Analysis
-
max time kernel
178s -
max time network
169s -
platform
android_x86 -
resource
android-x86-arm-20240514-en -
resource tags
-
submitted
02-06-2024 23:39
General
-
Target
ace89b1fc51ca81200f9bae2a2616f78a129ba1b79ce412061c604165bf415c4.apk
-
Size
703KB
-
MD5
7d23b5c62f8eb4fb5f04a7ffab0c20cf
-
SHA1
dfbfd7eede63dd92feeadb14c567ffe855a001be
-
SHA256
ace89b1fc51ca81200f9bae2a2616f78a129ba1b79ce412061c604165bf415c4
-
SHA512
356462991bd4dcaa4e341e646992d05b73562c22f907c57e73d4cf89356964d64b70260e59ef4d268da767cfaefecee58c6a1df2fe33f5fe4f63ff931875a672
-
SSDEEP
12288:AAPJBOOlHYdxT5JYSmWySvUAW9x7BIhh9EmwOXHz5khHNz4DieHH3:AABBOOFYFJYSmWNsAW7B8h9EmwOD5sNE
Malware Config
Signatures
-
Removes its main activity from the application launcher 1 TTPs 1 IoCs
-
Loads dropped Dex/Jar 1 TTPs 2 IoCs
Runs executable file dropped to the device during analysis.
-
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
-
Queries the phone number (MSISDN for GSM devices) 1 TTPs
-
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
-
Tries to add a device administrator. 2 TTPs 1 IoCs
-
Acquires the wake lock 1 IoCs
-
Checks if the internet connection is available 1 TTPs 1 IoCs
-
Reads information about phone network operator. 1 TTPs
-
Schedules tasks to execute at a specified time 1 TTPs 1 IoCs
Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.
-
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
Processes
-
com.rRIotMAa1⤵
- Removes its main activity from the application launcher
- Loads dropped Dex/Jar
- Makes use of the framework's foreground persistence service
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Tries to add a device administrator.
- Acquires the wake lock
- Checks if the internet connection is available
- Schedules tasks to execute at a specified time
- Uses Crypto APIs (Might try to encrypt user data)
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
/data/data/com.rRIotMAa/b.zipFilesize
203KB
MD5ce03b281ba8fffdbf39e084ede6060c7
SHA1b6d9fd2dc5250103343bc560c4c967bedc212b03
SHA256de93038ba0c8daca1eb00f8d1d8b9c23c3aec291ac814720d5e3d4d094f03b1a
SHA5126d94d391735dde10f3fd2d7f104abcf55fe18c76571c6f6fee2ba4cb7672bbcd2f78742e59f39369f02a05c2b41b72b1a24701414448b59c5504dfcd2c1b143c
-
/data/data/com.rRIotMAa/files/configFilesize
76B
MD5ba8013e3fa425ebbc87dbc26a4254f45
SHA13b59613cdca1d38c97d87248b51c4660217feed8
SHA25665c369c6b2ed22be3a7761e16bcee677b872ac03b154778c26c26bf12c60de30
SHA512be34891129fb4352bc461d5e7aa57b81f96138d52b99811789aeb8dec20bd23168745c466ab5551eaeaacbef6d3d1960e4f597133d0a4d96cf3e2a59459a603e