Analysis

  • max time kernel
    177s
  • max time network
    188s
  • platform
    android_x64
  • resource
    android-x64-arm64-20240514-en
  • resource tags

    androidarch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20240514-enlocale:en-usos:android-11-x64system
  • submitted
    22-05-2024 12:09

General

  • Target

    Modiseh.apk

  • Size

    9.3MB

  • MD5

    a13c2f362c81f4a7c7f306d00b774792

  • SHA1

    7c9404bdc85adebcadd60c22a544036e181668d1

  • SHA256

    70c0861ebf2fd815ac4896b3595e24b1297d76368d568ca391ba25e17663124a

  • SHA512

    91c80d8c6c4f43360df19392e5e19456f03c00bcb207585ff25713a577301add34e22fec330cd70fd9b7f7160d4a902f7cb722b8983aed864b5cfa7dd6fa9fc0

  • SSDEEP

    196608:dK2Zn8NyUX6sCBa/ZCBjuYSSsxn2oFyumIiO8LJWTmneeoLcQSZ:EW8sUX6E/IBjuYPKhgbIv8LJWTmh4c

Malware Config

Signatures

  • Checks if the Android device is rooted. 1 TTPs 2 IoCs
  • Checks memory information 2 TTPs 1 IoCs

    Checks memory information which indicate if the system is an emulator.

  • Acquires the wake lock 1 IoCs
  • Checks if the internet connection is available 1 TTPs 1 IoCs
  • Checks the presence of a debugger
  • Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

Processes

  • com.golestanec.modiseh
    1⤵
    • Checks if the Android device is rooted.
    • Checks memory information
    • Acquires the wake lock
    • Checks if the internet connection is available
    • Uses Crypto APIs (Might try to encrypt user data)
    PID:4526

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/user/0/com.golestanec.modiseh/cache/image_manager_disk_cache/af93d6827e485323417455f93c8b7d41d30058de2431cebc5033ea2a2e591340.0.tmp
    Filesize

    175KB

    MD5

    94f5d5ad797f0ce61c025c921941b164

    SHA1

    f69fb0240d37b5bc299e26924a5a45e6e8085373

    SHA256

    63c6682436da565690db9d602d317e68fc886568fbe23cd13215936b570b3d07

    SHA512

    ea71c1875a8aeb866727743247b2bd77996725219b9c163483a88906b1f8edd99182e66742ed23ab302bb0f7a631fd9e67b9335531cb9e96b9b52a1140a77f30

  • /data/user/0/com.golestanec.modiseh/cache/image_manager_disk_cache/journal
    Filesize

    180B

    MD5

    3194b95c350f7b9ce60fd40e42855e5c

    SHA1

    8fd4e6eb3bf75e63c439232877295a5ea02ef6c8

    SHA256

    6332880c51427a168079dfe402a9d8cc2b8ad324d7e3190db26c092ca9bfa26f

    SHA512

    eb7451fc4cbafd881338c23c68ceb6b598040a1007597288c9d45d2d2e25011f84aa01bc43384c2a832a2748d7663f4d7eefdaec3f3e77884a3bdbb07ae65b35

  • /data/user/0/com.golestanec.modiseh/cache/image_manager_disk_cache/journal.tmp
    Filesize

    31B

    MD5

    8c92de9ce46d41a22f3b20f77404cc1d

    SHA1

    8671a6dca00edb72be47363a7071be65cf270373

    SHA256

    68bb33ddeed9200be85a71f70b377985f9ee68e91578afbde8321463396f1274

    SHA512

    30f45fe9954215d6adafcc8f0a060a7ff41963a64f9b849a37f0d18fe045038d429ec13bf15226769c4ba78dad3c52f3d9e0dbbb4fcdea4828a1efe956e48f56

  • /data/user/0/com.golestanec.modiseh/databases/com.google.android.datatransport.events
    Filesize

    32KB

    MD5

    7daa8bf70cba1177c0aaa35143f5ff54

    SHA1

    4ddb8e3e373296808fd5a3832a454ea9c0c60b0a

    SHA256

    f02ded6053bd0f124da16cdf40849fb201797ddfac5536ab36e1feceb21564a3

    SHA512

    7178eae8e99b2f8b571bd333a3c6916bd088c96dc2c6d5b074ac388e58a345de6a82daceb39994019cbdc5c2d4065912eb0c52787ec50d9e1f746ba92bcee22f

  • /data/user/0/com.golestanec.modiseh/databases/com.google.android.datatransport.events-journal
    Filesize

    512B

    MD5

    a1d83cc52e827c35a9f32c33dfb96679

    SHA1

    b5cc57615b8ab27bdde6a498e07e9a5439db80c8

    SHA256

    d23afb98d10551e6561391576f75d0dc14925a922ed4ba541ed6d183a1c62b30

    SHA512

    ac97f3c26d0c4e4fe3399b33891cf5b088642f9d48695c04bc3473c47846ab9134e43686b4db5025524032764617072d0274b7814e80c0302df2dbe8e16cf49d

  • /data/user/0/com.golestanec.modiseh/databases/com.google.android.datatransport.events-journal
    Filesize

    8KB

    MD5

    1ef57aaf946c7949efc3145c1d1680b3

    SHA1

    1ef0428885c1bda4a37d439d7aa67b4f5bc3d79d

    SHA256

    89e4a1985cea7d355e6a07c972b13b4bc5cf16980c67c48da6d99bebc6a392d7

    SHA512

    8c266d8bce202a06865793554150f39fb3f158ca10090ffc51614b69d60a5e6269e27af95f27fdb2f37ac03abd14dd857ef33c28b0d692c08a270bfd31ec4583

  • /data/user/0/com.golestanec.modiseh/databases/com.google.android.datatransport.events-journal
    Filesize

    8KB

    MD5

    1fedcdd18f47cc94f92769438e82c999

    SHA1

    f4556707a86614990870dd503362709c9dd66677

    SHA256

    4de4a60c80ee28a14403d56f1d758dce910f7d202c6e3bb11bd818fb11a586d1

    SHA512

    299f410b0614de7134620ab64d2b6f5a5199b1d41cb00728a680e83d9b69cc31cd5a2ccd16005de8bbc86f0b518407d8ec701280cb875ad8c47c5669e0f76c49

  • /data/user/0/com.golestanec.modiseh/databases/google_app_measurement_local.db
    Filesize

    16KB

    MD5

    d9cf75fdd1c2292d986f6c3d5d60f2c8

    SHA1

    07ecb1d3a26d952ae5fecf54f36699ab498510b1

    SHA256

    2d227e9b7a044c8e10294f6a831fb92d81ea9582381796d87f35bd268e37538a

    SHA512

    442c96e4b4c79b8d1c64dd3a6d6088ae1dace441e78d830dfb3190ee1c0fafebc606fb432071b4a1ad1a4ba9b68c7877b0bce520ccc88708feaf82bbc474e0cb

  • /data/user/0/com.golestanec.modiseh/databases/google_app_measurement_local.db
    Filesize

    16KB

    MD5

    897f50081694a8d9c7a23bc8eb0fc845

    SHA1

    801b5bc61bd803c355adf2a3577c15331d8d4c34

    SHA256

    5ef72c64b8d46a8dcdaf6929a0723d1e08d58d7a85951cd32de867971ac22979

    SHA512

    23e63c574130a630658065b23f02d9896263e5977ef306316065e751d9abc609f068f0075b5adba7b88bbb009b32f9aee029555ccdbb69e2903edec43766b4c1

  • /data/user/0/com.golestanec.modiseh/databases/google_app_measurement_local.db
    Filesize

    16KB

    MD5

    e05b67c79d7711138828149229955a9e

    SHA1

    cb915fc4a65e534d6320daf249dfc77e597b564a

    SHA256

    16241f9619e1a99085eb9ff4a4fce2f56c3f64cf95a32675fe05bfb8dfadd8b7

    SHA512

    68a54812a9b42fdaf0abcf392ad7a1d231e0d7e1528d67624f8a9774fe59245c28a602fa34cb4150c431f3bb947a3e212e6c0858d4353cd4fa647d22d7e71a25

  • /data/user/0/com.golestanec.modiseh/databases/google_app_measurement_local.db
    Filesize

    16KB

    MD5

    3835a83db1911e9d7f3b1f33885718c0

    SHA1

    b99456f69975df2faaf2666e2ff36660b88f3e1c

    SHA256

    d2525ba826f60b903e3117c515e964be5512f18e9ef3204c4f015abae088b635

    SHA512

    f121855f62e3112376891c5be81040f269db7bfd80d5010119a11d49f80a004602eca7df798ff53c09671cb081c4ff421da7dc21c6109488f4b42a70b10b626f

  • /data/user/0/com.golestanec.modiseh/databases/google_app_measurement_local.db
    Filesize

    16KB

    MD5

    832313e8bacaac8e6d33c47507ee2e82

    SHA1

    328715538725b2614fdc8e12ffdff735cee5076c

    SHA256

    fe16016731a2dc51f3512b7e12e3ddba238d4656b16e60312458f6ac81f14372

    SHA512

    5d807c6632438ca0be081d9a88f1448636f46f24d1543525394dad19d30721bfdea80debc4999a8f6c022950027b2cabcace72e54268254e842309a9f7f195c0

  • /data/user/0/com.golestanec.modiseh/databases/google_app_measurement_local.db
    Filesize

    16KB

    MD5

    8ce3ea81daffd1bd00430ef0a0acf4c0

    SHA1

    5d13006f6e4b33bdcfa6d2a6464994883ca7143a

    SHA256

    8ccf82d05de9790bc7ac92bbbc0fecac509788ddf840c0eb855071874d65bd04

    SHA512

    99810c4b5e2552e4ac6bd690ad1b9239ce7e592f0a9a254967e516651879e57d061ca7fdc9d1475277facaea00fd15b798f7fd8d65865b46f349fa4d27639497

  • /data/user/0/com.golestanec.modiseh/databases/google_app_measurement_local.db-journal
    Filesize

    512B

    MD5

    b80146d434d63bda99e9c1ba0f3bfe54

    SHA1

    b9a34d6001dcb4aa0b4969eac2fb4497b429d620

    SHA256

    506b77c87262b67921e430bfbfc69a2a340ad454650167c1b517e515f8bb0196

    SHA512

    f5ba2fb63e9017405f91d91b49b1a4504069e4713e43208a686b820dd3c2946dbbe019fa9e2026c2bb1a223e60655ccedc6cd90eb62475f513d4078e2633787d

  • /data/user/0/com.golestanec.modiseh/databases/google_app_measurement_local.db-journal
    Filesize

    8KB

    MD5

    e78f99d9a22f4715c5b59c67c1c05275

    SHA1

    21987a282ff4fb309b143178c5f7bea2ff711ac8

    SHA256

    6c6d25e9b0f138069e13486583502afafe40836bb15126970dbe43b5e1876d08

    SHA512

    7620f3efff704db801765a58d2e0ae0d424f02f8f4db6f6a46f5952dffdadf256f5e6d1ec5682a93b9f0d91c7d0d16891457582cab4db8f146fcf6ff5aa7c7ab

  • /data/user/0/com.golestanec.modiseh/databases/google_app_measurement_local.db-journal
    Filesize

    4KB

    MD5

    873bf6e8f8f1a9664ec30a8baf249e36

    SHA1

    644d8562b4fb798ca7f693ef4fbb5b5dd38f6a2e

    SHA256

    068a4ade3fc2a7fc24f17a6021c59106d6aa7175f5c9764fa24e9e65575cbeb1

    SHA512

    452f25f9d2e76735d6a10dfced272fdcd4dcf728298a08dc6e54d216149dd950ee45557f4281da3549fc00a4703a26a35897566da5cdc399e26ff7ab5418dd26

  • /data/user/0/com.golestanec.modiseh/databases/google_app_measurement_local.db-journal
    Filesize

    8KB

    MD5

    fe5473923fdc5a55cf986e9a7a57aba4

    SHA1

    028765783fcb7699205903fa9ba738e4a151690c

    SHA256

    d6d468611324e047fe899453e98e3706aad88db08d88a2ae5451a4757956c842

    SHA512

    30f4e762815020448f66144523702e0d7c680138a521f59b19046853d773510bc08b702fd309de25292fc8ab9bc397793d16d5b8d8fd4a0616707766213ca357

  • /data/user/0/com.golestanec.modiseh/databases/google_app_measurement_local.db-journal
    Filesize

    8KB

    MD5

    c089937e555c5b3dfa71520cc5e60fea

    SHA1

    39d4a91e1aa496386a58229939cfcb7f0ff24420

    SHA256

    bd2581713f2234121b7925ea27b4dcb94f104d668a1d1125548688fba8523563

    SHA512

    cc0c756228836caf163df059bff4a2f20fd078041ccb1f94b076c00b8fa7ba07f3f8393b97ef4651420fcfb6fe2bba40693ce33d1231da5798d9292533742808

  • /data/user/0/com.golestanec.modiseh/databases/google_app_measurement_local.db-journal
    Filesize

    8KB

    MD5

    70ece2f9303ef3664e688f09db599ad8

    SHA1

    3896b2493a3eaf504fecc7cdb91f0802497cda90

    SHA256

    30ba44ff60e8815c991061efe7cb3bcf6553b2816e0aa2438f5d7b14cee25a21

    SHA512

    88837321b89883fc8ad308471ee3c4cc26b68cd2785134f8549530775349c2a7feefb2492cf9d3bce7b6ad086a95be9cac887a8fe87d5024f61159d523e1ab26

  • /data/user/0/com.golestanec.modiseh/files/.Fabric/com.crashlytics.sdk.android.crashlytics-core/664DE8FF01DE-0001-11AE-2DBACB96824BBeginSession.cls_temp
    Filesize

    77B

    MD5

    868927758a7a1114253f435bdca25aac

    SHA1

    e64e9e1b79c2b720b51bce68a4c161cd268b8036

    SHA256

    d6af55c340bc3fdc803acb8d9ab991f78dbaa980d5b1c0cc2fe804aff9c51934

    SHA512

    313c1267e1209f0b398f191bf12996602f34afe94031bd390b156c4901008ac0db20f84cbce1db8346443a706162e69bd4706ce824d9007c1ad812e194351622

  • /data/user/0/com.golestanec.modiseh/files/.Fabric/com.crashlytics.sdk.android.crashlytics-core/664DE8FF01DE-0001-11AE-2DBACB96824BBeginSession.json
    Filesize

    132B

    MD5

    2af16ae66f53e70320d0ea5a1e7d1b73

    SHA1

    8983adcc0418ec0545b8ec14b729885ba55ca36c

    SHA256

    da74c573ff497e3b1a74bd6e52dd51bb1aaaf45ff4e31f93b79928b4e1bff025

    SHA512

    c73adace9f40af26333ccd38e26b1992d6e73b6e07a638f13bacac01281d68e98f806999576dafc3f1ebbbd83e91eec0046d07282bd7a6a93765c202d3099464

  • /data/user/0/com.golestanec.modiseh/files/.Fabric/com.crashlytics.sdk.android.crashlytics-core/664DE8FF01DE-0001-11AE-2DBACB96824BSessionApp.cls_temp
    Filesize

    117B

    MD5

    4b4d8d7de49e4c4186381bc92260987a

    SHA1

    d002b04c2417f11124438e76416574852c5e664c

    SHA256

    ec7b288b44a524f892fe8a2226e56d75716c28f140645f3dee118dc6e7682d43

    SHA512

    1232134060f5065ef93289f18f81f3d57fcc4eada3731423b7674f875718bcabe090211aaac5705c2b27a75532cd43ffb3c0a2654a580f7bacf9beea43b96bfc

  • /data/user/0/com.golestanec.modiseh/files/.Fabric/com.crashlytics.sdk.android.crashlytics-core/664DE8FF01DE-0001-11AE-2DBACB96824BSessionApp.json
    Filesize

    231B

    MD5

    b40b2d97c5b46aa1c3c356b0fa0aba2c

    SHA1

    742ee54d5886502e81f44230d0244609391876df

    SHA256

    b24227ef0fcb82ba417fa8208e01ae73b11676df5014067129c5dab3211c9c39

    SHA512

    5644dc7e7be3443e9fa89be4d4e105f79ebeeb2030d042e1f6e18419cbbc13805fb9c356462cd9a85b97f76072f2fd2e2a01117e6de437149a2b297f2859f2ef

  • /data/user/0/com.golestanec.modiseh/files/.Fabric/com.crashlytics.sdk.android.crashlytics-core/664DE8FF01DE-0001-11AE-2DBACB96824BSessionDevice.cls_temp
    Filesize

    48B

    MD5

    fd6372364a5c5c9cf8945ac3ea7a5d94

    SHA1

    3c798cab71f6ae7a81e71e58712368231230588a

    SHA256

    7400bf714ca32b64dd89440c9d5ace4e0115ddce44d169839e465df0e1638641

    SHA512

    a18b18d061dfd979bce1e0b769009668c322300e7174f51d2532e86dc6018769194507a106dd30b97317f8c1a7539d13a7baeab2900c1e00da7c74e899dab276

  • /data/user/0/com.golestanec.modiseh/files/.Fabric/com.crashlytics.sdk.android.crashlytics-core/664DE8FF01DE-0001-11AE-2DBACB96824BSessionDevice.json
    Filesize

    202B

    MD5

    eeeb942571fa704cf8ae49731fbe9789

    SHA1

    b5989c4cb932ffc779ee25bb3f7bfb79cf720427

    SHA256

    78809f7ae96de01e3922b6d3a134c3f7e9a0cbdacef313f70e8d9345bf5fbd71

    SHA512

    71e55c16f9f8fc936f8607448916bbfa1ba233b7120b8676fe11552916ac4dd3e3a7b0f9c31e14048933c8bb9c9d6d630ab7d28389f31749640cc965b2636565

  • /data/user/0/com.golestanec.modiseh/files/.Fabric/com.crashlytics.sdk.android.crashlytics-core/664DE8FF01DE-0001-11AE-2DBACB96824BSessionOS.cls_temp
    Filesize

    15B

    MD5

    b3d9541cc92a9153d14e5160f8d8c008

    SHA1

    2e1ac80eb381dd82a03795b682f92020348c0113

    SHA256

    1ead5b213c87f182ffce484c34f7d9f140ad3425c0f303f460492efe8a26c56d

    SHA512

    78074409135a210ba4e1407ad9b3f784f5683e83aac4ce3482d4e8135425cf2b30db1ff5dd0041901c490a551a477237c6d255671c7b1fad74090980dcf3334f

  • /data/user/0/com.golestanec.modiseh/files/.Fabric/com.crashlytics.sdk.android.crashlytics-core/664DE8FF01DE-0001-11AE-2DBACB96824BSessionOS.json
    Filesize

    55B

    MD5

    fc1dcee4e422d77e7fab7c08c8a41344

    SHA1

    d5340127e9d5f735b9d33b9dc61c772fb0e2dc15

    SHA256

    b843f05ed78cd137c272ba7f0ce8ede3aa853098a856863e51d5c223b58f21c7

    SHA512

    3ec07617e3e1008572f6f2528de9d4b827050cc5a7cf19a1604c961f9ec370ede6f5fd83bfcc252c0ee286fe244ee6734046ef1aa638dcfc689cd4407a6a8f61

  • /data/user/0/com.golestanec.modiseh/files/.Fabric/com.crashlytics.sdk.android:answers/session_analytics.tap
    Filesize

    404B

    MD5

    585ee322a39324a42697ccf89ae1855c

    SHA1

    329f85c939d0de9ddde1413318d789f0fce68ed9

    SHA256

    3ab9a23ef187c68779a4a43e9d609e624ae21215386d8f8ec911407772c33b1b

    SHA512

    04ebfd4fdfa716edf20fa73ef6d066db3c76e253225ca0ca6bbf690ce764a801fb8092eccc19fefb0204f82dcc8f040b2bad76142b50b2de199f789517828492

  • /data/user/0/com.golestanec.modiseh/files/.Fabric/com.crashlytics.sdk.android:answers/session_analytics.tap
    Filesize

    859B

    MD5

    c37805de0747b9df712c000c8f01af21

    SHA1

    0ca87d2b1f5be4b77da935f33942d8d91489411c

    SHA256

    da8135304b6b64faf385e9d6b900daf8efb4fed8edbf6e17e7fabef384ed0a62

    SHA512

    c739d0515b8ab448bae0274977d7037c7720b526a95dfd605bb6ee4af249886003b85659d4f42e7973b62a379b68b1e89b00ccad9f21e9885c930324d97663c2

  • /data/user/0/com.golestanec.modiseh/files/.Fabric/com.crashlytics.sdk.android:answers/session_analytics.tap.tmp
    Filesize

    16B

    MD5

    c33583fae4e0b61cde1c5b9227963237

    SHA1

    fe2ebe4d27469af1460f7e852031a04208ef629b

    SHA256

    35c6d6e5b93657e4a741a1cec71c21813fe05aab219909ebbb0f62fb0ae648dc

    SHA512

    fa09047004bec791b23f0dade0b64f8ab9bbd67555505e0d0818f6e89dfe56f474df80db0786d081d36adf23a5bacea40275ba043444a3a85d3d9612575bdd1e

  • /data/user/0/com.golestanec.modiseh/files/.Fabric/com.crashlytics.sdk.android:answers/session_analytics_to_send/sa_7bb69271-8627-46af-bbc3-35c2b525c952_1716381954701.tap
    Filesize

    326B

    MD5

    1c47ddef908fd281d3878304147b3ad3

    SHA1

    548daff821efa33c1a9893b155ac6a20c48a0156

    SHA256

    39809a96168cd856a223bb9bf28586dd6ade1fca3f6b8107fc862a7c6ce6f5ed

    SHA512

    3f70178af183126508e8e7fc29a2b2d3eeb4e26605dffcf1fa42a2cabf817e9c98c43c72dd1da44387aa835dede8f4c754af982c94a1580ccdaf239e69f3f1ce

  • /data/user/0/com.golestanec.modiseh/files/PersistedInstallation1362232341938842405tmp
    Filesize

    90B

    MD5

    dd01291047f4a4763ed1cd1051826707

    SHA1

    cd86f2acfdeae99b43077a5ed64b8a3552743dcc

    SHA256

    c8b7593a06c2193f6c4c44972216b3f6d23bb170666f732638d470d7cc8c776e

    SHA512

    7ec8c6467149bb9ff666135ef4f9384f1dd499f6164f9d5d46365ae44737c765ff42a8051ce0698ccefdfbfcec6d3784b2c020dab97f97e318d1495b24451734

  • /data/user/0/com.golestanec.modiseh/files/PersistedInstallation7713910531117946238tmp
    Filesize

    562B

    MD5

    35b83a1e691c8dfe9cd3f1488a1ffdc7

    SHA1

    643ee0e029234a99ffb6eaebee81c63c8ffd64c4

    SHA256

    47c954b94cf0af9a3822729076b02af16ebc8acb467851c28aae4ef1411ab29e

    SHA512

    a6017ac780558d04c3c175d0a923b43bcdd7f679209b0fe4d9ac24a9a658a6e8e00162f6c1ba0dc36844c183b93b9100a675a2e92d6646549e7646d784789654

  • /data/user/0/com.golestanec.modiseh/files/UserProfile.json
    Filesize

    2B

    MD5

    99914b932bd37a50b983c5e7c90ae93b

    SHA1

    bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

    SHA256

    44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

    SHA512

    27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

  • /data/user/0/com.golestanec.modiseh/files/headerObject.json
    Filesize

    23B

    MD5

    612b2def1cc7be077923a20ce80ecfbd

    SHA1

    b3544521e8a028834cd6705a50b642b66df00e00

    SHA256

    c125685c371cb6a67e924f97c98657cd1966e660d6ca8d072be70f812f6e0cd4

    SHA512

    bf0564ddfe01faceb5a5f4a95a7282483cd56ad604300674d80faa28adb4cb603a55bf995b6473af55fb27a7fa9aba492f8f4991f3bf8e7df52cf5cada6a0ab5