Analysis

  • max time kernel
    50s
  • max time network
    189s
  • platform
    android_x64
  • resource
    android-x64-20240603-en
  • resource tags

    androidarch:x64arch:x86image:android-x64-20240603-enlocale:en-usos:android-10-x64system
  • submitted
    03/06/2024, 15:01

General

  • Target
    asd.apk
  • Size 6.4MB
  • Sample240603-seb9jsac7x
  • SHA256 97b88089fa97505c27fe86ab3ee1ff2e04863585cdb29b7f5dcbf07b9753b471
  • MD5 SHA1 SHA512 SSDEEP

Malware Config

Signatures

  • Loads dropped Dex/Jar 1 TTPs 64 IoCs

    Runs executable file dropped to the device during analysis.

  • Makes use of the framework's foreground persistence service 1 TTPs 2 IoCs

    Application may abuse the framework's foreground service to continue running in the foreground.

  • Queries information about running processes on the device 1 TTPs 3 IoCs

    Application may abuse the framework's APIs to collect information about running processes on the device.

  • Queries the phone number (MSISDN for GSM devices) 1 TTPs
  • Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
  • Checks if the internet connection is available 1 TTPs 1 IoCs
  • Schedules tasks to execute at a specified time 1 TTPs 1 IoCs

    Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.

Processes

  • com.dsblsjkhcuiewjkcwe23jhiuew.security
    1⤵
    • Loads dropped Dex/Jar
    • Makes use of the framework's foreground persistence service
    • Queries information about running processes on the device
    • Registers a broadcast receiver at runtime (usually for listening for system events)
    • Checks if the internet connection is available
    • Schedules tasks to execute at a specified time
    PID:5023
  • com.dsblsjkhcuiewjkcwe23jhiuew.security:remote
    1⤵
    • Queries information about running processes on the device
    PID:5085
  • com.dsblsjkhcuiewjkcwe23jhiuew.security:acc
    1⤵
    • Makes use of the framework's foreground persistence service
    • Queries information about running processes on the device
    PID:5245

Network

        MITRE ATT&CK Mobile v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        0.obfedex

        • Path /data/data/com.dsblsjkhcuiewjkcwe23jhiuew.security/app_com.dsblsjkhcuiewjkcwe23jhiuew.security.apps.BaseApplication/obfs/0.obfedex
        • Size 401KB
        • SHA256 5b89cb4af4a2e52e50ea7b80845359ba9290c3061bea32faca257194264829c3
        • MD5 SHA1 SHA512 SSDEEP

        1.obfedex

        • Path /data/data/com.dsblsjkhcuiewjkcwe23jhiuew.security/app_com.dsblsjkhcuiewjkcwe23jhiuew.security.apps.BaseApplication/obfs/1.obfedex
        • Size 203KB
        • SHA256 316d388e538ab2df65b1517f668aa246a7a81dcedff8f827132ee4075c89150f
        • MD5 SHA1 SHA512 SSDEEP

        10.obfedex

        • Path /data/data/com.dsblsjkhcuiewjkcwe23jhiuew.security/app_com.dsblsjkhcuiewjkcwe23jhiuew.security.apps.BaseApplication/obfs/10.obfedex
        • Size 36KB
        • SHA256 a3e569f0185bdbf7c1e1ca346a1e507e117c448cb94cdab1250d74892caee707
        • MD5 SHA1 SHA512 SSDEEP

        11.obfedex

        • Path /data/data/com.dsblsjkhcuiewjkcwe23jhiuew.security/app_com.dsblsjkhcuiewjkcwe23jhiuew.security.apps.BaseApplication/obfs/11.obfedex
        • Size 341KB
        • SHA256 2c005109c5758780dfcdf91d16c70364725695bb8a0f32ce7f465fff40273316
        • MD5 SHA1 SHA512 SSDEEP

        12.obfedex

        • Path /data/data/com.dsblsjkhcuiewjkcwe23jhiuew.security/app_com.dsblsjkhcuiewjkcwe23jhiuew.security.apps.BaseApplication/obfs/12.obfedex
        • Size 44KB
        • SHA256 4b76ca1986bc549b5366fd21ccdfd193a097197cc760d76f1ce948e38cd430e5
        • MD5 SHA1 SHA512 SSDEEP

        13.obfedex

        • Path /data/data/com.dsblsjkhcuiewjkcwe23jhiuew.security/app_com.dsblsjkhcuiewjkcwe23jhiuew.security.apps.BaseApplication/obfs/13.obfedex
        • Size 22KB
        • SHA256 737920f691f68082ca5bebd3d990806e57dbdac6f3f0a2b8b712f838269c5949
        • MD5 SHA1 SHA512 SSDEEP

        14.obfedex

        • Path /data/data/com.dsblsjkhcuiewjkcwe23jhiuew.security/app_com.dsblsjkhcuiewjkcwe23jhiuew.security.apps.BaseApplication/obfs/14.obfedex
        • Size 29KB
        • SHA256 29f3f9ec4c651e4a23f3f9c79b1122befdb54d8fa3e040e84a25eb6a80b70ef5
        • MD5 SHA1 SHA512 SSDEEP

        15.obfedex

        • Path /data/data/com.dsblsjkhcuiewjkcwe23jhiuew.security/app_com.dsblsjkhcuiewjkcwe23jhiuew.security.apps.BaseApplication/obfs/15.obfedex
        • Size 17KB
        • SHA256 93ada3ee03bb6ad02fc6bff2757bb31c2a9a48f7faad5edfbf2b6058abecb862
        • MD5 SHA1 SHA512 SSDEEP

        16.obfedex

        • Path /data/data/com.dsblsjkhcuiewjkcwe23jhiuew.security/app_com.dsblsjkhcuiewjkcwe23jhiuew.security.apps.BaseApplication/obfs/16.obfedex
        • Size 37KB
        • SHA256 d3e567dec917eb083fe45cfe035f4964df6023bf3351e2a0b60ee4996948ee52
        • MD5 SHA1 SHA512 SSDEEP

        17.obfedex

        • Path /data/data/com.dsblsjkhcuiewjkcwe23jhiuew.security/app_com.dsblsjkhcuiewjkcwe23jhiuew.security.apps.BaseApplication/obfs/17.obfedex
        • Size 17KB
        • SHA256 8dead2c236e5915dcf7c6895e24ff911c26cd32a03398582d7a788ad11d28c41
        • MD5 SHA1 SHA512 SSDEEP

        18.obfedex

        • Path /data/data/com.dsblsjkhcuiewjkcwe23jhiuew.security/app_com.dsblsjkhcuiewjkcwe23jhiuew.security.apps.BaseApplication/obfs/18.obfedex
        • Size 52KB
        • SHA256 e0c5f17875bdbb271db1d4b03d9ea790277f08133b3c3b427cf08039092887c6
        • MD5 SHA1 SHA512 SSDEEP

        19.obfedex

        • Path /data/data/com.dsblsjkhcuiewjkcwe23jhiuew.security/app_com.dsblsjkhcuiewjkcwe23jhiuew.security.apps.BaseApplication/obfs/19.obfedex
        • Size 31KB
        • SHA256 5af216630431c2293c1fb0fc271ec5b0fb94007789b31cac16b0a8ae66a75a87
        • MD5 SHA1 SHA512 SSDEEP

        2.obfedex

        • Path /data/data/com.dsblsjkhcuiewjkcwe23jhiuew.security/app_com.dsblsjkhcuiewjkcwe23jhiuew.security.apps.BaseApplication/obfs/2.obfedex
        • Size 270KB
        • SHA256 978baafa0c424526d00d3e988009ebe7fff611d3c0ae04899498b23f08153594
        • MD5 SHA1 SHA512 SSDEEP

        20.obfedex

        • Path /data/data/com.dsblsjkhcuiewjkcwe23jhiuew.security/app_com.dsblsjkhcuiewjkcwe23jhiuew.security.apps.BaseApplication/obfs/20.obfedex
        • Size 18KB
        • SHA256 1e70d5fdc0adedb84c4cd93e03794355824ca5edda170c4971fa1bf9cba72f11
        • MD5 SHA1 SHA512 SSDEEP

        21.obfedex

        • Path /data/data/com.dsblsjkhcuiewjkcwe23jhiuew.security/app_com.dsblsjkhcuiewjkcwe23jhiuew.security.apps.BaseApplication/obfs/21.obfedex
        • Size 36KB
        • SHA256 e060b196c600df24fa4a196abbbc8f9f1e7046c2aa945da4c2d48b9205d4f192
        • MD5 SHA1 SHA512 SSDEEP

        22.obfedex

        • Path /data/data/com.dsblsjkhcuiewjkcwe23jhiuew.security/app_com.dsblsjkhcuiewjkcwe23jhiuew.security.apps.BaseApplication/obfs/22.obfedex
        • Size 187KB
        • SHA256 3cff9ca09fa98997f48cea656e3500c0be5bf8300e52bddc3a0afba547a5bc52
        • MD5 SHA1 SHA512 SSDEEP

        23.obfedex

        • Path /data/data/com.dsblsjkhcuiewjkcwe23jhiuew.security/app_com.dsblsjkhcuiewjkcwe23jhiuew.security.apps.BaseApplication/obfs/23.obfedex
        • Size 15KB
        • SHA256 a0296980d6db2bf4ca1550c05ea4b054be7ac41afde51913e6f8127d7817eca7
        • MD5 SHA1 SHA512 SSDEEP

        24.obfedex

        • Path /data/data/com.dsblsjkhcuiewjkcwe23jhiuew.security/app_com.dsblsjkhcuiewjkcwe23jhiuew.security.apps.BaseApplication/obfs/24.obfedex
        • Size 32KB
        • SHA256 80580981b4b536dff4ceeab8c168e1032cf8ff85c53a20fa58ca3555774d9c90
        • MD5 SHA1 SHA512 SSDEEP

        25.obfedex

        • Path /data/data/com.dsblsjkhcuiewjkcwe23jhiuew.security/app_com.dsblsjkhcuiewjkcwe23jhiuew.security.apps.BaseApplication/obfs/25.obfedex
        • Size 26KB
        • SHA256 3feccd468e3d1e5e3124f3d83c0f15dbcd536a85a2eed284bc4aec1b7c360fc7
        • MD5 SHA1 SHA512 SSDEEP

        26.obfedex

        • Path /data/data/com.dsblsjkhcuiewjkcwe23jhiuew.security/app_com.dsblsjkhcuiewjkcwe23jhiuew.security.apps.BaseApplication/obfs/26.obfedex
        • Size 17KB
        • SHA256 8bb9a98f635f7c78d9c75340c15a3b997bc86974ed79d03e2b018cac9d65dca2
        • MD5 SHA1 SHA512 SSDEEP

        27.obfedex

        • Path /data/data/com.dsblsjkhcuiewjkcwe23jhiuew.security/app_com.dsblsjkhcuiewjkcwe23jhiuew.security.apps.BaseApplication/obfs/27.obfedex
        • Size 19KB
        • SHA256 6e4d8ed2f96668429b23dd4c951689c7740bd038d90393f7175ca8d8dc4e7490
        • MD5 SHA1 SHA512 SSDEEP

        28.obfedex

        • Path /data/data/com.dsblsjkhcuiewjkcwe23jhiuew.security/app_com.dsblsjkhcuiewjkcwe23jhiuew.security.apps.BaseApplication/obfs/28.obfedex
        • Size 31KB
        • SHA256 33bae8306ec07bcdcfb1881948cc257ad78e3ebc7b8561e971c00dd7f70b47a5
        • MD5 SHA1 SHA512 SSDEEP

        29.obfedex

        • Path /data/data/com.dsblsjkhcuiewjkcwe23jhiuew.security/app_com.dsblsjkhcuiewjkcwe23jhiuew.security.apps.BaseApplication/obfs/29.obfedex
        • Size 29KB
        • SHA256 a53d53745566d8661a241620700c0b419cc2ab2ab01fe1448382632dc1234ec5
        • MD5 SHA1 SHA512 SSDEEP

        3.obfedex

        • Path /data/data/com.dsblsjkhcuiewjkcwe23jhiuew.security/app_com.dsblsjkhcuiewjkcwe23jhiuew.security.apps.BaseApplication/obfs/3.obfedex
        • Size 44KB
        • SHA256 c1f17172700851a468987453089864651a504ce5088ff4847aab950ec0ee5d5c
        • MD5 SHA1 SHA512 SSDEEP

        30.obfedex

        • Path /data/data/com.dsblsjkhcuiewjkcwe23jhiuew.security/app_com.dsblsjkhcuiewjkcwe23jhiuew.security.apps.BaseApplication/obfs/30.obfedex
        • Size 171KB
        • SHA256 3d430b8a9af1d261c43d1ff403197b8f614cf0b6caff7cb3819d02debff29ce4
        • MD5 SHA1 SHA512 SSDEEP

        31.obfedex

        • Path /data/data/com.dsblsjkhcuiewjkcwe23jhiuew.security/app_com.dsblsjkhcuiewjkcwe23jhiuew.security.apps.BaseApplication/obfs/31.obfedex
        • Size 314KB
        • SHA256 494d52d41a15265fc80fcd64b66ab1234892bc012bbe1641bc49578312f1c470
        • MD5 SHA1 SHA512 SSDEEP

        32.obfedex

        • Path /data/data/com.dsblsjkhcuiewjkcwe23jhiuew.security/app_com.dsblsjkhcuiewjkcwe23jhiuew.security.apps.BaseApplication/obfs/32.obfedex
        • Size 226KB
        • SHA256 c62eee3e22cd4b79b72ffd43f0b50d6ea4bde6a4e543c9a9809b070d8550536d
        • MD5 SHA1 SHA512 SSDEEP

        33.obfedex

        • Path /data/data/com.dsblsjkhcuiewjkcwe23jhiuew.security/app_com.dsblsjkhcuiewjkcwe23jhiuew.security.apps.BaseApplication/obfs/33.obfedex
        • Size 89KB
        • SHA256 1bb8fa57a82d08a940e587b3d4c03baf2de7b433db5be6da707da3ceca047451
        • MD5 SHA1 SHA512 SSDEEP

        34.obfedex

        • Path /data/data/com.dsblsjkhcuiewjkcwe23jhiuew.security/app_com.dsblsjkhcuiewjkcwe23jhiuew.security.apps.BaseApplication/obfs/34.obfedex
        • Size 248KB
        • SHA256 53f7a1195c333ca57f386710e72f5d8a270a9ff836b64b1cadd8e1d65b7b6546
        • MD5 SHA1 SHA512 SSDEEP

        35.obfedex

        • Path /data/data/com.dsblsjkhcuiewjkcwe23jhiuew.security/app_com.dsblsjkhcuiewjkcwe23jhiuew.security.apps.BaseApplication/obfs/35.obfedex
        • Size 125KB
        • SHA256 d438d8c9b18576e24e779691b9747ab283aa6e2d0fa4628dc968a989e7a13184
        • MD5 SHA1 SHA512 SSDEEP

        36.obfedex

        • Path /data/data/com.dsblsjkhcuiewjkcwe23jhiuew.security/app_com.dsblsjkhcuiewjkcwe23jhiuew.security.apps.BaseApplication/obfs/36.obfedex
        • Size 53KB
        • SHA256 154b1c2ec871b96d385792ee1a97d7e3dba2db922c9d9d51ef97144904008e87
        • MD5 SHA1 SHA512 SSDEEP

        4.obfedex

        • Path /data/data/com.dsblsjkhcuiewjkcwe23jhiuew.security/app_com.dsblsjkhcuiewjkcwe23jhiuew.security.apps.BaseApplication/obfs/4.obfedex
        • Size 63KB
        • SHA256 27676e399dc6338ee08015de7fedb9060a350c55a5b5ce66d6cf678130ed129c
        • MD5 SHA1 SHA512 SSDEEP

        5.obfedex

        • Path /data/data/com.dsblsjkhcuiewjkcwe23jhiuew.security/app_com.dsblsjkhcuiewjkcwe23jhiuew.security.apps.BaseApplication/obfs/5.obfedex
        • Size 96KB
        • SHA256 7f0a06e0a2f5f79101dce6c6c235c170819050ad06fc7b0f03cfd275239c1b40
        • MD5 SHA1 SHA512 SSDEEP

        6.obfedex

        • Path /data/data/com.dsblsjkhcuiewjkcwe23jhiuew.security/app_com.dsblsjkhcuiewjkcwe23jhiuew.security.apps.BaseApplication/obfs/6.obfedex
        • Size 27KB
        • SHA256 b33643b8f9a719a63f0f54c163fd1f9f6a60019f42ef62074c9245ec270c45a0
        • MD5 SHA1 SHA512 SSDEEP

        7.obfedex

        • Path /data/data/com.dsblsjkhcuiewjkcwe23jhiuew.security/app_com.dsblsjkhcuiewjkcwe23jhiuew.security.apps.BaseApplication/obfs/7.obfedex
        • Size 25KB
        • SHA256 e8dbfe3b0534be46703a562ef6554fee6453cd821b7145b085a0d7ce812f209e
        • MD5 SHA1 SHA512 SSDEEP

        8.obfedex

        • Path /data/data/com.dsblsjkhcuiewjkcwe23jhiuew.security/app_com.dsblsjkhcuiewjkcwe23jhiuew.security.apps.BaseApplication/obfs/8.obfedex
        • Size 45KB
        • SHA256 28b86f05d7ff338962ec0bf39e0b197c298c96d80b1d6f0806cd5f146abe2755
        • MD5 SHA1 SHA512 SSDEEP

        9.obfedex

        • Path /data/data/com.dsblsjkhcuiewjkcwe23jhiuew.security/app_com.dsblsjkhcuiewjkcwe23jhiuew.security.apps.BaseApplication/obfs/9.obfedex
        • Size 55KB
        • SHA256 ff5123a6460fe2c71174cd9b064f67f75dfedb814bb01dc0ba7a380155de4910
        • MD5 SHA1 SHA512 SSDEEP

        db.db

        • Path /data/data/com.dsblsjkhcuiewjkcwe23jhiuew.security/databases/db.db
        • Size 32KB
        • SHA256 c03ea975f5e369601569d0e7f969b6693764a0413110a7b667f87fc91c90efc0
        • MD5 SHA1 SHA512 SSDEEP

        db.db-journal

        • Path /data/data/com.dsblsjkhcuiewjkcwe23jhiuew.security/databases/db.db-journal
        • Size 512B
        • SHA256 4b9b96fe1ee91885880a67b03a5c29a147f108ddacc24ea057e7febff8fa88a8
        • MD5 SHA1 SHA512

        db.db-journal

        • Path /data/data/com.dsblsjkhcuiewjkcwe23jhiuew.security/databases/db.db-journal
        • Size 8KB
        • SHA256 ab478f2612f3e2321a586cba77613d5a55468a2a7fc958b4d9ad9ed0c916accb
        • MD5 SHA1 SHA512 SSDEEP

        db.db-journal

        • Path /data/data/com.dsblsjkhcuiewjkcwe23jhiuew.security/databases/db.db-journal
        • Size 8KB
        • SHA256 e83d7fbdfca1932572d7ca9367f50cafa8dfa8f08e6552c00e18e603140323b8
        • MD5 SHA1 SHA512 SSDEEP

        db.db-journal

        • Path /data/data/com.dsblsjkhcuiewjkcwe23jhiuew.security/databases/db.db-journal
        • Size 12KB
        • SHA256 25069d7fb28c2d4af11742822a33253adb87069afe61913a8429ab2d790d9ea1
        • MD5 SHA1 SHA512 SSDEEP

        db.db-journal

        • Path /data/data/com.dsblsjkhcuiewjkcwe23jhiuew.security/databases/db.db-journal
        • Size 12KB
        • SHA256 dedde94211ea12c32a78d2ad8f7d73f636f89bfae63c10d6434f03b94ff50c6b
        • MD5 SHA1 SHA512 SSDEEP