952613bcf964ea8befc857d05764a100bdf3efa35c772b0019aec736c017563
SHA51263f95b6aa087975d71f017dc8177a858a98a265440f1dbdb97491e200481e132bc4967f20694a95cf544121c289f10ca689f0403745a6feb94995084ed07bb7f
-
/data/data/com.golestanec.modiseh/databases/google_app_measurement_local.db-journalFilesize
4KB
MD5988b14240d336cd5e50ea7150f394cbe
SHA127b82a49e8b8b6f4a527f9df8ac163fa9c9298f4
SHA256b75ccdd75a4752750ff2f4ccb5df417cc6bf7914d35c4db84f94cf4809df370e
SHA5122e40b06d71079b5d7c1a16bc16f3e15f7a1a330176fa39a766cd3ed869d079b909951c5f9e4ee1396335244d8090b029da3ee8129d58bbc160df82b9b1a9e639
-
/data/data/com.golestanec.modiseh/databases/google_app_measurement_local.db-journalFilesize
8KB
MD5fd4ae0d2c165cb83f923c90e48302530
SHA1c1910bd7bcdf692192b243d6c6d320a2746be958
SHA256b67780c0861468df9b3888c936b5fb32685a67048f1df3873e522256b4708f45
SHA51283b4fe55f31cf2dd6ad8fa9d979ae846373ffbd08b64677da61088ae0fabbb81f168c2951b265420e11ba3fb86bf184d7be23356463405d2ec190af78bf6e0b9
-
/data/data/com.golestanec.modiseh/databases/google_app_measurement_local.db-journalFilesize
8KB
MD592e29910c8bcd265bfe17af7216b4dd8
SHA13ddc7451214dca735ac50374ce7913e65778bf5b
SHA256c338974b9aecc94519a895e8ac250df3469326d6bfc4d7fb4fabe8280035ea23
SHA51235d9e21ed5c6b576a80b6ac3954f454d160a66ada21f82284ea84a847115798343822e16dc9ae20b358fbd4003e5f1413fc39bb9fd179a22a43252237864b4b9
-
/data/data/com.golestanec.modiseh/databases/google_app_measurement_local.db-journalFilesize
8KB
MD5d7b46cfb48a262245b9b2c0d3321215e
SHA19165e0384a4bdfba5545c4f673c410a4dd36e8ba
SHA2563351391990fd83dabe2bd5dd15032c6aecd239d228576d189f7fa188e3ab62dc
SHA51211dab5ce20f356fe4f58a3582836ce2ff638100993e94da0ceefa549249278a116cee1e9c1c75120f1e0deec03ff76c68ba927c07ab0d5110288b1e4887a1714
-
/data/data/com.golestanec.modiseh/files/.Fabric/com.crashlytics.sdk.android.crashlytics-core/664DE8F70084-0001-1442-05470631F42EBeginSession.cls_tempFilesize
77B
MD5492d2fe1a7b4e00c9ec79f3461d0a3ee
SHA16701e090fdfd0dad115ceb3177433fb613ee92d8
SHA256e31508f5783a1760f93baa456229cf82c6ea87e994b9b8038b58ca0f3ee256f4
SHA512ea136fcf4269113fb042b6a84cb9dc25a16dc141ff97142d762276a8bd7376843a2b9ac667871bf0c521cfc91680b3623c86c77ee52ed8011649777d9bf7efde
-
/data/data/com.golestanec.modiseh/files/.Fabric/com.crashlytics.sdk.android.crashlytics-core/664DE8F70084-0001-1442-05470631F42EBeginSession.jsonFilesize
132B
MD5850758e3c9adc2b91ff35848bae6c7ad
SHA1ae4bda30cb511dda3b6256b22c6a2e1b8e689ff4
SHA2562252469f49058cae9f32a4e6c395433acca3e6f8af6ac491257411aef8a64b7c
SHA5128c35dbca7f8906459974186f4ffd8b1447f5892195fb56d119e4174bed295f402798b7ad38910d546506f3fb43790588a70efd260cfbbdb402ba7ad2febea321
-
/data/data/com.golestanec.modiseh/files/.Fabric/com.crashlytics.sdk.android.crashlytics-core/664DE8F70084-0001-1442-05470631F42ESessionApp.cls_tempFilesize
117B
MD5c43ea793df4af4378250552951815ad2
SHA12f2dccb8e5540c7cff704f62a839a11038604691
SHA2562551dbce6dc1d0b905fad72277e1ebb85f6c5642b6c1d758e5ffa6245d914385
SHA5123e772a86d6f1cd377e2c0fdbccc83483cbd96b8c28008170e44cdd9e606c2ec83c201f81ba3369829a1d5f7621af636f5c12194fd8d6c327b5915fb5c4c9b1d8
-
/data/data/com.golestanec.modiseh/files/.Fabric/com.crashlytics.sdk.android.crashlytics-core/664DE8F70084-0001-1442-05470631F42ESessionApp.jsonFilesize
231B
MD57ae734477e9f5074a311705a3bed43f3
SHA1f86115fcfb54bcfbc89ab36f0aab79c590d4ef08
SHA2567af78179d7ab2439d7be9d52c90862d93c5b9d7070c70341f708130a3ba4677f
SHA51200e3e8350b587742e9e98516713ecd83373e1f7cdebe538381aff920acc495e1e24adac95326b0bf335fa79273757bb248a8bb5f136436e71c5c13831c35e54e
-
/data/data/com.golestanec.modiseh/files/.Fabric/com.crashlytics.sdk.android.crashlytics-core/664DE8F70084-0001-1442-05470631F42ESessionDevice.cls_tempFilesize
48B
MD52390c1f21db00b20c07107e3ec7275fe
SHA1e663a646460acc071aebee942cc1776c23d77655
SHA256d348072a01496839cfcde3a18866423aee74aefd613fa3bf1ff4a203ef46a699
SHA51243ff60754eb60795ca1c318f44dcfe49194add26cc3d92c2eac7bef538fd65b6290f2e5953b8f1693b9425ebbcdd022ab16a18280146ee0b0c2eefe27bc0bd63
-
/data/data/com.golestanec.modiseh/files/.Fabric/com.crashlytics.sdk.android.crashlytics-core/664DE8F70084-0001-1442-05470631F42ESessionDevice.jsonFilesize
202B
MD5afa07370d07ed0a8ac9554ee7001bb72
SHA1d1e9de22fda1295087525ff3a377f7d7dd410ac7
SHA2568d4b99fc4968c9cdff4626ff6c1467cdb427f7a597b153f03b4bfb62dde6c07d
SHA512a7a974b1c4ca3d7ca92e1449dc9718d5ea2af7f8e4c605d25c731fb4bbe891fdf340835e2a4e3a363558744e5ee30aec22542f377eb5bffc0097c70d24f241d1
-
/data/data/com.golestanec.modiseh/files/.Fabric/com.crashlytics.sdk.android.crashlytics-core/664DE8F70084-0001-1442-05470631F42ESessionOS.cls_tempFilesize
15B
MD52566d27ce8c28d8961f082c375d7535e
SHA192fe585b1a2c9c523d2fa1f65ab5c1b6a1a6edaf
SHA2565acdb54ddba2e264f6822fbdbc4e9b5158f57d43785c2f01d981956b18f7a90a
SHA5121c70679bbd25a57f9ac02083d5af0fe72b1417cf3070a195497f03d6f492e87b1ed3f570de7ea7c814c995a1530e32610d9570f31a480648f4062e8d3287be8f
-
/data/data/com.golestanec.modiseh/files/.Fabric/com.crashlytics.sdk.android.crashlytics-core/664DE8F70084-0001-1442-05470631F42ESessionOS.jsonFilesize
55B
MD55caea4b68c57072f7f52a5a41720566c
SHA14d9712f1702c7238949da43f7d8ae6efb233a666
SHA2563223857b618b924c2b0fbc7bfb373a1aacf300a7b5ab585e18fffcf19039f363
SHA512fe1455d21c521aeae3292bdcc386f6d2005dc253930c03e44dbcb972f96b849670d2aba039ea59e1a5ebc0350e6315151d17bcda55c161a62987d4bb01e91f9f
-
/data/data/com.golestanec.modiseh/files/.Fabric/com.crashlytics.sdk.android:answers/session_analytics.tapFilesize
404B
MD5dc8f2c75b76bc4ea5b4e11deb49901da
SHA1e48a741bc5c8ea2369586cf7ecf03083a29ff213
SHA256615f75348c9408b4a98ebd39901a2b0fc7389dac93f4fedc5f5801c8c6e7e056
SHA512d3c578c355bcc9661f57d34b7f84c1cbe1318487e1a3e2cb090a1d1c56a103b00e4f8b00912f4876c7ef2c0a0fbf66034e28b19be83a0457164fc586b2b86342
-
/data/data/com.golestanec.modiseh/files/.Fabric/com.crashlytics.sdk.android:answers/session_analytics.tapFilesize
859B
MD543918b3dc68960983ee5b622481b77dd
SHA1dc56a4c501badf891513367cc4f20b6cf493d203
SHA2568e49d7fa569ed8fbbec4f8df5016a86441a00feec9b99b34d0778a52554e601a
SHA51227146353d5fa4990edaa123c113da622e687f6de9ff826ec1dd04d9a524822b218b465a0304ebf6654e83a8f94b056cf6059d71a6c3fee20f7fd139275f34974
-
/data/data/com.golestanec.modiseh/files/.Fabric/com.crashlytics.sdk.android:answers/session_analytics.tap.tmpFilesize
16B
MD5c33583fae4e0b61cde1c5b9227963237
SHA1fe2ebe4d27469af1460f7e852031a04208ef629b
SHA25635c6d6e5b93657e4a741a1cec71c21813fe05aab219909ebbb0f62fb0ae648dc
SHA512fa09047004bec791b23f0dade0b64f8ab9bbd67555505e0d0818f6e89dfe56f474df80db0786d081d36adf23a5bacea40275ba043444a3a85d3d9612575bdd1e
-
/data/data/com.golestanec.modiseh/files/.Fabric/com.crashlytics.sdk.android:answers/session_analytics_to_send/sa_e5fa26bd-a6a1-472c-927b-849a99d8bf26_1716381945523.tapFilesize
327B
MD59ca84d47f2449bfdeaeb3b7b4d10a9bc
SHA10822a7cbad7e6728e3302ab2da2bd03f996b6f20
SHA256c82eb1682b29d2a40e826358173a75addad2b7355ccaaabade6c0df1dc243f2d
SHA512e4f8ddf811b35192dd128f8325aa51f5fd78145707d92c8922cef632ef084332bd09864a19195997fd8c20c0a91181f0941e39b0f7c44ba1a9e164b669ec3793
-
/data/data/com.golestanec.modiseh/files/PersistedInstallation7515776948195287829tmpFilesize
561B
MD525e7530c64ccf97df17b9a6d28ecb2f5
SHA1305762567e9c0f37c0817b417b5c16954249f5c1
SHA2560e9a06ee465225aeaf46e0ef180817330b61cf9287d2b67fa22df66b9d9dc4af
SHA512ee5c720890ddb079d2d76320313fbda46e36a4fe5bb1608e3adcc273b7ab1f440352ba51cba810cb3acd7d56ef65cf06f0b7c5fecfc2d84eb82cc2f85602e94e
-
/data/data/com.golestanec.modiseh/files/PersistedInstallation964912211505829885tmpFilesize
90B
MD55054a26d5e2c35928b5812f9f1cf3332
SHA1fb4f7a8876200a5c80a027f96a25f6baa82c98c2
SHA256ed3093196adb71c99f6188d79ba73d2030939dab8fa60f894573d8de307d886d
SHA5126bc2b8ba86d7e7d63a7a5cc2865485bf0806e31bab85097f4cbcbf3abc723a3aef014e7675ef1e9932e141ea37ba5832e2abecf8ba91300962ac7afbd00d8f92
-
/data/data/com.golestanec.modiseh/files/UserProfile.jsonFilesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
-
/data/data/com.golestanec.modiseh/files/headerObject.jsonFilesize
23B
MD5612b2def1cc7be077923a20ce80ecfbd
SHA1b3544521e8a028834cd6705a50b642b66df00e00
SHA256c125685c371cb6a67e924f97c98657cd1966e660d6ca8d072be70f812f6e0cd4
SHA512bf0564ddfe01faceb5a5f4a95a7282483cd56ad604300674d80faa28adb4cb603a55bf995b6473af55fb27a7fa9aba492f8f4991f3bf8e7df52cf5cada6a0ab5