c205749c0845e58842eb4f7c851741215bb4ca886b4af6ee6776e48ad8ffd129

Analysis

max time kernel
4s
max time network
131s
platform
android_x86
resource
android-x86-arm-20240514-en
resource tags

androidarch:armarch:x86image:android-x86-arm-20240514-enlocale:en-usos:android-9-x86system
submitted
23-05-2024 22:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c205749c0845e58842eb4f7c851741215bb4ca886b4af6ee6776e48ad8ffd129.apk
Size

860KB
MD5

4698cf50175befa88bf69de3e9d8fbee
SHA1

d56774a07e76102e347ebe18868dca9ce3ca9910
SHA256

c205749c0845e58842eb4f7c851741215bb4ca886b4af6ee6776e48ad8ffd129
SHA512

feb112a56f0335a5007e45f56bc2484dff884173514d093d7c534d22224d129837be7ae5efa5d016ca22e6fd93d722dde1c92101ce122c05f85c7d5b3a8ae9c6
SSDEEP

24576:ALXbSiBU23fon4mEB4eX64vv08xIK7LQhc+cxk:APSi4mX6430GT7ecq

Score

7^/10

evasion execution persistence

Malware Config

Signatures

Loads dropped Dex/Jar 1 TTPs 3 IoCs

Runs executable file dropped to the device during analysis.

evasion

T1407

Processes:

com.indicate.ordinary/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.indicate.ordinary/app_mph_dex/classes.dex --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/com.indicate.ordinary/app_mph_dex/oat/x86/classes.odex --compiler-filter=quicken --class-loader-context=&

ioc	pid	process
/data/user/0/com.indicate.ordinary/app_mph_dex/classes.dex	4219	com.indicate.ordinary
/data/user/0/com.indicate.ordinary/app_mph_dex/classes.dex	4244	/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.indicate.ordinary/app_mph_dex/classes.dex --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/com.indicate.ordinary/app_mph_dex/oat/x86/classes.odex --compiler-filter=quicken --class-loader-context=&
/data/user/0/com.indicate.ordinary/app_mph_dex/classes.dex	4219	com.indicate.ordinary

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
persistence

T1624.001

Processes:

com.indicate.ordinary

description ioc process

Framework service call android.app.IActivityManager.registerReceiver com.indicate.ordinary
Schedules tasks to execute at a specified time 1 TTPs 1 IoCs
Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.
execution persistence

T1603

Processes:

com.indicate.ordinary

description ioc process

Framework service call android.app.job.IJobScheduler.schedule com.indicate.ordinary

description	ioc	process
Framework service call	android.app.IActivityManager.registerReceiver	com.indicate.ordinary

description	ioc	process
Framework service call	android.app.job.IJobScheduler.schedule	com.indicate.ordinary

com.indicate.ordinary
1⤵
- Loads dropped Dex/Jar
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Schedules tasks to execute at a specified time
PID:4219

/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.indicate.ordinary/app_mph_dex/classes.dex --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/com.indicate.ordinary/app_mph_dex/oat/x86/classes.odex --compiler-filter=quicken --class-loader-context=&
2⤵
- Loads dropped Dex/Jar
PID:4244

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.indicate.ordinary/app_mph_dex/classes.dex
Filesize
929KB

MD5
7f99011707bc55532dfb82caf0df1b11

SHA1
0e46b591ca58a647f4bf2a184e38f97f5e13902b

SHA256
1857313577c3a52f565f007d3ebf2655b7ad50c9bdf73f77e59b07033c0c52bb

SHA512
45bc44c0f402335493de5b1a6739ffb3fc507d5d1bc0bd0d6a94e850c6624432553aeae9dc0e64081d92e3b8e1f693704169836b6af88e0a8f15370aa1f67809

Download Submit
/data/user/0/com.indicate.ordinary/app_mph_dex/classes.dex
Filesize
929KB

MD5
e1708bb00b3bfd6296e256f875a3bbef

SHA1
b43ac8ed49ff0ecc004acbc247e4a0f54ff39a06

SHA256
3800dc54ec15879b597e1482fe23090fb8e397fe573dadffc78b9493236d1085

SHA512
8503cbb5322e2b5a8217229b7cc9e82604700fe4b2e9bfe24a917a477a7e1682b5e98fb3ca53e561776abaa386d3398a0a76e1c404a71aa30c2c33330eb7b46a

Download Submit