Analysis
- max time kernel
5s - max time network
161s - platform
android_x64 - resource
android-x64-arm64-20240603-en - resource tags
androidarch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20240603-enlocale:en-usos:android-11-x64system - submitted
03/06/2024, 15:01
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
890814e53dca788e353433be8f1d28c2.apk
Resource
android-x86-arm-20240603-en
android-9-x86
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
890814e53dca788e353433be8f1d28c2.apk
Resource
android-x64-20240603-en
android-10-x64
0 signatures
150 seconds
Behavioral task
behavioral3
Sample
890814e53dca788e353433be8f1d28c2.apk
Resource
android-x64-arm64-20240603-en
android-11-x64
2 signatures
150 seconds
Behavioral task
behavioral4
Sample
asd.apk
Resource
android-x86-arm-20240603-en
android-9-x86
10 signatures
150 seconds
Behavioral task
behavioral5
Sample
asd.apk
Resource
android-x64-20240603-en
android-10-x64
7 signatures
150 seconds
Behavioral task
behavioral6
Sample
asd.apk
Resource
android-x64-arm64-20240603-en
android-11-x64
7 signatures
150 seconds
Behavioral task
behavioral7
Sample
base.apk
Resource
android-x86-arm-20240603-en
android-9-x86
4 signatures
150 seconds
Behavioral task
behavioral8
Sample
base.apk
Resource
android-x64-20240603-en
android-10-x64
3 signatures
150 seconds
General
- Target 890814e53dca788e353433be8f1d28c2.apk
- Size 9.1MB
- Sample240603-seb9jsac7x
- SHA256 8c636cf0b0e28fd5af9f394dbfcc0037ace5e351736eb3dbbb7505609aff56b9
- MD5 890814e53dca788e353433be8f1d28c2
- SHA1 1201511ffd20cb07cdcc5c43b8d78596119f5b2c
- SHA512 f976911db54eff8c3b16954b34fc425e5f0909b3fc34080ff5ffc9ad45fc0f0744faebdde80d7ebea53f1dfbb0e68de41116473fd2d44cb395ae960b6c18328a
- SSDEEP 196608:GKFspWqSLS4eRvdIe14LPvhmv2Df+b/NtinMMhXfojKjZbyPvSKf01/:VONceRlIeqLPvwRbFsgnDG/
- MD5 SHA1 SHA512 SSDEEP
Score
8/10
Malware Config
Signatures
- Checks if the Android device is rooted. 1 TTPs 9 IoCs
ioc Process /system/app/Superuser.apk com.dsusyewichvewi23hjiue.app /system/bin/failsafe/su com.dsusyewichvewi23hjiue.app /data/local/su com.dsusyewichvewi23hjiue.app /sbin/su com.dsusyewichvewi23hjiue.app /system/bin/su com.dsusyewichvewi23hjiue.app /system/xbin/su com.dsusyewichvewi23hjiue.app /data/local/xbin/su com.dsusyewichvewi23hjiue.app /data/local/bin/su com.dsusyewichvewi23hjiue.app /system/sd/xbin/su com.dsusyewichvewi23hjiue.app - Loads dropped Dex/Jar 1 TTPs 22 IoCs
Runs executable file dropped to the device during analysis.
ioc pid Process /data/user/0/com.dsusyewichvewi23hjiue.app/app_gddv.s0e.bfk6.fki/obfs/0.obfedex 4546 com.dsusyewichvewi23hjiue.app /data/user/0/com.dsusyewichvewi23hjiue.app/app_gddv.s0e.bfk6.fki/obfs/0.obfedex 4546 com.dsusyewichvewi23hjiue.app /data/user/0/com.dsusyewichvewi23hjiue.app/app_gddv.s0e.bfk6.fki/obfs/1.obfedex 4546 com.dsusyewichvewi23hjiue.app /data/user/0/com.dsusyewichvewi23hjiue.app/app_gddv.s0e.bfk6.fki/obfs/1.obfedex 4546 com.dsusyewichvewi23hjiue.app /data/user/0/com.dsusyewichvewi23hjiue.app/app_gddv.s0e.bfk6.fki/obfs/2.obfedex 4546 com.dsusyewichvewi23hjiue.app /data/user/0/com.dsusyewichvewi23hjiue.app/app_gddv.s0e.bfk6.fki/obfs/2.obfedex 4546 com.dsusyewichvewi23hjiue.app /data/user/0/com.dsusyewichvewi23hjiue.app/app_gddv.s0e.bfk6.fki/obfs/3.obfedex 4546 com.dsusyewichvewi23hjiue.app /data/user/0/com.dsusyewichvewi23hjiue.app/app_gddv.s0e.bfk6.fki/obfs/3.obfedex 4546 com.dsusyewichvewi23hjiue.app /data/user/0/com.dsusyewichvewi23hjiue.app/app_gddv.s0e.bfk6.fki/obfs/4.obfedex 4546 com.dsusyewichvewi23hjiue.app /data/user/0/com.dsusyewichvewi23hjiue.app/app_gddv.s0e.bfk6.fki/obfs/4.obfedex 4546 com.dsusyewichvewi23hjiue.app /data/user/0/com.dsusyewichvewi23hjiue.app/app_gddv.s0e.bfk6.fki/obfs/5.obfedex 4546 com.dsusyewichvewi23hjiue.app /data/user/0/com.dsusyewichvewi23hjiue.app/app_gddv.s0e.bfk6.fki/obfs/5.obfedex 4546 com.dsusyewichvewi23hjiue.app /data/user/0/com.dsusyewichvewi23hjiue.app/app_gddv.s0e.bfk6.fki/obfs/6.obfedex 4546 com.dsusyewichvewi23hjiue.app /data/user/0/com.dsusyewichvewi23hjiue.app/app_gddv.s0e.bfk6.fki/obfs/6.obfedex 4546 com.dsusyewichvewi23hjiue.app /data/user/0/com.dsusyewichvewi23hjiue.app/app_gddv.s0e.bfk6.fki/obfs/7.obfedex 4546 com.dsusyewichvewi23hjiue.app /data/user/0/com.dsusyewichvewi23hjiue.app/app_gddv.s0e.bfk6.fki/obfs/7.obfedex 4546 com.dsusyewichvewi23hjiue.app /data/user/0/com.dsusyewichvewi23hjiue.app/app_gddv.s0e.bfk6.fki/obfs/8.obfedex 4546 com.dsusyewichvewi23hjiue.app /data/user/0/com.dsusyewichvewi23hjiue.app/app_gddv.s0e.bfk6.fki/obfs/8.obfedex 4546 com.dsusyewichvewi23hjiue.app /data/user/0/com.dsusyewichvewi23hjiue.app/app_gddv.s0e.bfk6.fki/obfs/9.obfedex 4546 com.dsusyewichvewi23hjiue.app /data/user/0/com.dsusyewichvewi23hjiue.app/app_gddv.s0e.bfk6.fki/obfs/9.obfedex 4546 com.dsusyewichvewi23hjiue.app /data/user/0/com.dsusyewichvewi23hjiue.app/app_gddv.s0e.bfk6.fki/obfs/10.obfedex 4546 com.dsusyewichvewi23hjiue.app /data/user/0/com.dsusyewichvewi23hjiue.app/app_gddv.s0e.bfk6.fki/obfs/10.obfedex 4546 com.dsusyewichvewi23hjiue.app
Processes
Network
MITRE ATT&CK Mobile v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path /data/user/0/com.dsusyewichvewi23hjiue.app/app_gddv.s0e.bfk6.fki/obfs/0.obfedex
- Size 321KB
- SHA256 02fef677b8afe4fd1e6931ee5f89a380ecce90a14d7fd89bb8a8d9c264b8e64f
- MD5 1470d96a3d611ac95e5e54e7a56a108c
- SHA1 2e1bac968a06b3504b8b66dbccece2eb95c90e7b
- SHA512 75c87e6c775f363540e861bd7ec7f2e14f396b2d3e43a6705864842fc05dd94bc1b8b33b0d181a965e4e927015d4f68656b18b04a7ab90c67760f6ae7968494a
- SSDEEP 3072:7O90jEL1nv2cM65aQSjJW5t3u6/KXwcWGtYYGvF5w6zObkajXslMdbYFJ/Dbs29d:7BwZnuXsCeF5+oajdg/H9tpodEKDu
- MD5 SHA1 SHA512 SSDEEP
- Path /data/user/0/com.dsusyewichvewi23hjiue.app/app_gddv.s0e.bfk6.fki/obfs/1.obfedex
- Size 176KB
- SHA256 67bf6d7b10000e74f7ecbfd568c5f66931d1fe43eb20cd31a11d0dad3aaf800e
- MD5 2ae32fc38a1cb24942abbc23b42c5212
- SHA1 93665aa33fd02d3f4c636bcf23c98652d78692c7
- SHA512 5d2d6239922f1629922b03e5fd5d9de327fd34094e47315c37c744bb50700796384a8baf1fd773e38334ed5f0ac9df271135aefed04b95236a27207500b187ee
- SSDEEP 3072:HBKqu4KO9mSYxLNaGPh8BrnhACSJIUY+zZRFG8qflxXj+Gq5HOXF7nSu2H1:gOKLNaGJc2CSaUYfxSEB72H1
- MD5 SHA1 SHA512 SSDEEP
- Path /data/user/0/com.dsusyewichvewi23hjiue.app/app_gddv.s0e.bfk6.fki/obfs/10.obfedex
- Size 118KB
- SHA256 b6121823b1137d0370b554597df0b913a8b57f164dfdecc1eec25f51bfa1b6f9
- MD5 94438bf35669c283c19346bc535e536a
- SHA1 995e6e7b0754f879c1bcf9782f5522ba6ac53d69
- SHA512 d42e771b7be0ccfae97bd79a669ef7376b31469f62ae5cd5320b2ae93ee2216b37b0ab68d7e0e1b28e1764db3b8a842561844c6201f0da9b729a0aeab906f8d1
- SSDEEP 1536:WSrKqvN86wAG0WPU+6/19KCh1+ruHdZXobxI4V5Ko1mi+uROgQ3OTs5S1b2YdCO0:S7yt9KC7+ruHdZXo1I416OTH1lP61BBP
- MD5 SHA1 SHA512 SSDEEP
- Path /data/user/0/com.dsusyewichvewi23hjiue.app/app_gddv.s0e.bfk6.fki/obfs/2.obfedex
- Size 76KB
- SHA256 3805fb8485413417c707f4e033f2ae87d6687f776a75c9a3e4059ea91aaec34a
- MD5 0b2c87ce455c65cb3a5f9fa9317a47d2
- SHA1 0eeac5eda13c6a1634a792f02568fef37425961f
- SHA512 34e9df25e2182e744f83d4e7b8bbb2bd7e27a6060f6f73558bac702400ad90872c2d088f01e03e615080ae83b3fa4fe3bfc61896064cf35ca30a4247a4138cd3
- SSDEEP 1536:MMRqZMfxZ5tw4dZ2H3zfuVWVHZ4eIbY1t:9QkZ5C4dZ2HjzUbYv
- MD5 SHA1 SHA512 SSDEEP
- Path /data/user/0/com.dsusyewichvewi23hjiue.app/app_gddv.s0e.bfk6.fki/obfs/3.obfedex
- Size 166KB
- SHA256 fb59b91b510d896e0e14097cfb8aca2d1e384f758490fbe75cf1ad30927170bd
- MD5 3b2b5be999feba267cbec00711b19972
- SHA1 b6d7b1a781984f6ead4519be4a50b2aaa29aae14
- SHA512 156d7a7de6d7ee9a5fe652becbfc18c7d0387d437bfaf3f414bbe3925e78dc3a41ce68847b238cc9e89b2a7c6420c61398bc6e4a1f5971052e04c617860e3f54
- SSDEEP 3072:GlaCBMnI1znZ3n1+9F+ky4owKtVWGqNoef0EFaajhJLJoG:DC6GzZeF+kydtAos0EFaatPj
- MD5 SHA1 SHA512 SSDEEP
- Path /data/user/0/com.dsusyewichvewi23hjiue.app/app_gddv.s0e.bfk6.fki/obfs/4.obfedex
- Size 308KB
- SHA256 6d4b6bac1b0b6a9e895bc1fb946973c8009f8a2789d43ad00cb1573fbfa87f91
- MD5 482d1a53ba966dbb4ebb9a34a5a3859e
- SHA1 41ae5706ec623274fa486c39581152c5bb2470d7
- SHA512 4dea49530e32a90f7f1c134857f4502bfd10dcdc93cb6fedd4e6dcdaaa27b81d7f272dc2316b6f5e0ab5f5a2446383b84f20959be26cbe78d89c90d261fba7c7
- SSDEEP 6144:cWr9+JjD/AroZarsbidaYn1HWMQb+j2LVQY4M4xS:f+hzA0ZqWMbaL+jlS
- MD5 SHA1 SHA512 SSDEEP
- Path /data/user/0/com.dsusyewichvewi23hjiue.app/app_gddv.s0e.bfk6.fki/obfs/5.obfedex
- Size 248KB
- SHA256 f86bdd736110beab11a7b6e5080dad33345a124e3227ae3f814711faf8d22aa3
- MD5 2e26021f01a4ab9b531450f346285e67
- SHA1 f1b1bfcc122f62025fc6661f9a18e069267cb625
- SHA512 b91bad41faf900e461e643c5f21bcdb4efc9712f087836343c1e64a210b864138ef5e375693b09a5f959700ec3c134211b4f2ddf41589929a0b27e78f46b9d4b
- SSDEEP 6144:yiZVAxxjXCa9T6Jm598CutOkcZtP7cEzgIE/nXC2oZBf:yiHmx7vLg3oZBf
- MD5 SHA1 SHA512 SSDEEP
- Path /data/user/0/com.dsusyewichvewi23hjiue.app/app_gddv.s0e.bfk6.fki/obfs/6.obfedex
- Size 129KB
- SHA256 089596d9dfb76e8264a126ba8f780fcbad4f42bb2ed356bc0c6286c47eea5c60
- MD5 560aa4a8a6d197ac25b3635fff3cc5e2
- SHA1 271cb7249da8ae5358e8b138a1c006238d7897ec
- SHA512 f8090380f7fa1d8bb0934b826d846db402de050641fa3a99ccd9398104940feceead757c92133ab14e49a309f6fbdae436a7cf0e0a808289758c386db6eabd69
- SSDEEP 3072:ecKnYs0LrUIiJrbvciDhPy9912XCDD6jlyZi:ZTyPv78rD3k
- MD5 SHA1 SHA512 SSDEEP
- Path /data/user/0/com.dsusyewichvewi23hjiue.app/app_gddv.s0e.bfk6.fki/obfs/7.obfedex
- Size 285KB
- SHA256 67bb969cddd942bef6c8d6914aa08524e642826d479a2d12cdf083bd2d992644
- MD5 487c1ce4b09b9dfe0e41603836a8379b
- SHA1 2342d9e9b0badf0a31790188b8fb20ac6e3f9298
- SHA512 a91c938fa29b5d48d0afbd3550614b7b0d301cbb3ec7c23b03eea8718e1940405803fbebbb13461a57102e256c4b39e2ac48557ad6678c8b2bf03e0e5b19b616
- SSDEEP 6144:WcKa9T6Jm59SyADwtMEG0Zg8P1NdZkI7TNIhNTQWJA:zA+Zb7xIbTZJA
- MD5 SHA1 SHA512 SSDEEP
- Path /data/user/0/com.dsusyewichvewi23hjiue.app/app_gddv.s0e.bfk6.fki/obfs/8.obfedex
- Size 82KB
- SHA256 3d4d7d07ea1b6883322e3b9ebb097160a2f30c2f4f1f21eb7fe89113c44986a3
- MD5 d9afae46ba2d31301e2ce56e4daca3ad
- SHA1 b1ddae4d420829a83f3cae9bd4b453e12747df80
- SHA512 7f965163b4cd01d01bc155d8004086357104030a7b6aad778ad8d2050fa02efe7f389c5f6fdea6dab8cb32013d0a935b2f04c05f3466061b06d61aadf2ca71fd
- SSDEEP 1536:nUzmtOobe1JFvIL9ZQ9yn8VlpaiBT6Yt1JTZ+IFcmECcECnL:UCUomvIL9ZQYrCDt9cmENL
- MD5 SHA1 SHA512 SSDEEP
- Path /data/user/0/com.dsusyewichvewi23hjiue.app/app_gddv.s0e.bfk6.fki/obfs/9.obfedex
- Size 78KB
- SHA256 da9d42c5250890d42208e594be99f9c89f103e0a0c0a54ba22a86464a0710652
- MD5 34cea195056ca413a826b6fd8e655f6e
- SHA1 b74c780d7f215e619ae8e64aad39be38d8ae7676
- SHA512 be7fec30d242770498b1870cd4e606e76af293b31d850392b6373fc81e6789f564c682b8d4ee58696bb5b726af7201a8a5bd85d7c7dfbf34103ac604700b576f
- SSDEEP 1536:mwtsLt56gm9uA5o+6czRoL6h5+WSoQp2VAz6Xacs:mDt56gm4PczRoL6hmYVA+Ps
- MD5 SHA1 SHA512 SSDEEP