Analysis
- max time kernel
127s - max time network
131s - platform
android_x86 - resource
android-x86-arm-20240603-en - resource tags
androidarch:armarch:x86image:android-x86-arm-20240603-enlocale:en-usos:android-9-x86system - submitted
04/06/2024, 03:06
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
8f8a468acb35106fafd7893f36428a8f.apk
Resource
android-x86-arm-20240603-en
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
8f8a468acb35106fafd7893f36428a8f.apk
Resource
android-x64-20240603-en
11 signatures
150 seconds
Behavioral task
behavioral3
Sample
8f8a468acb35106fafd7893f36428a8f.apk
Resource
android-x64-arm64-20240603-en
8 signatures
150 seconds
General
- Target 8f8a468acb35106fafd7893f36428a8f.apk
- Size 4.2MB
- Sample240604-dlyc2abg44
- SHA256 dbc82167bd33f85b5fb78303de64a56aeb8da555cbd202f6d179dc7d6822f497
- MD5 8f8a468acb35106fafd7893f36428a8f
- SHA1 dd880c83455e1f1fce214ab31c36450c43a23291
- SHA512 9aabd46c99daf4bdb5b1d002eaa69cd51f3291232530e404306bbb7261bb9a87c508dc6250f9ee942065224026b789ef3e6242bcd9ff6e1e4da681258c901f45
- SSDEEP 98304:afIyL/HObxN+sy121xanDJJgr/x74sNm0RJBu3S88DtGsqco07:gpfOlNTy0V/x74sNm0XU3OXBB7
- MD5 SHA1 SHA512 SSDEEP
Score
7/10
Malware Config
Signatures
- Checks CPU information 2 TTPs 1 IoCs
Checks CPU information which indicate if the system is an emulator.
description ioc Process File opened for read /proc/cpuinfo com.dm2photo24 - Checks memory information 2 TTPs 1 IoCs
Checks memory information which indicate if the system is an emulator.
description ioc Process File opened for read /proc/meminfo com.dm2photo24 - Loads dropped Dex/Jar 1 TTPs 1 IoCs
Runs executable file dropped to the device during analysis.
ioc pid Process /data/user/0/com.dm2photo24/cache/ads2292803383136322178.jar 4284 com.dm2photo24 - Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.
description ioc Process Framework service call android.net.wifi.IWifiManager.getConnectionInfo com.dm2photo24 - Queries the mobile country code (MCC) 1 TTPs 1 IoCs
description ioc Process Framework service call com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone com.dm2photo24 - Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
description ioc Process Framework service call android.app.IActivityManager.registerReceiver com.dm2photo24 - Checks if the internet connection is available 1 TTPs 1 IoCs
description ioc Process Framework service call android.net.IConnectivityManager.getActiveNetworkInfo com.dm2photo24 - Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
description ioc Process Framework API call javax.crypto.Cipher.doFinal com.dm2photo24
Processes
-
com.dm2photo241⤵
- Checks CPU information
- Checks memory information
- Loads dropped Dex/Jar
- Queries information about the current Wi-Fi connection
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Checks if the internet connection is available
- Uses Crypto APIs (Might try to encrypt user data)
PID:4284
Network
MITRE ATT&CK Mobile v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path /data/data/com.dm2photo24/app_sslcache/www.chartboost.com.443
- Size 10KB
- SHA256 d672ae4f8b525ee82b6b92f7b5e847c0aa5a4070f19a94aa1e17148fb9fb1468
- MD5 62bc685349a361182818bde937665f9d
- SHA1 a244a613fb17d6d663e4ccbef94ab787cd48b505
- SHA512 aecff1d3fe440be64f2ba9266fe9eb81a20fdf8f6c122a29d22d0c51bdb97bf2c5ee43b979d3475488d61474214b31e76290c790a906470eaa8f1927fa8568a4
- SSDEEP 192:KuW8u6ymbY2MLKMmZNvBYQJuuW8u6ymbfMLKMEZNvBsYQJ5B:KX8u6XILKlZNvB8X8u6XwLKbZNvBsd
- MD5 SHA1 SHA512 SSDEEP
- Path /data/data/com.dm2photo24/app_sslcache/www.chartboost.com.443
- Size 10KB
- SHA256 014af1ce648371a8c4fcbf53318b1c92c9f43f7f8b36aa33b1e0a2be9125e8c3
- MD5 231d6ab86e63133c95f2ac3b7c21dd2b
- SHA1 20219f7eb08c7225277e27cae5e97ed7a7546150
- SHA512 b1a7b3ded8e897dcf8ee6df631e086f578f9212e65d97329c02864c12089da5ef5f98c63cde7752a6e186734bec77bc8c8494a0d62a6e6e529a9573f90717338
- SSDEEP 192:oxxuW8u6ymb82MLKMmZNvBYQJuuW8u6ymbfMLKMEZNvBsYQJ5B:KxX8u6XsLKlZNvB8X8u6XwLKbZNvBsd
- MD5 SHA1 SHA512 SSDEEP
- Path /data/data/com.dm2photo24/cache/ads2292803383136322178.jar
- Size 2KB
- SHA256 ee2de01a238f9e1834f9f9934dd1f5b267bdf9747965641d2fd636d740041f9b
- MD5 d80f6d032778b02d10a9c9a2f1a24714
- SHA1 e34d4ea9618b1b499b65032723ea029ab3998500
- SHA512 34fa52d41831142f86999ac407aafeb2b69bb4cd45ada9f739be84c80deb0414d11d6784f385eec287e4f6b5bdf29ba1c9a6a77c07707d66a73c60eb389136e1
- MD5 SHA1 SHA512
- Path /data/data/com.dm2photo24/databases/tapcontext
- Size 28KB
- SHA256 e97f7a884c3bc033bc5c6e490a39cba7e859659d03bf0f311e3e8caaa17e6f8b
- MD5 58960ac91bc0b4b8dc95bed910408497
- SHA1 968e074918c7512850a1cb4707cf4655ddfdf251
- SHA512 5db180a117fd9c0b5c81451bc959b8a9452322099f1ef62a7b715680100f415932cc265476f82c5479ce6499329f13a6aafd2fbcc73d11071406aed799083093
- SSDEEP 12:GpknDpj5/H/oRp5koJStYXjdgWE1AFUnTgTVEqhUhzvj2mKWH9ToKAe8haYXNkbF:maP/ohkoRSWSgZif2mKWH9kZaYXGF
- MD5 SHA1 SHA512 SSDEEP
- Path /data/data/com.dm2photo24/databases/tapcontext
- Size 28KB
- SHA256 cead145121adf043450199025d9c1abe5fd5a4199fc9c228ec7082d644609c4b
- MD5 c3db527cd1f616aa2994f315a11ed7d8
- SHA1 4b346b3ea6396301119e9441469feb1a8112323a
- SHA512 d703abf4bccc60dcd3063ffadbc7f8b606084b885b3f23769469e6c9921c5e4251226a4d6acfad7f1ca67ca6289ad9da51355c219d460bbf3cd1cac932b3d1cc
- SSDEEP 12:TGO89qWFNKQU99wzbhRJTSFbyjLH9wzbhRZfRmBEyPbGtOwGQ:TGOWqWFU5+JNR+Z0GSiGQ
- MD5 SHA1 SHA512 SSDEEP
- Path /data/data/com.dm2photo24/databases/tapcontext-journal
- Size 512B
- SHA256 a5a7077d0b93ed2f418baf3231e1c3d011d5aeb0b3b3263e46d3f5762ecfe860
- MD5 f5b03834cef7cd4111ef7ad392842d93
- SHA1 95fe0296c0551c6c9016e67d062d33a1ba5cad21
- SHA512 ddb4862f673f277ad7c7c78d71f6df34bcbbc7b94ed0f39f0f990fee87cc4c50fb9ac3c1dc155cf78f6bcb0fdb0ebb458e592fd1f5eb637513692235ad32566c
- MD5 SHA1 SHA512
- Path /data/data/com.dm2photo24/databases/tapcontext-shm
- Size 32KB
- SHA256 c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
- MD5 bb7df04e1b0a2570657527a7e108ae23
- SHA1 5188431849b4613152fd7bdba6a3ff0a4fd6424b
- SHA512 768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012
- SSDEEP 3::
- MD5 SHA1 SHA512 SSDEEP
- Path /data/data/com.dm2photo24/databases/tapcontext-wal
- Size 40KB
- SHA256 3b4e22dbcd18feb7b81c88f1b26f31ee2ab6d8399ca34cb6af5a8fd07617f2ae
- MD5 809a28443d5720eb729fe74bd28cbf12
- SHA1 cd022c7538e343dfb65ed6b17535f7d259560462
- SHA512 037e46fad9bdf40a459b05bdc2e1776c82608525c536bcb2c802e6551e42233203b90c45f4057ad9aa6b6b26a88f0eca4b50d54676247444c0c465a7881c9304
- SSDEEP 24:Kx7yzyGSP/bATLIGOWqWFU5+JNR+Z0GSP/bnZ98Y:ZzNSP/koGOb5gzuSP/n
- MD5 SHA1 SHA512 SSDEEP
- Path /data/data/com.dm2photo24/databases/tapcontext-wal
- Size 12KB
- SHA256 50deb540a50fd5b475da8d1926af4598cafb4c3224d0ac6f708ef7fbc13151c9
- MD5 9871302918dbcff94cbe4057a9f244fe
- SHA1 3cbc5f9ff6874f0be6c82761b026e429780c2822
- SHA512 92bdd687cf63b55e82e5111c61a3c115b9efedd65d8b29039244006e070589af9f6403c397f987e3aecc095b6b7b7311287ed5a0e2057a726476f6fd9938d753
- SSDEEP 24:K4ZvaP/ohkoRSWSgZif2mKWH9kZaYX+RMb:OskQZiu9WH9kZPkMb
- MD5 SHA1 SHA512 SSDEEP
- Path /data/data/com.dm2photo24/files/eula.zip
- Size 63KB
- SHA256 e72d6614473f140732c907c5df5c041cad180d5015a2b86050abc3edc5644a5d
- MD5 0e82b33284e7d810dd9e350e22423125
- SHA1 e8400b31498cded7988c5a7f9bba2bf351ae5189
- SHA512 a295c8c10759c44e4df3d10ea372969590730e8c33d42cff7e07b2c39d1f3248916a0f2ae293c647ce7f942f531b03caab4c605590d4969f799eb8b26ef9eac4
- SSDEEP 1536:prCSMrhNeWn5UrQyQSIFRGTqvtIn8IcY164tioRY/1yCcW75NvlWpT:pIlhny02ckMt6OZ4tN2/nT5jg
- MD5 SHA1 SHA512 SSDEEP
- Path /data/data/com.dm2photo24/files/offline_eula_body.html
- Size 22KB
- SHA256 a40a4a11b0a2e8ae227e6d101cbd27a3f7736292795ba223f5d086753cd3eb60
- MD5 c1c75ba9fda9128ea1f79555c02f2fb6
- SHA1 96f62897f0f82eb973f4cacb18f89d1cffa4e696
- SHA512 bd46619ff6a9119499307a19eb2f23378ccde2af4da04683ebc3535c3da9b81ece4cdb5db8ed118cd58cf5aca1314d87329d659e05f5a58a9aae5a20c24303a2
- SSDEEP 384:SpJSAyCBfDXLp7/DgrhOIIpyq+eP3Zid5YQ/D9yvtMJ45o:Sp7LpoMpyqpP3Zihyvha
- MD5 SHA1 SHA512 SSDEEP
- Path /data/data/com.dm2photo24/files/offline_eula_footer.html
- Size 13KB
- SHA256 1f075332b57fdfbb9417718f3c0d9f27ffbb2c135b3291aca4b9f2911d7e9e3b
- MD5 9818dabc2eb86d5f4f071e9d67334570
- SHA1 117e7978c9293d86ea5492b90a4999cc24225dbb
- SHA512 79937390d4b02688abb0e24cef356024c3dbd3cd59d85ea3300556af59f0648293ed24fb5db740a4329fdddccf43af3b7679135555397a3adedd3eeccf5423a0
- SSDEEP 192:SIC1VPawVyCxZ7/YDLFn+D2yi0+DZQuDSeDOIDEFpS4V4GDjFu0QE69HqKS1cBIZ:SIiVxSAykfVBDjFaW18IZ
- MD5 SHA1 SHA512 SSDEEP
- Path /data/user/0/com.dm2photo24/cache/ads2292803383136322178.jar
- Size 4KB
- SHA256 f3c142f78cadcb57d7da3d8e4dc5f8c7b05377417c639059910696c844afc1f9
- MD5 12670a32ad1380c9021a9e74aa5f2281
- SHA1 7e8caf0c7a4d78452efb90958e8ce1aae5148e44
- SHA512 1277dde373cab02d5df62732834adb79f8dbf1d1a9ac56b5b348e354317fadc24fe20b5ebdd1ecc28f8fc98dcdff807d2839bef75ef7d871e976e68a95851b06
- SSDEEP 96:8V0+Z8fg8M9CC/mkE2K6Uq7tJ5FVDNqv3jokVbdzfgDmM0/:8VXYglD+kE2K6r36v3dLgKx
- MD5 SHA1 SHA512 SSDEEP
- Path /storage/emulated/0/.tapcontext
- Size 18B
- SHA256 8cdfa9505fbe0d9617f08d27d7d99d3f5dcbae701cfcccb9549b342cd16c253e
- MD5 7e6c787c297b755effc1faa040edce95
- SHA1 95fc631191a2034314028727ee13730dda7408da
- SHA512 b1d96c1e05f38c3993e7bbf48d6ae74c7d6ab73f2af3bdc8736d72efbeca05f67624a0850b170ff2b103db25b680840b564818204e1f8b05c61360228f369059
- MD5 SHA1 SHA512