Analysis
- max time kernel
100s - max time network
172s - platform
android_x64 - resource
android-x64-20240603-en - resource tags
androidarch:x64arch:x86image:android-x64-20240603-enlocale:en-usos:android-10-x64system - submitted
03/06/2024, 15:01
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
890814e53dca788e353433be8f1d28c2.apk
Resource
android-x86-arm-20240603-en
android-9-x86
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
890814e53dca788e353433be8f1d28c2.apk
Resource
android-x64-20240603-en
android-10-x64
0 signatures
150 seconds
Behavioral task
behavioral3
Sample
890814e53dca788e353433be8f1d28c2.apk
Resource
android-x64-arm64-20240603-en
android-11-x64
2 signatures
150 seconds
Behavioral task
behavioral4
Sample
asd.apk
Resource
android-x86-arm-20240603-en
android-9-x86
10 signatures
150 seconds
Behavioral task
behavioral5
Sample
asd.apk
Resource
android-x64-20240603-en
android-10-x64
7 signatures
150 seconds
Behavioral task
behavioral6
Sample
asd.apk
Resource
android-x64-arm64-20240603-en
android-11-x64
7 signatures
150 seconds
Behavioral task
behavioral7
Sample
base.apk
Resource
android-x86-arm-20240603-en
android-9-x86
4 signatures
150 seconds
Behavioral task
behavioral8
Sample
base.apk
Resource
android-x64-20240603-en
android-10-x64
3 signatures
150 seconds
General
- Target base.apk
- Size 313KB
- Sample240603-seb9jsac7x
- SHA256 a55aef8fdfaf4152b5653900c6465a72a2cac8695f92b935b14af70df6792ffa
- MD5 80fc9f41ca450ca5f089a9785b982925
- SHA1 b3450a1422881f0b78554eb1695887c578856487
- SHA512 c20ab215dbc2499bc8eb1cae150d4b0c5feeadd390de7974dfdae2acfc71afcd24db23d0db54b4c4634b7bb65c99865c3f382c6946d3c8522bc039b5437767cd
- SSDEEP 6144:nIKApPu6xdwXbbuO3+wL+vu+hKZ0FoBFqDoi+q5dhhye:Z+G6Lgbu8+wL+NhKZ0FoyDoi+qrhhye
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Loads dropped Dex/Jar 1 TTPs 22 IoCs
Runs executable file dropped to the device during analysis.
ioc pid Process /data/user/0/com.dsblsjkhcuiewjkcwe23jhiuew.security/app_dpz4.raf.or79.rjy/obfs/0.obfedex 5187 com.dsblsjkhcuiewjkcwe23jhiuew.security /data/user/0/com.dsblsjkhcuiewjkcwe23jhiuew.security/app_dpz4.raf.or79.rjy/obfs/0.obfedex 5187 com.dsblsjkhcuiewjkcwe23jhiuew.security /data/user/0/com.dsblsjkhcuiewjkcwe23jhiuew.security/app_dpz4.raf.or79.rjy/obfs/1.obfedex 5187 com.dsblsjkhcuiewjkcwe23jhiuew.security /data/user/0/com.dsblsjkhcuiewjkcwe23jhiuew.security/app_dpz4.raf.or79.rjy/obfs/1.obfedex 5187 com.dsblsjkhcuiewjkcwe23jhiuew.security /data/user/0/com.dsblsjkhcuiewjkcwe23jhiuew.security/app_dpz4.raf.or79.rjy/obfs/2.obfedex 5187 com.dsblsjkhcuiewjkcwe23jhiuew.security /data/user/0/com.dsblsjkhcuiewjkcwe23jhiuew.security/app_dpz4.raf.or79.rjy/obfs/2.obfedex 5187 com.dsblsjkhcuiewjkcwe23jhiuew.security /data/user/0/com.dsblsjkhcuiewjkcwe23jhiuew.security/app_dpz4.raf.or79.rjy/obfs/3.obfedex 5187 com.dsblsjkhcuiewjkcwe23jhiuew.security /data/user/0/com.dsblsjkhcuiewjkcwe23jhiuew.security/app_dpz4.raf.or79.rjy/obfs/3.obfedex 5187 com.dsblsjkhcuiewjkcwe23jhiuew.security /data/user/0/com.dsblsjkhcuiewjkcwe23jhiuew.security/app_dpz4.raf.or79.rjy/obfs/4.obfedex 5187 com.dsblsjkhcuiewjkcwe23jhiuew.security /data/user/0/com.dsblsjkhcuiewjkcwe23jhiuew.security/app_dpz4.raf.or79.rjy/obfs/4.obfedex 5187 com.dsblsjkhcuiewjkcwe23jhiuew.security /data/user/0/com.dsblsjkhcuiewjkcwe23jhiuew.security/app_dpz4.raf.or79.rjy/obfs/5.obfedex 5187 com.dsblsjkhcuiewjkcwe23jhiuew.security /data/user/0/com.dsblsjkhcuiewjkcwe23jhiuew.security/app_dpz4.raf.or79.rjy/obfs/5.obfedex 5187 com.dsblsjkhcuiewjkcwe23jhiuew.security /data/user/0/com.dsblsjkhcuiewjkcwe23jhiuew.security/app_dpz4.raf.or79.rjy/obfs/6.obfedex 5187 com.dsblsjkhcuiewjkcwe23jhiuew.security /data/user/0/com.dsblsjkhcuiewjkcwe23jhiuew.security/app_dpz4.raf.or79.rjy/obfs/6.obfedex 5187 com.dsblsjkhcuiewjkcwe23jhiuew.security /data/user/0/com.dsblsjkhcuiewjkcwe23jhiuew.security/app_dpz4.raf.or79.rjy/obfs/7.obfedex 5187 com.dsblsjkhcuiewjkcwe23jhiuew.security /data/user/0/com.dsblsjkhcuiewjkcwe23jhiuew.security/app_dpz4.raf.or79.rjy/obfs/7.obfedex 5187 com.dsblsjkhcuiewjkcwe23jhiuew.security /data/user/0/com.dsblsjkhcuiewjkcwe23jhiuew.security/app_dpz4.raf.or79.rjy/obfs/8.obfedex 5187 com.dsblsjkhcuiewjkcwe23jhiuew.security /data/user/0/com.dsblsjkhcuiewjkcwe23jhiuew.security/app_dpz4.raf.or79.rjy/obfs/8.obfedex 5187 com.dsblsjkhcuiewjkcwe23jhiuew.security /data/user/0/com.dsblsjkhcuiewjkcwe23jhiuew.security/app_dpz4.raf.or79.rjy/obfs/9.obfedex 5187 com.dsblsjkhcuiewjkcwe23jhiuew.security /data/user/0/com.dsblsjkhcuiewjkcwe23jhiuew.security/app_dpz4.raf.or79.rjy/obfs/9.obfedex 5187 com.dsblsjkhcuiewjkcwe23jhiuew.security /data/user/0/com.dsblsjkhcuiewjkcwe23jhiuew.security/app_dpz4.raf.or79.rjy/obfs/10.obfedex 5187 com.dsblsjkhcuiewjkcwe23jhiuew.security /data/user/0/com.dsblsjkhcuiewjkcwe23jhiuew.security/app_dpz4.raf.or79.rjy/obfs/10.obfedex 5187 com.dsblsjkhcuiewjkcwe23jhiuew.security - Queries the phone number (MSISDN for GSM devices) 1 TTPs
- Reads information about phone network operator. 1 TTPs
Network
MITRE ATT&CK Mobile v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path /data/data/com.dsblsjkhcuiewjkcwe23jhiuew.security/app_dpz4.raf.or79.rjy/obfs/0.obfedex
- Size 53KB
- SHA256 378b99ddad8137b7bf07654f11c67d850172ec5c958cde30a62227ecc1f09697
- MD5 dc1f5d051d09340fe6e5dfa08cddc22e
- SHA1 4dbb8f08faebae53d3ed888fcb6cb56ff645fdcb
- SHA512 eb1ebce80a3b456d6d6c5607a616a04a6b4439ce00ef2816ff9852078904e7934d184bdfebba4f379991b1aa67eb7c7997546896dfa8a17d9f184169e3574b68
- SSDEEP 1536:hLuO3TtlFCW2Qu0E7Jb7aIUDYLdzdA4scDwbxV:Fu0nEbQcLdzdA6Da/
- MD5 SHA1 SHA512 SSDEEP
- Path /data/data/com.dsblsjkhcuiewjkcwe23jhiuew.security/app_dpz4.raf.or79.rjy/obfs/1.obfedex
- Size 1KB
- SHA256 ca12be5f0b51807412164ce4c32dd27c3c1f58d15410a50efc579c25e6531fed
- MD5 36d159912dcad873c63aef06e294d897
- SHA1 1eeb4283c5fd73f3edbbf0f7ba5e2aab596838dd
- SHA512 6be0e23e8016454f13e927da0372c5dc931ba6ce3cf9d52a6a246c3a4eb4734c82d191535a1cfa771eb53bbfc644f0ac12e3445d395c30c42ba1ab626206f852
- MD5 SHA1 SHA512
- Path /data/data/com.dsblsjkhcuiewjkcwe23jhiuew.security/app_dpz4.raf.or79.rjy/obfs/10.obfedex
- Size 8KB
- SHA256 b2fe5b1c1d52f2e891e69c8e18ad2506d64481b2d79fde27e98dd76ca11b4857
- MD5 4a0a12f32e58121b7bd039ddab25b797
- SHA1 d0a29bf55f268079972b7f25bfc4908f4a5088bf
- SHA512 09a6e234ca25045c86cfa6f1e1fa575c22bae0a69f9519f744cb5c31e7f1eb64de59c0f4557cf504ae3b1eaccb7a4014c1e6675ee69c4b40609f452b7194d152
- SSDEEP 96:2/T/YiJkeSCBkGkIcOVPP3OGXmZi0kJd93D9aJ/uiav7C0zCwCKLgQy:AoWSRtq0W1aluiU7C02Hl
- MD5 SHA1 SHA512 SSDEEP
- Path /data/data/com.dsblsjkhcuiewjkcwe23jhiuew.security/app_dpz4.raf.or79.rjy/obfs/2.obfedex
- Size 1KB
- SHA256 4a3ac1310c61f7ba3b538e100036b29006fec1c1e9b2965f1c4a92a72478259a
- MD5 b9dd15632c67624182ac596677aa811e
- SHA1 8a6b3bdfa5d395af4aa6d60481ebad5ddc22edd4
- SHA512 e41d6feb1cc498fee8395333d77e559a32dcd918563312a2e73b765b8dd4cfe53895750a004a1277995e83d4e915d4e5516d9fd5175d2c1a72117b0a0de999b2
- MD5 SHA1 SHA512
- Path /data/data/com.dsblsjkhcuiewjkcwe23jhiuew.security/app_dpz4.raf.or79.rjy/obfs/3.obfedex
- Size 59KB
- SHA256 803d87b7f146ff38062f864e80a066f3216a7c9e07c1ca96dc5ecf1b4e3f3f82
- MD5 dad0749639dbcb9e13709cc999ae7042
- SHA1 f73a36c871f439311faffdb304d3889a1064e12e
- SHA512 bc832104646894ef860167a69b8501e35e910e6a30b1cea596ee39e69aff7baecd21eb4cf9708e47cef766c3b059872aed1ea24787b68d01643f1ebc8f87b316
- SSDEEP 1536:q3aJ1t3MJ4Gc8XDtQpHZhAMc4DfsV2Gs7G6EjMU:iaWztQpHZhBc4Df22xU
- MD5 SHA1 SHA512 SSDEEP
- Path /data/data/com.dsblsjkhcuiewjkcwe23jhiuew.security/app_dpz4.raf.or79.rjy/obfs/4.obfedex
- Size 20KB
- SHA256 d1ee9e6844d70ecd26177267cc0bbf7e8a266492529cf99fa0c3e788aac68b1e
- MD5 709bb4f074443507dae304785e925af5
- SHA1 bcb54fee5f731e1e75bdaf453f75ca387ae85299
- SHA512 4f7cc82bf6d159c6978401b13b0af4f4352bba00c7dc8935b43bfcbb7cc9b0498cc759d80e9162ede9bf64883a519652d4ba4ee02f55fe9d464d867e2d850cd1
- SSDEEP 384:9hB8e9406LlpIYMGfSGBtKe8lZwZNNCxzRwIwJ:reIYLPaSSGKeMoN+I
- MD5 SHA1 SHA512 SSDEEP
- Path /data/data/com.dsblsjkhcuiewjkcwe23jhiuew.security/app_dpz4.raf.or79.rjy/obfs/5.obfedex
- Size 15KB
- SHA256 858d03ee873fcca05817f1219b1ce433aa8a7d13361e7eceeb780b602b57863a
- MD5 0c05bdc4aee0fb272907084ec871cb0d
- SHA1 6d0e5fdb3881e86a84c67c2021e66df43cf4fdce
- SHA512 66f9915f3bce507f07078ebf337c45a36b5a7783cba453002b540bcc49444818097f297e1fa2e4e4312e29739e5bf5a1fbd3a3dd3f677a9f3df554b4580ba585
- SSDEEP 192:TBWl8YGrTuLH1bskpQgFteZomQXBa1fDG7nw/rA+EvxtRC9T4evu6:tWlxG3cozgbeZRQXQ94w0+Qk5m6
- MD5 SHA1 SHA512 SSDEEP
- Path /data/data/com.dsblsjkhcuiewjkcwe23jhiuew.security/app_dpz4.raf.or79.rjy/obfs/6.obfedex
- Size 5KB
- SHA256 d68d718e9923b1d89c4f2803645c0543c409aca49284a8512e48bb1fbc711c62
- MD5 66295031f6fb34b975169836cb54f1ca
- SHA1 1c168229a29833ea495e07857f0d67b27597405f
- SHA512 65f54ec6b700bfcee0a177c106cc4b5a27c6d131a80d2bf72102260cca6a9ed74adee628603fb0e2e67ba6b5f030bbf674663a23c2ef8017eb7ea13080b9116f
- SSDEEP 96:6Mii2QJ6mZMaQZTBPYQs3ZeZXKJi0pZj3XvuH1mCYYUD:zi1D88NPYQspmJNHxYYI
- MD5 SHA1 SHA512 SSDEEP
- Path /data/data/com.dsblsjkhcuiewjkcwe23jhiuew.security/app_dpz4.raf.or79.rjy/obfs/7.obfedex
- Size 7KB
- SHA256 a01a11334bcb711ae342d535eb696cf43449661d9cc64310a2304c43dfb35693
- MD5 0c8d78ccf420cc3984a98522e6882e03
- SHA1 20e6b288c7f9f72fa7153f8a171fd68f49005115
- SHA512 880f5951d1db75fc8cac712d09887a190e7daa6ddb69a46d334fc61d2b52bd85f49eb434e6167cbd66b7f07bb9286d65ace2991b521f2063aa7d19e44a351d42
- SSDEEP 192:aEsJ0qcc9WhKo1Yd++r4hVjtIY7Npa4STf1:aElgWhKo1Yd++rEjtIip2Tt
- MD5 SHA1 SHA512 SSDEEP
- Path /data/data/com.dsblsjkhcuiewjkcwe23jhiuew.security/app_dpz4.raf.or79.rjy/obfs/8.obfedex
- Size 4KB
- SHA256 f26e8627c19105e71cf6ac6009cf422a3cf23473c4fd5ce61f0b5e1086c6f7d5
- MD5 b3597d369cf86dee48ce8f7d4f2f5206
- SHA1 0f925790e5bf34734deacd2a4d14a892122952eb
- SHA512 25f4056bb55df31e984a0573c103518f4bba90ee7e36c201c0cd9fd1bbedf329f0c3a2bd9d3ed238ae146d7d24a361a11688dbc72c8e803f0891ee6f9340d51d
- SSDEEP 48:HVtG0UdubE6ClYvmVYqFk9wJp5vKlHixmlkJYty1GlibIg2Ea9fu:1t5iubE6uYvmVYGTdKpSJUlibVV+u
- MD5 SHA1 SHA512 SSDEEP
- Path /data/data/com.dsblsjkhcuiewjkcwe23jhiuew.security/app_dpz4.raf.or79.rjy/obfs/9.obfedex
- Size 984B
- SHA256 a9a61fa175ab8cfcd32f9ec0f26625aca1f16ab3b4ed4a0110556246384c7972
- MD5 36eb679975e0a60fd74cf38d23a65414
- SHA1 00842f9e2a596cb6f1dce078829e6386ba6a7217
- SHA512 e75a4a806c6f68dbd3b7285c17aaf84384586c7496ea34ae9e3697c7d5ae9656fe61fab99bfda980182bf3f60bdf500e1ded680dcdfd08ef2c910935ba6e01f7
- MD5 SHA1 SHA512
- Path /storage/emulated/0/dsblsjkhcuiewjkcwe23jhiuew.txt
- Size 2B
- SHA256 4fc82b26aecb47d2868c4efbe3581732a3e7cbcc6c2efb32062c08170a05eeb8
- MD5 6512bd43d9caa6e02c990b0a82652dca
- SHA1 17ba0791499db908433b80f37c5fbc89b870084b
- SHA512 74a49c698dbd3c12e36b0b287447d833f74f3937ff132ebff7054baa18623c35a705bb18b82e2ac0384b5127db97016e63609f712bc90e3506cfbea97599f46f
- MD5 SHA1 SHA512