Resubmissions
12-06-2024 08:16
240612-j6cvqavhpc 1028-05-2024 23:19
240528-3a8r3age6v 828-05-2024 23:18
240528-3ase3sge5s 620-05-2024 20:07
240520-yv4lmafb48 820-05-2024 15:26
240520-svdgjsgb5t 8Analysis
-
max time kernel
59s -
max time network
67s -
platform
android_x86 -
resource
android-x86-arm-20240611.1-en -
resource tags
androidarch:armarch:x86image:android-x86-arm-20240611.1-enlocale:en-usos:android-9-x86system -
submitted
12-06-2024 08:16
Behavioral task
behavioral1
Sample
file.apk
Resource
android-x64-20240611.1-en
Behavioral task
behavioral2
Sample
file.apk
Resource
android-x64-arm64-20240611.1-en
Behavioral task
behavioral3
Sample
file.apk
Resource
android-33-x64-arm64-20240611.1-en
Behavioral task
behavioral4
Sample
file.apk
Resource
android-x86-arm-20240611.1-en
General
-
Target
file.apk
-
Size
2.7MB
-
MD5
ac79187fd3024fb9cb5d1a872461503c
-
SHA1
c48240ce763e07b690e4fe79d6dfe69eeeebf8bd
-
SHA256
a6f6e6fb44626f8e609b3ccb6cbf73318baf01d08ef84720706b205f2864b116
-
SHA512
7f86e193359aab2d5970e7a3346bd98a96d35bea8074dc889d30eac3a3010181bd0c6a768b44895a717635a7ffc7e8cd4c3d8d95a80c9b09c2c137358c0603ae
-
SSDEEP
49152:U4CJQ42CbqPuuPx0ZH349hOVyPbs2faMrtm87ptAPfMW9pZU23V/1rF:U/OIuJ0RQhOVyg2ic7+HU23h1x
Malware Config
Signatures
-
Checks if the Android device is rooted. 1 TTPs 1 IoCs
Processes:
com.tejuhabilu.auto:AppMetricaioc Process /sbin/su com.tejuhabilu.auto:AppMetrica -
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
Processes:
com.tejuhabilu.autodescription ioc Process Framework service call android.app.IActivityManager.setServiceForeground com.tejuhabilu.auto -
Checks the presence of a debugger
-
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 2 IoCs
Processes:
com.tejuhabilu.autocom.tejuhabilu.auto:AppMetricadescription ioc Process Framework service call android.app.IActivityManager.registerReceiver com.tejuhabilu.auto Framework service call android.app.IActivityManager.registerReceiver com.tejuhabilu.auto:AppMetrica -
Schedules tasks to execute at a specified time 1 TTPs 1 IoCs
Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.
Processes:
com.tejuhabilu.autodescription ioc Process Framework service call android.app.job.IJobScheduler.schedule com.tejuhabilu.auto -
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
Processes:
com.tejuhabilu.auto:AppMetricadescription ioc Process Framework API call javax.crypto.Cipher.doFinal com.tejuhabilu.auto:AppMetrica
Processes
-
com.tejuhabilu.auto1⤵
- Makes use of the framework's foreground persistence service
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Schedules tasks to execute at a specified time
PID:4191
-
com.tejuhabilu.auto:AppMetrica1⤵
- Checks if the Android device is rooted.
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Uses Crypto APIs (Might try to encrypt user data)
PID:4288
Network
MITRE ATT&CK Mobile v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
24B
MD56fe526d7bd57a63126ee5d311718745a
SHA109055fdbf7793af48d6ec8304afcc2a220e1641f
SHA25697a48a51a9bd481619a792f1240314ad8f9e96575883d7c05dc2ec4d7c8176d1
SHA5123c6d01393e08ef281a8e4f1f2d6fc3cc3071eaf8e43cf960be032f763bf90917ff5c7cbaeedc127af1c6f299f2e9e9d89f143862d11c877574048c8161b82768
-
Filesize
8B
MD50a0c61c64f45d190bc2033108e35c904
SHA1e4d1889fa0ce95d5e8d9f2b1de192a0fcacdb60f
SHA25666a93d1631a2e6d721e63ed3f5f464c4622f2d01dd428326ae20a729d06f2e54
SHA512fd155fd62beb6b9c26705877a73b89ea0c2ad327915b4b8da6dde1680bea1a3483e4a81776f388d86338d6c4a1c2a6da35a2f5cec81201d43e909793bb227a55
-
Filesize
104KB
MD5a794ef860eb860f545730e3282b7c3fc
SHA1d9a480eb564730fa852c1af8a6ff63c04531fffb
SHA2565eb42ee7b85ff88c0818362cd9dd7fcac6f6bf8b3b86ebbbb56c272824865ff9
SHA5124c4515f4eec9c52139847ba0b26b1d821458fa175371da25ce2727fc8db2e13bd2f8da6f46d84c2c7a9607c1282e6953ec1ab571a75c42c59b6f34da48d0dd86
-
Filesize
229KB
MD599911cc955680119e33d2ffb51679c61
SHA14ef6fc6579fc97cdca8d659e80cc778b52207d4f
SHA256b9941d5e903b839d21c84d4cb07fad43e1371da4642c5195c3086268255f01fd
SHA5129d6b1107656efd31046431a3ff08e04a536b17868ff8386adb81ccc531c69f42333b46542e00fc10c8050b88590212a2279954c25fd8354fbabfcaf063d9e635
-
Filesize
32KB
MD5dd2321c6c2f72cd6ef7380693f1e0da2
SHA1f169d6455e6c81daa4a6634383a28345094c18eb
SHA2560c311926b7145e7aecd62ce4e1a15be1289b48f002e47713b04c8a592c006dc4
SHA5126ca56f38016cad0c543a7f06ca2b2289c4df940b1d795497e8dfe69e995f190d9026e92886553fcc23c7b585cc9fc583ed81589d52e60abafbfa260c798266e9
-
Filesize
32KB
MD51d51df756d7e6d1e3093ba8158e33b37
SHA1d9156a0378e8dfd915e5c55b0734cd87743c9238
SHA256ed63ab8ac0fab59b26ea98e2a6335db80be086ffe5568d5e2c6f7a86c825ee0c
SHA5123025383f143790df24040057f97a8aa9e68ca39b0b66ed4dd0836c953378de50bcf482e5fbff4eeaca8e649e183b90e1ed12a6a69f23282b4ac3e0f5241d05c1
-
Filesize
116KB
MD5c6ec5db7a51a170eeb632d63147be7ac
SHA1733be17f6400f9b31e20a03785a6bea85a4b6b53
SHA256dfdeae4bcf5a96ff50c3ef26f7096f4ca448fe2c88b971c143ef8bf783f7872f
SHA512f4944c7aaeb8cb10c5ad9f121b30478e3ad913cd2997a411fb2afc12d82b699cdd6899008c96885f663a328a5cbd0f07954fac6e18de5b7d1789204abb165545
-
Filesize
410KB
MD52ebd8eae34a64f8ab56f7c759c5c8455
SHA15c80f477cbd1f4e8b3f74c4583ec37a994396464
SHA25613709af4bef4815e0a5d2620decf2391572daab54390a6799a7cd5b384185ea9
SHA51277c803052c1fa69a1b2debf2c369e52644384f656eef94393a924c3ee53e52be27755d8c1435425040d1557995d8af70b96b3a3cc7e143bb5a50d6be028aca40
-
/data/data/com.tejuhabilu.auto/no_backup/appmetrica/analytics/appmetrica_vital_20799a27-fa80-4b36-b2db-0f8141f24180.dat
Filesize231B
MD57dde3896065e4d83a7f6295a91568ce1
SHA1cb4f77eaa4b5bab0d6262a045e335b03913941f9
SHA2565047cffc18dc109f355681427bbc727ffcac5c9f1314f4838685bd52d9413e33
SHA512863971499a69700968525dd93375bac0d38552bf9c4931fd1ef33eb0987af7960f549bc688decaa006fc45a321359e05baf27ae437edfc5d74d37c25fc4459c4
-
/data/data/com.tejuhabilu.auto/no_backup/appmetrica/analytics/appmetrica_vital_20799a27-fa80-4b36-b2db-0f8141f24180.dat
Filesize233B
MD5927333d206583084f7a4bbace754ea23
SHA11710652c6d3ae8d719ac6e2f63148dc08a2a1692
SHA256d688000f4c5391208fbfb9c6a04f57e970b5ac60759959deb944fa22cb8682e6
SHA5120f9ddd19b73428912c9da3f1a2a749ac5c44abe4d71bf876db2dc36418747b891943a467dd9f914529e6fe429226ef0277b3a4bdb2a4a68fadcfe50d98143f6e
-
/data/data/com.tejuhabilu.auto/no_backup/appmetrica/analytics/appmetrica_vital_20799a27-fa80-4b36-b2db-0f8141f24180.dat
Filesize284B
MD519ceaa8fe911c56388124b1a6dd24c7f
SHA146c5067326f207bf9841f2ec2766dc84a5697841
SHA256a32d66ba294e116af17cf121639cfd9ba8d299172038d0bbf77ae00f9ab1c4e7
SHA5120dc1c47b34319fc582190c7d37ba5f6ee638a98127a7508c06c25da1ae652873c3929b70dc4393da3c382eb1e618bee34c41a6741a926dee5607591380c684e5
-
/data/data/com.tejuhabilu.auto/no_backup/appmetrica/analytics/appmetrica_vital_637bd161-180f-4e80-9ba8-b725f3e45ed3.dat
Filesize242B
MD5c8f95a2d1ce9eaba8931abfa01485bfd
SHA1cc5091cd4f7509190f61beeba1e5a84785e06fc9
SHA2563f90d72e6aa2c22963cb650d8fb5463b10d21278d52bf4878ab972248d228bc9
SHA51220cd8f10c1fc2580442da278c2dd33c40a48ae9c341efcc69ecb2482a99df08c540a77dbedc76bf3032e0fffb6e26e1cd2e7c835ea69e81f212b1e1d6ba9b85c
-
/data/data/com.tejuhabilu.auto/no_backup/appmetrica/analytics/appmetrica_vital_637bd161-180f-4e80-9ba8-b725f3e45ed3.dat
Filesize242B
MD5ec0e4d1acd8be23b4ca9027097a74315
SHA1889ccd49b058cc8ca2dffef324af9779375218d9
SHA2568095f2dcca2f653caa19ac4497783704377516e6939dd7f68ab2662f78d69a84
SHA512374f1a0fa8ad6637015c5bc6e6aa2a906b69a10d88f5f326249f31c8bbc9b9f27dabd1275331f983448f47acabc5f2cf4e707c6c429026639d558a3f15f245bd
-
/data/data/com.tejuhabilu.auto/no_backup/appmetrica/analytics/appmetrica_vital_637bd161-180f-4e80-9ba8-b725f3e45ed3.dat
Filesize271B
MD57d2387ab23099a9c167650016cdc6400
SHA1357f4d74754af3bd0d781aa0ca5c60f0ad751b60
SHA25685baca9d5f3e8620c429377498a30769a218edddba535239595365ee8f966807
SHA512bfb7a9360f578bc67ad4cd8c7502fd9d79a0c0fe33abd94e3dc68bd92937b1e5f3a997adf9f36b035142c80248b5a0ee77f2a9fd704064af82dbb6e366f85897
-
/data/data/com.tejuhabilu.auto/no_backup/appmetrica/analytics/appmetrica_vital_637bd161-180f-4e80-9ba8-b725f3e45ed3.dat
Filesize280B
MD59434759b303165b6e35facdc4cea8a42
SHA1954e8bc7cc70f03026bee12cb225140af68017ff
SHA2569c20dd189bf0cc2403cae13d5063648d1a39f222f38c1db3ae633bc6fbd6477e
SHA5121e4ea390997edf8d5f62e32bba5df107b8bd03e6c00548269d6ac6565bb63d6500415dbcab2756852510dde5974d4e366bca071428e9a4a404811b99bc781cb0
-
Filesize
8KB
MD5468d17503f95edffa7875d3e63745ee8
SHA11b764df5fc007d0ea47d40a84b433109a4b786ab
SHA2568949f0df883f96f970a37df826e92fcda2bae91856d39cc1d827226e4378b617
SHA512a2807f7f63c77e6add85bc89e58fb5cee595bc70e5cf7e9d252187afe62faae9ccf2db0b69f9d0a95147d5daca717c0bf095d6c3324b5fe73ba6febc3a557e13
-
Filesize
20KB
MD5008314ec82c557173f9c816d89942784
SHA15b11e8f303fc90e660a2ade60d85c44fa0482021
SHA2567115b79b17b39e9d64fda131cbe2e4b741024d96591d1be0dc9069601a37d74e
SHA512cd1a7d17ea3c44a25b835a1ff67aee9f71123e2172401fb973a486b51dc0f55ed11ea13aef2515ac87e330aba8c8bb493487f2d505c06bcc4c30e9f11fc44d0c
-
Filesize
32KB
MD5bb7df04e1b0a2570657527a7e108ae23
SHA15188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA256c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
SHA512768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012
-
Filesize
32KB
MD5e726da5d10025be21ce16f2b75a489dc
SHA1b52afa1a931865784d6de1b9228d9d11e3717e39
SHA256a14f1355be71d3f20ebae258d4a721692b4665745986364daacc79fd961e9e63
SHA51268db16ea868fdb9ab78a7b3cf129a98561c42461a79903f0a7017a74af5927dd5cb7c417a64228fa895c98bee87d3aef96a178c30974a5b62d051ec43a3d1c8f
-
Filesize
32KB
MD5d41cb6009376c6cf020d82b93636ab8b
SHA19309c3c6163ce234a30df69edb38d9e4c79cbd21
SHA256c322ef4d2d8f71a23317d044c3554bf09d5aa0931b165ba842d4b70bdfa93444
SHA512634eec85b14111d2b248f86b35ab28f4c91c4e768ed7d98edc28f17aa4b784230b1b03c22ef5859e7cdf0b85276d2001a7977bb7fe6b10b7365db36f243d3fc4
-
Filesize
20KB
MD56fb9cb5c2bde6e6d10ee2a1916aa8e9e
SHA1e720927cbf23143659002d733891cf8a5822001a
SHA2568b4ccd51895c27378cab774d6f434143a175190469f362184da178f4e095acd8
SHA512e8e7029f246544e650167ce7c0f50ca6cf2f794446eedcd6b64ad6c780ccfa35cfdcc7932ddb1b6d3a93c72fb6bfd40718ea58708d0e9105b450e9828e6f0abe
-
Filesize
20KB
MD595931788d964c91add0f44bb15079ca9
SHA1082a4c2a28ee4b3c83c469928acdab604ad1e787
SHA256b4e5519516c15925fda3c4105f7c01deac70d6124de929ae1c05ae09321c9113
SHA5120f51e06c4b448f0e18d213dd2ee4675fbc57afbc780f9cccae10fc463c069ef13f399623797ebbcd004ef3ed6c7bb2d2e3680f341cdc4ee48399ea7f9e16fda7
-
Filesize
20KB
MD5fadf8b2c8e61e2f69e9a39feafe6817e
SHA1bc86f253602f283c3154469d84efc70f6d2dfe70
SHA256081db491f654fb16ef5ed37e25d750243fc0440ac049d1a293e973d94e879e33
SHA512e3d6b6a54fdf491a345ce0d716b217cb952c664884380aa004d618e3c6a53cd5b14f7c7960a1c5016104e8280486401176008b86d9a9680292a79ea4aa857e6d
-
Filesize
32KB
MD57ea89c913c5690fb2323c094240b4765
SHA10d5a58a92242f5c59f79880ff90e1382a1a0b963
SHA256c41ffc1c05a78aa2a6add753667feb74a72787fe910e78c456251f1b6d6c20f4
SHA512225bebd42b5c4cfc8adbdd362d95e1c584f6ffae4d024408256b02c84f8c2dfbc3806385c204f5465693464aae51a67c9f48d20a59bc1e89da42a930bef933c0
-
Filesize
20KB
MD5508b7b0b171d99077a6499faaa2eb84e
SHA12d82b56d9117d83ebd4db3802616cd39f4c90966
SHA256bad982ce1be1fe6333a02f1a21c50f49f01b96ac971506db13a1cd94515ca9dd
SHA512986d4d8cb4d57d77c2caee6bc8b9d1d54a97bd3194c26c936ebe59016957cd42cc97c24e19af90bca6a1ac0bb220eca5ec11415ad90649a07e4825c018e93fac
-
Filesize
512B
MD554f2e664fbf9f00cd840b2ed014ae60b
SHA1aeb8d8313c615098898dfbf58e80c51768b185a8
SHA2568f7c2b71988cf2337e6a347665547064cc5df093bf74d0f5dc0921b1dded77e4
SHA5129f8b447214fd5204109de00cedb7cb7d42932bd721027fd99095f3421771c8d723b7d8ddb61db0c6db3e1abfa550d2dfc6d027d7861ee85246a4adb2ce5197f6
-
Filesize
32KB
MD5c82717e277abb74dba54420bedee1cca
SHA1db40327b6a480fb55ce04f24d9035bd9b3141f0a
SHA2567987cb1811b799fe771b920876168fe5444ff3e592989671e2f8c98a11874fcf
SHA5120d3efc6b0cf97e1fccbcf011c5f3c745c45f81f81781f77d475c4036d5ed6bbbf753816a774ed82daf21ee4128d63a13ecc06fd739e823b0711740dad6d62c1c
-
Filesize
32KB
MD54f37070bb776ac2f4a10f629664c65a9
SHA136bf00d676d610bb7ad3f207a8a1b6c157c15adc
SHA25665d1b6e8893d01d9412862b45238de4db71d7b7809371b475376283233c32f15
SHA512433f66aacdb58ff257c784192b78cd22ecbf4f3ea7ba51a60b28e928ccd6abd290fb7228d654799f7d65c787ddd483930c6e8ff051f045c0d947079aeb9f1141
-
Filesize
20KB
MD563504f597a1ad3d2f6b01eefa4adc663
SHA1f809d40ac20a592439486bb7aa073f40c1656571
SHA2561d589988fa8881baee4d15f136123f43a41cb482d61b45a2063086d639532715
SHA512e764e5a20a82fffea2d1d55d87eb6db94ff3e554da4c0dbe2bb7b37bb4954c93b6c8ee536c68f8c133656ab1840b85fd8a2f1f02e7725ffa2172c8f9f7933d5e
-
Filesize
8KB
MD5e417636290a791b14956b5868ec43096
SHA1ef13a39bf48a02ee7b8d313775d5755aa8fe59f3
SHA2561d461b597def4c2397450f3c20c180d2dcf83441cdc6611c7b290f3ce9c640ae
SHA512cf315792d92ba7f4318409efbc632295a12d4d1730fc88478262365f1e2313354be238fe0ef45eed1a5c505e65153757d0e40c0e8c54e849c086b34a71375e74
-
Filesize
169KB
MD5684c9cbabde1a4fb59d6142e76e8b6e0
SHA136389007379af1a87cafac483849a344fac7f89b
SHA2563f6a5284d355c2cdf26499a36fad50413e93fad3d64ab47229cbf2b78fed414e
SHA5123150f5f8c239450ed233eb1410688896ed4d5af10a7661fcb6cec57d4666e3f9996455c82dc68567f0b710b07701f2c753391363a2191cdbaa9d0b14ff27b473
-
Filesize
8KB
MD582797906de053b64ef3c16629ba98a72
SHA1709249ec3d085cb0a2ef3b0a08d04faea51ff563
SHA25619e08ec680345d5d1cbdbda48e9b4d4fd5ecd546e237c8a65ae1a7c48f819968
SHA512d27223c6c874a26db63420a7a074c30c881affde513f1e8b5c70e7f68e3d3caf560867f0ab21d39df7ffe037de6a9d66474c9148e030ae6d7fd5d3acaa4bff12
-
/data/data/com.tejuhabilu.auto/no_backup/appmetrica/analytics/db/component_20799a27-fa80-4b36-b2db-0f8141f24180.db-journal
Filesize512B
MD5b82254e95bd80b7af010705fcb38d97b
SHA1b35b8b11994f3643587b9d2664981b4d7c8ebbd1
SHA256385db3379709b8ebfb5b57ab862f17a944f85fe9c3c5ab0be916a2ee95059dfc
SHA512d394b65daa80b7001001b097e8739ba5484575abc323b4abf45ebb79fa37ed5a8251dcfc8b513fa597c5c55606031648e0d10b3d1b814ffa1c9bcad81e79a1b0
-
/data/data/com.tejuhabilu.auto/no_backup/appmetrica/analytics/db/component_20799a27-fa80-4b36-b2db-0f8141f24180.db-wal
Filesize189KB
MD518b0f14c0ab545cbe4c495ba0cf0950f
SHA1d43ece1b639ca66a5c711da57a2c7ad7f6720828
SHA2565e596b9cde548b92ee5918d92b274f16964c8218924afaa09ec87549219153e3
SHA51231247b0e6e123b2f39cf2f47631752dec17d67f5da03c2646d3f7fbc6186185203f4d4f313e0326158e3a7ff0d0d3b319736772b13a9cc917279dd6a90ccd5d9
-
Filesize
4KB
MD5f2b4b0190b9f384ca885f0c8c9b14700
SHA1934ff2646757b5b6e7f20f6a0aa76c7f995d9361
SHA2560a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514
SHA512ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1
-
Filesize
8KB
MD5c86b8f068543daa0bbb8ae7f704e3106
SHA1811257466b118b43c33b5b5bd144b76d0034bc9c
SHA256d0ac1c32acf7047f2b221d1aa2a392f5f5892db39f4aa2e24ae1809b8386806e
SHA512d3f89ea3853b0d29135ec3f2ed7993b2aabb3f06c892cbc7d7760f4dc1b0b406ba2aded44714b1480055aac88871d9340c1c967db759e013398c50e9dbc5bb42
-
Filesize
1KB
MD5aed8a98f1caac9c0f140c11570e69525
SHA1553ced2f5eefc8798d933f5a356fea990bdb95b7
SHA25651bed96ca85c0e09336705e871b7fa6ee2f3681494ab450a6ed371de7dbfba52
SHA512bb9dc233c85209f4930b78da43192ed6224e8c262117f7c3122d1753b0345adf1f9bafd861e0aa54ad2822bb0b62fad280ca176ab38dc6bd5b4c2a7f8002fb84