Analysis
- max time kernel
7s - max time network
151s - platform
android_x64 - resource
android-x64-20240611.1-en - resource tags
androidarch:x64arch:x86image:android-x64-20240611.1-enlocale:en-usos:android-10-x64system - submitted
13/06/2024, 04:10
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
a8c4786bfeca5fdff386c6c81fee39f8b91dbc71d122fc665c2e4526b2ab2d5d.apk
Resource
android-x86-arm-20240611.1-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
a8c4786bfeca5fdff386c6c81fee39f8b91dbc71d122fc665c2e4526b2ab2d5d.apk
Resource
android-x64-20240611.1-en
3 signatures
150 seconds
General
- Target a8c4786bfeca5fdff386c6c81fee39f8b91dbc71d122fc665c2e4526b2ab2d5d.apk
- Size 309KB
- Sample240613-erwbasxdrk
- SHA256 a8c4786bfeca5fdff386c6c81fee39f8b91dbc71d122fc665c2e4526b2ab2d5d
- MD5 d47d51883ddd45e6cd22c4ccedaff2fc
- SHA1 8d58d4459dc8b896a534aad32335ec3316fc4991
- SHA512 89bf0639cafc9c2dcfbab00aab3dad705d102c858bcc3f96108000c906b7a56a2fce6ed10b095de8ad716d8669382a4619fb03069988046ac29f602d8b6c71b5
- SSDEEP 6144:/wTX/74HHeKNeH/DoLnC5y930bZflD9bzfOZVc20NdVM8aHI5zS:/40H+RGnCk9Mfx9aQNZaHItS
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Loads dropped Dex/Jar 1 TTPs 18 IoCs
Runs executable file dropped to the device during analysis.
ioc pid Process /data/user/0/com.dsbjshwhcuywehf25nvjhef.security/app_ajld.nkb.hc9x.cct/obfs/0.obfedex 5099 com.dsbjshwhcuywehf25nvjhef.security /data/user/0/com.dsbjshwhcuywehf25nvjhef.security/app_ajld.nkb.hc9x.cct/obfs/0.obfedex 5099 com.dsbjshwhcuywehf25nvjhef.security /data/user/0/com.dsbjshwhcuywehf25nvjhef.security/app_ajld.nkb.hc9x.cct/obfs/1.obfedex 5099 com.dsbjshwhcuywehf25nvjhef.security /data/user/0/com.dsbjshwhcuywehf25nvjhef.security/app_ajld.nkb.hc9x.cct/obfs/1.obfedex 5099 com.dsbjshwhcuywehf25nvjhef.security /data/user/0/com.dsbjshwhcuywehf25nvjhef.security/app_ajld.nkb.hc9x.cct/obfs/2.obfedex 5099 com.dsbjshwhcuywehf25nvjhef.security /data/user/0/com.dsbjshwhcuywehf25nvjhef.security/app_ajld.nkb.hc9x.cct/obfs/2.obfedex 5099 com.dsbjshwhcuywehf25nvjhef.security /data/user/0/com.dsbjshwhcuywehf25nvjhef.security/app_ajld.nkb.hc9x.cct/obfs/3.obfedex 5099 com.dsbjshwhcuywehf25nvjhef.security /data/user/0/com.dsbjshwhcuywehf25nvjhef.security/app_ajld.nkb.hc9x.cct/obfs/3.obfedex 5099 com.dsbjshwhcuywehf25nvjhef.security /data/user/0/com.dsbjshwhcuywehf25nvjhef.security/app_ajld.nkb.hc9x.cct/obfs/4.obfedex 5099 com.dsbjshwhcuywehf25nvjhef.security /data/user/0/com.dsbjshwhcuywehf25nvjhef.security/app_ajld.nkb.hc9x.cct/obfs/4.obfedex 5099 com.dsbjshwhcuywehf25nvjhef.security /data/user/0/com.dsbjshwhcuywehf25nvjhef.security/app_ajld.nkb.hc9x.cct/obfs/5.obfedex 5099 com.dsbjshwhcuywehf25nvjhef.security /data/user/0/com.dsbjshwhcuywehf25nvjhef.security/app_ajld.nkb.hc9x.cct/obfs/5.obfedex 5099 com.dsbjshwhcuywehf25nvjhef.security /data/user/0/com.dsbjshwhcuywehf25nvjhef.security/app_ajld.nkb.hc9x.cct/obfs/6.obfedex 5099 com.dsbjshwhcuywehf25nvjhef.security /data/user/0/com.dsbjshwhcuywehf25nvjhef.security/app_ajld.nkb.hc9x.cct/obfs/6.obfedex 5099 com.dsbjshwhcuywehf25nvjhef.security /data/user/0/com.dsbjshwhcuywehf25nvjhef.security/app_ajld.nkb.hc9x.cct/obfs/7.obfedex 5099 com.dsbjshwhcuywehf25nvjhef.security /data/user/0/com.dsbjshwhcuywehf25nvjhef.security/app_ajld.nkb.hc9x.cct/obfs/7.obfedex 5099 com.dsbjshwhcuywehf25nvjhef.security /data/user/0/com.dsbjshwhcuywehf25nvjhef.security/app_ajld.nkb.hc9x.cct/obfs/8.obfedex 5099 com.dsbjshwhcuywehf25nvjhef.security /data/user/0/com.dsbjshwhcuywehf25nvjhef.security/app_ajld.nkb.hc9x.cct/obfs/8.obfedex 5099 com.dsbjshwhcuywehf25nvjhef.security - Queries the phone number (MSISDN for GSM devices) 1 TTPs
- Reads information about phone network operator. 1 TTPs
Network
MITRE ATT&CK Mobile v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path /data/data/com.dsbjshwhcuywehf25nvjhef.security/app_ajld.nkb.hc9x.cct/obfs/0.obfedex
- Size 51KB
- SHA256 6750c0952fb9a83e0bb9d3f1ba1232b7a2af5c13af9c58727f6a4d9cbbfff76f
- MD5 cb7dc5e072160ac36f811ac18b4a6b81
- SHA1 62876101d742972e8dfd4e54ba6aae21093095a5
- SHA512 8925332a43059f959967bddd415b2312acca245aeba8c053bd0f29a20858b79672687a10b6f1300ffb51e96e2d362ed5eac1dfdfe911bb569e3b810a837f4fe9
- SSDEEP 768:rIVIdwQoK9sg5qv6bIQkGpzTRrcneSia1de5YwS4mR5J7SHmQg9DLEN:EnXKB5qlQfzTCia1czmRSy5k
- MD5 SHA1 SHA512 SSDEEP
- Path /data/data/com.dsbjshwhcuywehf25nvjhef.security/app_ajld.nkb.hc9x.cct/obfs/1.obfedex
- Size 59KB
- SHA256 368d102143ab67ffd68610bf58aecef09358c7c83b72bc062fedb2cf92031b65
- MD5 1ce9e7774eb0be3d298390dafbd484ed
- SHA1 ecbf7676457491f0a055586cf0b542d6b106ca35
- SHA512 a3df6573cfb9330cefd46c139edd1adce4c5da425f564b1a41de0f59eeb74b712ce882378333003a7a3956983fa586f6354a3531e36344ccd4c450851a65ed13
- SSDEEP 768:ldGXmq5Se7qCZikQOMu7uZheZY7QWfk6bOsx9fDkeCETtYz:nGXH5/qcQptZhe27QWfk6bOs7D2EBU
- MD5 SHA1 SHA512 SSDEEP
- Path /data/data/com.dsbjshwhcuywehf25nvjhef.security/app_ajld.nkb.hc9x.cct/obfs/2.obfedex
- Size 19KB
- SHA256 4cf354e0ff6b766f594493687b3c139255c12dedd7673f4118480f4afbff6f0a
- MD5 9dc67f97165170c4d75e9db7397b0c81
- SHA1 360571024142571de71e998150a237e9a8f359fc
- SHA512 23def1058871f81293c7f40365341436b4950e9da85ce650b3526fa848aa416c9105e349a8d576f929b94deb8c2680fd9680f4070639984952fcb4f8e6fc9be8
- SSDEEP 192:YnM/ffXNmoP+NC1T1iJeEi7UAWHRz9wljhD/uzDvNuc5BifZAYkF2u3xBxhiP:YnM/HNm96Fsy5uvvMrZA3F2uhBeP
- MD5 SHA1 SHA512 SSDEEP
- Path /data/data/com.dsbjshwhcuywehf25nvjhef.security/app_ajld.nkb.hc9x.cct/obfs/3.obfedex
- Size 15KB
- SHA256 d116e56641ed48f80242f0473b52e81cc6c4d0909abc3008e5b46e8baf3efb0a
- MD5 0271846c2cbc4568e7921d68f6013d83
- SHA1 4086a8b6dbfaa311ca92452d611426a1f435e3d5
- SHA512 5766e0b9710ace2c9aa674130ff93c5391e7cfed9c2473f43d7433e14c895a5ef95753b345dff8ee5a0bf162afc312d9adbd32c7231ddb552df41e9f56c268b1
- SSDEEP 192:/o6srNPN3lTwIgC9eHfVDa+x9IEwIQ4oWMirqeERPJ4SbUn6j:Q6wNFIC9+V9QAr3cbUc
- MD5 SHA1 SHA512 SSDEEP
- Path /data/data/com.dsbjshwhcuywehf25nvjhef.security/app_ajld.nkb.hc9x.cct/obfs/4.obfedex
- Size 5KB
- SHA256 ffe80dfa2b45d35bfe163cea57408f4f85aa27f6b51aa162549bd1cd72891872
- MD5 21703d96baf77ccb28cf1c8a4c36d837
- SHA1 cdd9ae2d267ec11c42e4b99404b568136b92731a
- SHA512 70976891add851a560da4e170c8f01bd729ce58f4539b88fb21e2647450c2a51e9c06c9cfd26369a692807e8f72017f15f870d664d903e22d56cbee3440b9b96
- SSDEEP 96:dwfPqBnz7hzvgct27OPYQnogZzUGMI4ofXJjfVxmRr:dwfPOhzIOPYQnoYpMUne
- MD5 SHA1 SHA512 SSDEEP
- Path /data/data/com.dsbjshwhcuywehf25nvjhef.security/app_ajld.nkb.hc9x.cct/obfs/5.obfedex
- Size 7KB
- SHA256 e547fdefd1dd6a4cc410fc1a01f220e9e964c9d07448511461cc34a10212c2d2
- MD5 01bf6d893ad16f179aed2d8f4f452931
- SHA1 9a65f25c80153395ea1fd76152b1ba647375738f
- SHA512 fcfd19884cef3189c28131a3238445951da1278e01f64b8110c85a528fb254f068bc64d3b525d313b6c4e7bd7b3eb0517e6f1420c03765e7db66fe82ab9f5886
- SSDEEP 192:28F1EtmwrmqgPsxqKo1Yd++rjWVdOiZ3xoIkDVy:TWgimuYKo1Yd++raVdOAvk8
- MD5 SHA1 SHA512 SSDEEP
- Path /data/data/com.dsbjshwhcuywehf25nvjhef.security/app_ajld.nkb.hc9x.cct/obfs/6.obfedex
- Size 4KB
- SHA256 f26e8627c19105e71cf6ac6009cf422a3cf23473c4fd5ce61f0b5e1086c6f7d5
- MD5 b3597d369cf86dee48ce8f7d4f2f5206
- SHA1 0f925790e5bf34734deacd2a4d14a892122952eb
- SHA512 25f4056bb55df31e984a0573c103518f4bba90ee7e36c201c0cd9fd1bbedf329f0c3a2bd9d3ed238ae146d7d24a361a11688dbc72c8e803f0891ee6f9340d51d
- SSDEEP 48:HVtG0UdubE6ClYvmVYqFk9wJp5vKlHixmlkJYty1GlibIg2Ea9fu:1t5iubE6uYvmVYGTdKpSJUlibVV+u
- MD5 SHA1 SHA512 SSDEEP
- Path /data/data/com.dsbjshwhcuywehf25nvjhef.security/app_ajld.nkb.hc9x.cct/obfs/7.obfedex
- Size 1KB
- SHA256 94169f8a887674910163c7e626120c362aca79669229c2fd7c410f150482d02a
- MD5 c3fc18a9e98aa826f0e7cd4132b750de
- SHA1 1341a2bcc6adfe7618a459a2c5bfae40a47837b9
- SHA512 0e060d237a4ae4d19539906d3e5f92efc271c59fd5abc2cb3c998661e85991b157034e489bbf552e80e6208d486902806e70a49dbaae247ec201a8ff8fe56734
- MD5 SHA1 SHA512
- Path /data/data/com.dsbjshwhcuywehf25nvjhef.security/app_ajld.nkb.hc9x.cct/obfs/8.obfedex
- Size 9KB
- SHA256 5d9d113f05ab4b6d703f13cf0c4c6857dda9eec725826d394297c804dfb792bb
- MD5 646f2c70e74a8ef5a146ceafad971404
- SHA1 49575cec91603f01969196802fd0f6f3651cd5df
- SHA512 bc026b1d2f29214f18ca36051876203c87f07429ab7d886969e0be22fea21adb9ca4877e51452d4361bff5b27cd20ab612fc0ffb31943ee36ecd4b77f0b479dc
- SSDEEP 192:5KvAAxMuvlXrETXICFhmb4DRh/TM6zJfaMc:9HuvlUXrfmwzxaMc
- MD5 SHA1 SHA512 SSDEEP
- Path /storage/emulated/0/dsbjshwhcuywehf25nvjhef.txt
- Size 2B
- SHA256 4fc82b26aecb47d2868c4efbe3581732a3e7cbcc6c2efb32062c08170a05eeb8
- MD5 6512bd43d9caa6e02c990b0a82652dca
- SHA1 17ba0791499db908433b80f37c5fbc89b870084b
- SHA512 74a49c698dbd3c12e36b0b287447d833f74f3937ff132ebff7054baa18623c35a705bb18b82e2ac0384b5127db97016e63609f712bc90e3506cfbea97599f46f
- MD5 SHA1 SHA512