Analysis
-
max time kernel
176s -
max time network
130s -
platform
android_x86 -
resource
android-x86-arm-20240514-en -
resource tags
androidarch:armarch:x86image:android-x86-arm-20240514-enlocale:en-usos:android-9-x86system -
submitted
24-05-2024 12:36
Static task
static1
Behavioral task
behavioral1
Sample
daa8d41db8b17c2a107d17fe15cd5a310142bf8c62d6177bffdecefcd7522765.apk
Resource
android-x86-arm-20240514-en
Behavioral task
behavioral2
Sample
daa8d41db8b17c2a107d17fe15cd5a310142bf8c62d6177bffdecefcd7522765.apk
Resource
android-x64-20240514-en
Behavioral task
behavioral3
Sample
daa8d41db8b17c2a107d17fe15cd5a310142bf8c62d6177bffdecefcd7522765.apk
Resource
android-x64-arm64-20240514-en
General
-
Target
daa8d41db8b17c2a107d17fe15cd5a310142bf8c62d6177bffdecefcd7522765.apk
-
Size
1.9MB
-
MD5
1cdadc772cf659725cb2f8a2bb9a9d89
-
SHA1
69dd08febb44efe9c0d2393e4f6cbce131bc0c35
-
SHA256
daa8d41db8b17c2a107d17fe15cd5a310142bf8c62d6177bffdecefcd7522765
-
SHA512
3a2cce05c3dbe24be404976092ce99ff7596a0566cc4fb311d97b1b5062c4aeb3cbe088b08eab85eddb5c1f1b2a415cac3d581405adb20d24671b4acc9dc7f57
-
SSDEEP
24576:Qok/Boh8Y78QDuqTWqRQ4kQQOVa6ox7nPWgYJWrwkc7OhpMjg4OFgiWV7r+tmX9W:Qokpoh8Qr/TRxC8YMJ0VrOpLh+tmUeS
Malware Config
Signatures
-
Checks memory information 2 TTPs 1 IoCs
Checks memory information which indicate if the system is an emulator.
-
Loads dropped Dex/Jar 1 TTPs 2 IoCs
Runs executable file dropped to the device during analysis.
Processes:
/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/quasar.bistrocook/files/bdbfefb6.dex --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/quasar.bistrocook/files/oat/x86/bdbfefb6.odex --compiler-filter=quicken --class-loader-context=&quasar.bistrocookioc pid process /data/user/0/quasar.bistrocook/files/bdbfefb6.dex 4457 /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/quasar.bistrocook/files/bdbfefb6.dex --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/quasar.bistrocook/files/oat/x86/bdbfefb6.odex --compiler-filter=quicken --class-loader-context=& /data/user/0/quasar.bistrocook/files/bdbfefb6.dex 4392 quasar.bistrocook -
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
Processes:
quasar.bistrocookdescription ioc process Framework service call com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone quasar.bistrocook -
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
Processes:
quasar.bistrocookdescription ioc process Framework service call android.app.IActivityManager.registerReceiver quasar.bistrocook -
Acquires the wake lock 1 IoCs
Processes:
quasar.bistrocookdescription ioc process Framework service call android.os.IPowerManager.acquireWakeLock quasar.bistrocook -
Checks if the internet connection is available 1 TTPs 1 IoCs
Processes:
quasar.bistrocookdescription ioc process Framework service call android.net.IConnectivityManager.getActiveNetworkInfo quasar.bistrocook
Processes
-
quasar.bistrocook1⤵
- Checks memory information
- Loads dropped Dex/Jar
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Acquires the wake lock
- Checks if the internet connection is available
-
/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/quasar.bistrocook/files/bdbfefb6.dex --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/quasar.bistrocook/files/oat/x86/bdbfefb6.odex --compiler-filter=quicken --class-loader-context=&2⤵
- Loads dropped Dex/Jar
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
/data/data/quasar.bistrocook/files/BGEaUZrYFilesize
724B
MD57266bfeacf1bff945d158ece87bd34cf
SHA1fdf84d34343a323c4cfe127c3d84c849004c0442
SHA25646951401e36fbe078a90d81ffb28369499adf54490d9f288ac95d1dc74ed6ddf
SHA512a341533638953cfd03a8f2d93d5064748defa816c0a16bc10022cadadb0a86c15b11866165f69ad60234602d0cc6a8ef7b9053fb9aa7a012bfb923a40795b630
-
/data/data/quasar.bistrocook/files/BGEaUZrYFilesize
470B
MD5927e7f9b9f8a51c251286d48569c7932
SHA14d388db0838ccdb83f0380ee7e18c9772862e91c
SHA256608e20d587371fc897a5e542d1a6a43bf4c76d80576d8e6e023e70add325211d
SHA51296b08dc4c8594c7f5b7efbf1be5387892b2a52a4dbd8b8edc6b5e4a47866ce03324764c876865070f803997ae3344b08af069f59e61df3d5341837d1e0046afe
-
/data/data/quasar.bistrocook/files/TrPJFdsNFilesize
336B
MD5134ae7f86715ffcf627cf20eb02319e8
SHA1a40563ea5533d152c964ab3a9e353ba1995f32dc
SHA256ab6fa29f3270ca1f44c82f3e1fa1bd7c7de25ed55b1fd258a6283261831bcb7a
SHA5123eaa5409c1bc1158a4622f3f9e35a06734d6cdfc6159392493002e7ad0a497bcb3af455c902dc9da469935ae3f8ce53cd30d2d30d293911e0ebb26af0d52d831
-
/data/data/quasar.bistrocook/files/TrPJFdsNFilesize
336B
MD5377dbf936cbfa46f866f06f7a8898ee6
SHA1fcb02a23dc8f4b5cfd4ddede0b333762eddaacf9
SHA2567be291719b9c992055a91913aea0d91bf4961870550e732b6403797cf3798ae4
SHA512a6a53bbd444068dc97692dd25e60321466d9c9317656ac724e18f2635dfff0369cddcdba111de044086d5012ecc304c96cb1e0292fe1dd46b115b3c752485b6f
-
/data/data/quasar.bistrocook/files/TrPJFdsNFilesize
336B
MD51d4b69c0a991afe9dd113fe5a358f683
SHA1119bbfb5f2ee6bd1021c83bfa6dce5248d4e4b76
SHA256853c1e7d323a96f9a6f134b3ae8d1993396bcda614304793332df5a287faf712
SHA5122ef4398f0e29e7cb726236b8b404cf20d98f2407afc5eec6460d41379f4549406c75edfff6e1d95b73f1984200d68f901e57104d7bf9e1a5be922ad2b6f8264c
-
/data/data/quasar.bistrocook/files/bdbfefb6.dexFilesize
261KB
MD541b8243edb9b9dde73ab207644e7e53b
SHA1675de278447f6b585eba1db7460e599a30596d46
SHA25614df0943e0c93d98b078e8bb6557ad887781f0337e54250184a8df5ff22e61ea
SHA5129e86bfd169cc48e2b0a917884d38ed79bc0975420effaf336f1255cd61349b02a78a601e23722a7b2178578a73a23d8881872cbe619b6d58e84b48a43955117e
-
/data/data/quasar.bistrocook/no_backup/com.google.InstanceId.propertiesFilesize
2KB
MD59ac0e6998af36cec6c473417b8fd77d8
SHA13acff80c4357249ad05d024ed484568d1a55b026
SHA2567bf2334bc1ef47e4a36a2d1f697ce0325460ebacd8ce3b05e11503b5556e29d8
SHA512676fbb57e35ea0bc6e8831e2074897d1c4d19099eb556cebbcc096df7032de1b0c5d38bd27da8b820137410091ad27fec17164cea5b017af41a8494d19557a1c
-
/data/user/0/quasar.bistrocook/files/bdbfefb6.dexFilesize
614KB
MD52c7772a4236490f59e7f642a7a3a4cd4
SHA12e2bfb350a98af968a284a971751abaf99678d9f
SHA2563a79a298753fce30d4a773d80e4ecba6a90149d201aaaba56ea0edba3be541a6
SHA5121ac26087b78da22a346597bd86b9a1cffa467c3f90aa0e22e9fc2528e7bfeaee48f4cf16a4a364053125da851d347613afcff78277dbc2752aaba52be9f67e89