Overview

overview

8

Static

static

6

890814e53d...c2.apk

android-9-x86

8

890814e53d...c2.apk

android-10-x64

1

890814e53d...c2.apk

android-11-x64

8

asd.apk

android-9-x86

8

asd.apk

android-10-x64

7

asd.apk

android-11-x64

7

base.apk

android-9-x86

7

base.apk

android-10-x64

7

base.apk

android-11-x64

7

Analysis

  • max time kernel
    81s
  • max time network
    204s
  • platform
    android_x86
  • resource
    android-x86-arm-20240603-en
  • resource tags

    androidarch:armarch:x86image:android-x86-arm-20240603-enlocale:en-usos:android-9-x86system
  • submitted
    03/06/2024, 15:01

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    base.apk
  • Size 313KB
  • Sample240603-seb9jsac7x
  • SHA256 a55aef8fdfaf4152b5653900c6465a72a2cac8695f92b935b14af70df6792ffa
  • MD5 SHA1 SHA512 SSDEEP
Score
7/10
discoveryevasion

Malware Config

Signatures

  • Loads dropped Dex/Jar 1 TTPs 33 IoCs

    Runs executable file dropped to the device during analysis.

    evasion
  • Queries the phone number (MSISDN for GSM devices) 1 TTPs
    discovery
  • Reads information about phone network operator. 1 TTPs
    discovery
  • Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
    evasion

Processes

  • com.dsblsjkhcuiewjkcwe23jhiuew.security
    1⤵
    • Loads dropped Dex/Jar
    • Requests disabling of battery optimizations (often used to enable hiding in the background).
    PID:4276
    • /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.dsblsjkhcuiewjkcwe23jhiuew.security/app_dpz4.raf.or79.rjy/obfs/0.obfedex --output-vdex-fd=42 --oat-fd=43 --oat-location=/data/user/0/com.dsblsjkhcuiewjkcwe23jhiuew.security/app_dpz4.raf.or79.rjy/obfs/oat/x86/0.odex --compiler-filter=quicken --class-loader-context=&
      2⤵
      • Loads dropped Dex/Jar
      PID:4302
    • /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.dsblsjkhcuiewjkcwe23jhiuew.security/app_dpz4.raf.or79.rjy/obfs/1.obfedex --output-vdex-fd=42 --oat-fd=43 --oat-location=/data/user/0/com.dsblsjkhcuiewjkcwe23jhiuew.security/app_dpz4.raf.or79.rjy/obfs/oat/x86/1.odex --compiler-filter=quicken --class-loader-context=&
      2⤵
      • Loads dropped Dex/Jar
      PID:4325
    • /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.dsblsjkhcuiewjkcwe23jhiuew.security/app_dpz4.raf.or79.rjy/obfs/2.obfedex --output-vdex-fd=42 --oat-fd=43 --oat-location=/data/user/0/com.dsblsjkhcuiewjkcwe23jhiuew.security/app_dpz4.raf.or79.rjy/obfs/oat/x86/2.odex --compiler-filter=quicken --class-loader-context=&
      2⤵
      • Loads dropped Dex/Jar
      PID:4348
    • /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.dsblsjkhcuiewjkcwe23jhiuew.security/app_dpz4.raf.or79.rjy/obfs/3.obfedex --output-vdex-fd=42 --oat-fd=43 --oat-location=/data/user/0/com.dsblsjkhcuiewjkcwe23jhiuew.security/app_dpz4.raf.or79.rjy/obfs/oat/x86/3.odex --compiler-filter=quicken --class-loader-context=&
      2⤵
      • Loads dropped Dex/Jar
      PID:4372
    • /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.dsblsjkhcuiewjkcwe23jhiuew.security/app_dpz4.raf.or79.rjy/obfs/4.obfedex --output-vdex-fd=42 --oat-fd=43 --oat-location=/data/user/0/com.dsblsjkhcuiewjkcwe23jhiuew.security/app_dpz4.raf.or79.rjy/obfs/oat/x86/4.odex --compiler-filter=quicken --class-loader-context=&
      2⤵
      • Loads dropped Dex/Jar
      PID:4394
    • /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.dsblsjkhcuiewjkcwe23jhiuew.security/app_dpz4.raf.or79.rjy/obfs/5.obfedex --output-vdex-fd=42 --oat-fd=43 --oat-location=/data/user/0/com.dsblsjkhcuiewjkcwe23jhiuew.security/app_dpz4.raf.or79.rjy/obfs/oat/x86/5.odex --compiler-filter=quicken --class-loader-context=&
      2⤵
      • Loads dropped Dex/Jar
      PID:4417
    • /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.dsblsjkhcuiewjkcwe23jhiuew.security/app_dpz4.raf.or79.rjy/obfs/6.obfedex --output-vdex-fd=42 --oat-fd=43 --oat-location=/data/user/0/com.dsblsjkhcuiewjkcwe23jhiuew.security/app_dpz4.raf.or79.rjy/obfs/oat/x86/6.odex --compiler-filter=quicken --class-loader-context=&
      2⤵
      • Loads dropped Dex/Jar
      PID:4441
    • /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.dsblsjkhcuiewjkcwe23jhiuew.security/app_dpz4.raf.or79.rjy/obfs/7.obfedex --output-vdex-fd=42 --oat-fd=43 --oat-location=/data/user/0/com.dsblsjkhcuiewjkcwe23jhiuew.security/app_dpz4.raf.or79.rjy/obfs/oat/x86/7.odex --compiler-filter=quicken --class-loader-context=&
      2⤵
      • Loads dropped Dex/Jar
      PID:4467
    • /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.dsblsjkhcuiewjkcwe23jhiuew.security/app_dpz4.raf.or79.rjy/obfs/8.obfedex --output-vdex-fd=42 --oat-fd=43 --oat-location=/data/user/0/com.dsblsjkhcuiewjkcwe23jhiuew.security/app_dpz4.raf.or79.rjy/obfs/oat/x86/8.odex --compiler-filter=quicken --class-loader-context=&
      2⤵
      • Loads dropped Dex/Jar
      PID:4490
    • /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.dsblsjkhcuiewjkcwe23jhiuew.security/app_dpz4.raf.or79.rjy/obfs/9.obfedex --output-vdex-fd=42 --oat-fd=43 --oat-location=/data/user/0/com.dsblsjkhcuiewjkcwe23jhiuew.security/app_dpz4.raf.or79.rjy/obfs/oat/x86/9.odex --compiler-filter=quicken --class-loader-context=&
      2⤵
      • Loads dropped Dex/Jar
      PID:4514
    • /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.dsblsjkhcuiewjkcwe23jhiuew.security/app_dpz4.raf.or79.rjy/obfs/10.obfedex --output-vdex-fd=42 --oat-fd=43 --oat-location=/data/user/0/com.dsblsjkhcuiewjkcwe23jhiuew.security/app_dpz4.raf.or79.rjy/obfs/oat/x86/10.odex --compiler-filter=quicken --class-loader-context=&
      2⤵
      • Loads dropped Dex/Jar
      PID:4536

Network

        MITRE ATT&CK Mobile v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        0.obfedex
        • Path /data/data/com.dsblsjkhcuiewjkcwe23jhiuew.security/app_dpz4.raf.or79.rjy/obfs/0.obfedex
        • Size 53KB
        • SHA256 378b99ddad8137b7bf07654f11c67d850172ec5c958cde30a62227ecc1f09697
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        1.obfedex
        • Path /data/data/com.dsblsjkhcuiewjkcwe23jhiuew.security/app_dpz4.raf.or79.rjy/obfs/1.obfedex
        • Size 1KB
        • SHA256 ca12be5f0b51807412164ce4c32dd27c3c1f58d15410a50efc579c25e6531fed
        • MD5 SHA1 SHA512
        Submit Download

        10.obfedex
        • Path /data/data/com.dsblsjkhcuiewjkcwe23jhiuew.security/app_dpz4.raf.or79.rjy/obfs/10.obfedex
        • Size 8KB
        • SHA256 b2fe5b1c1d52f2e891e69c8e18ad2506d64481b2d79fde27e98dd76ca11b4857
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        2.obfedex
        • Path /data/data/com.dsblsjkhcuiewjkcwe23jhiuew.security/app_dpz4.raf.or79.rjy/obfs/2.obfedex
        • Size 1KB
        • SHA256 4a3ac1310c61f7ba3b538e100036b29006fec1c1e9b2965f1c4a92a72478259a
        • MD5 SHA1 SHA512
        Submit Download

        3.obfedex
        • Path /data/data/com.dsblsjkhcuiewjkcwe23jhiuew.security/app_dpz4.raf.or79.rjy/obfs/3.obfedex
        • Size 59KB
        • SHA256 803d87b7f146ff38062f864e80a066f3216a7c9e07c1ca96dc5ecf1b4e3f3f82
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        4.obfedex
        • Path /data/data/com.dsblsjkhcuiewjkcwe23jhiuew.security/app_dpz4.raf.or79.rjy/obfs/4.obfedex
        • Size 20KB
        • SHA256 d1ee9e6844d70ecd26177267cc0bbf7e8a266492529cf99fa0c3e788aac68b1e
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        5.obfedex
        • Path /data/data/com.dsblsjkhcuiewjkcwe23jhiuew.security/app_dpz4.raf.or79.rjy/obfs/5.obfedex
        • Size 15KB
        • SHA256 858d03ee873fcca05817f1219b1ce433aa8a7d13361e7eceeb780b602b57863a
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        6.obfedex
        • Path /data/data/com.dsblsjkhcuiewjkcwe23jhiuew.security/app_dpz4.raf.or79.rjy/obfs/6.obfedex
        • Size 5KB
        • SHA256 d68d718e9923b1d89c4f2803645c0543c409aca49284a8512e48bb1fbc711c62
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        7.obfedex
        • Path /data/data/com.dsblsjkhcuiewjkcwe23jhiuew.security/app_dpz4.raf.or79.rjy/obfs/7.obfedex
        • Size 7KB
        • SHA256 a01a11334bcb711ae342d535eb696cf43449661d9cc64310a2304c43dfb35693
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        8.obfedex
        • Path /data/data/com.dsblsjkhcuiewjkcwe23jhiuew.security/app_dpz4.raf.or79.rjy/obfs/8.obfedex
        • Size 4KB
        • SHA256 f26e8627c19105e71cf6ac6009cf422a3cf23473c4fd5ce61f0b5e1086c6f7d5
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        9.obfedex
        • Path /data/data/com.dsblsjkhcuiewjkcwe23jhiuew.security/app_dpz4.raf.or79.rjy/obfs/9.obfedex
        • Size 984B
        • SHA256 a9a61fa175ab8cfcd32f9ec0f26625aca1f16ab3b4ed4a0110556246384c7972
        • MD5 SHA1 SHA512
        Submit Download

        0.obfedex
        • Path /data/user/0/com.dsblsjkhcuiewjkcwe23jhiuew.security/app_dpz4.raf.or79.rjy/obfs/0.obfedex
        • Size 53KB
        • SHA256 31d4689ea7605deac4e68e5992f6f6868fbdd9fd29f5616db7f4efc5d632d3ae
        • MD5 SHA1 SHA512 SSDEEP
        Download

        1.obfedex
        • Path /data/user/0/com.dsblsjkhcuiewjkcwe23jhiuew.security/app_dpz4.raf.or79.rjy/obfs/1.obfedex
        • Size 1KB
        • SHA256 c355b684e9a48b46a3ffa295a32abe4e446ce465fe0d0ab1458b4caaf4d64a49
        • MD5 SHA1 SHA512
        Download

        2.obfedex
        • Path /data/user/0/com.dsblsjkhcuiewjkcwe23jhiuew.security/app_dpz4.raf.or79.rjy/obfs/2.obfedex
        • Size 1KB
        • SHA256 740d09d4f9da81a8c62f5717482c3b33a81d1a90100abb4aed51a401121a9e23
        • MD5 SHA1 SHA512
        Download

        3.obfedex
        • Path /data/user/0/com.dsblsjkhcuiewjkcwe23jhiuew.security/app_dpz4.raf.or79.rjy/obfs/3.obfedex
        • Size 59KB
        • SHA256 a8d63cde0a494202dbfc01a874cde6cc50e81a48b76c946c6a2cf56ef511f8d2
        • MD5 SHA1 SHA512 SSDEEP
        Download

        4.obfedex
        • Path /data/user/0/com.dsblsjkhcuiewjkcwe23jhiuew.security/app_dpz4.raf.or79.rjy/obfs/4.obfedex
        • Size 20KB
        • SHA256 23b47888fda0e90c867d3aeb579803ce1af180d28a5058ca3e3d2712f6b063c3
        • MD5 SHA1 SHA512 SSDEEP
        Download

        5.obfedex
        • Path /data/user/0/com.dsblsjkhcuiewjkcwe23jhiuew.security/app_dpz4.raf.or79.rjy/obfs/5.obfedex
        • Size 15KB
        • SHA256 69d937303f93e70f63d9b1e67738d15c0c8721ca7fdfa34752ce801f24da5da4
        • MD5 SHA1 SHA512 SSDEEP
        Download

        6.obfedex
        • Path /data/user/0/com.dsblsjkhcuiewjkcwe23jhiuew.security/app_dpz4.raf.or79.rjy/obfs/6.obfedex
        • Size 5KB
        • SHA256 6ef2ca09431a43c7428c87ec5ba4d544043f9a4ad572ebea3298bf75ce660f81
        • MD5 SHA1 SHA512 SSDEEP
        Download

        7.obfedex
        • Path /data/user/0/com.dsblsjkhcuiewjkcwe23jhiuew.security/app_dpz4.raf.or79.rjy/obfs/7.obfedex
        • Size 7KB
        • SHA256 c0b0634869808c03c73e298d9eb25ef8650b4ccd70ad6cb239bf77872c3fd7c1
        • MD5 SHA1 SHA512 SSDEEP
        Download

        8.obfedex
        • Path /data/user/0/com.dsblsjkhcuiewjkcwe23jhiuew.security/app_dpz4.raf.or79.rjy/obfs/8.obfedex
        • Size 4KB
        • SHA256 3b8e5630d678d3798a7a57766a9bfb5b1517686bf73790bf536315e46663ccb2
        • MD5 SHA1 SHA512 SSDEEP
        Download

        9.obfedex
        • Path /data/user/0/com.dsblsjkhcuiewjkcwe23jhiuew.security/app_dpz4.raf.or79.rjy/obfs/9.obfedex
        • Size 984B
        • SHA256 a8f684a1f0864ddb706a98168982b58c670d3a84776a0dae9bb4858e352fe0cf
        • MD5 SHA1 SHA512
        Download

        dsblsjkhcuiewjkcwe23jhiuew.txt
        • Path /storage/emulated/0/dsblsjkhcuiewjkcwe23jhiuew.txt
        • Size 2B
        • SHA256 4fc82b26aecb47d2868c4efbe3581732a3e7cbcc6c2efb32062c08170a05eeb8
        • MD5 SHA1 SHA512
        Submit Download