Analysis
- max time kernel
8s - max time network
150s - platform
android_x64 - resource
android-x64-20240611.1-en - resource tags
androidarch:x64arch:x86image:android-x64-20240611.1-enlocale:en-usos:android-10-x64system - submitted
14/06/2024, 23:31
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
b00f11c8f6fe590dbc39eb816f6dd058c407d55176bbb5aa7c43d409740d8a70.apk
Resource
android-x86-arm-20240611.1-en
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
b00f11c8f6fe590dbc39eb816f6dd058c407d55176bbb5aa7c43d409740d8a70.apk
Resource
android-x64-20240611.1-en
3 signatures
150 seconds
General
- Target b00f11c8f6fe590dbc39eb816f6dd058c407d55176bbb5aa7c43d409740d8a70.apk
- Size 321KB
- Sample240614-3htm4s1aqc
- SHA256 b00f11c8f6fe590dbc39eb816f6dd058c407d55176bbb5aa7c43d409740d8a70
- MD5 88459962c1dd7513d732cb375d834954
- SHA1 f5980dbbd7a1645a895ee14da4e201d105b5f081
- SHA512 44569211ea9236ce390bf7b59020ed31c846acb63d276e775530cf33c97729c09e1fee9b073896022b470d59246caea7ffbb9e1b280edc19d909ce722edc4b29
- SSDEEP 6144:psfHWp5SKQ3ADorJSaocKst2XKI091ISN2y:KfyMccrJSaLmN091LP
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Loads dropped Dex/Jar 1 TTPs 18 IoCs
Runs executable file dropped to the device during analysis.
ioc pid Process /data/user/0/com.dzbfewsjkwenmcew3hjyfd.security/app_eso2.dnq.lh9o.d3t/obfs/0.obfedex 5044 com.dzbfewsjkwenmcew3hjyfd.security /data/user/0/com.dzbfewsjkwenmcew3hjyfd.security/app_eso2.dnq.lh9o.d3t/obfs/0.obfedex 5044 com.dzbfewsjkwenmcew3hjyfd.security /data/user/0/com.dzbfewsjkwenmcew3hjyfd.security/app_eso2.dnq.lh9o.d3t/obfs/1.obfedex 5044 com.dzbfewsjkwenmcew3hjyfd.security /data/user/0/com.dzbfewsjkwenmcew3hjyfd.security/app_eso2.dnq.lh9o.d3t/obfs/1.obfedex 5044 com.dzbfewsjkwenmcew3hjyfd.security /data/user/0/com.dzbfewsjkwenmcew3hjyfd.security/app_eso2.dnq.lh9o.d3t/obfs/2.obfedex 5044 com.dzbfewsjkwenmcew3hjyfd.security /data/user/0/com.dzbfewsjkwenmcew3hjyfd.security/app_eso2.dnq.lh9o.d3t/obfs/2.obfedex 5044 com.dzbfewsjkwenmcew3hjyfd.security /data/user/0/com.dzbfewsjkwenmcew3hjyfd.security/app_eso2.dnq.lh9o.d3t/obfs/3.obfedex 5044 com.dzbfewsjkwenmcew3hjyfd.security /data/user/0/com.dzbfewsjkwenmcew3hjyfd.security/app_eso2.dnq.lh9o.d3t/obfs/3.obfedex 5044 com.dzbfewsjkwenmcew3hjyfd.security /data/user/0/com.dzbfewsjkwenmcew3hjyfd.security/app_eso2.dnq.lh9o.d3t/obfs/4.obfedex 5044 com.dzbfewsjkwenmcew3hjyfd.security /data/user/0/com.dzbfewsjkwenmcew3hjyfd.security/app_eso2.dnq.lh9o.d3t/obfs/4.obfedex 5044 com.dzbfewsjkwenmcew3hjyfd.security /data/user/0/com.dzbfewsjkwenmcew3hjyfd.security/app_eso2.dnq.lh9o.d3t/obfs/5.obfedex 5044 com.dzbfewsjkwenmcew3hjyfd.security /data/user/0/com.dzbfewsjkwenmcew3hjyfd.security/app_eso2.dnq.lh9o.d3t/obfs/5.obfedex 5044 com.dzbfewsjkwenmcew3hjyfd.security /data/user/0/com.dzbfewsjkwenmcew3hjyfd.security/app_eso2.dnq.lh9o.d3t/obfs/6.obfedex 5044 com.dzbfewsjkwenmcew3hjyfd.security /data/user/0/com.dzbfewsjkwenmcew3hjyfd.security/app_eso2.dnq.lh9o.d3t/obfs/6.obfedex 5044 com.dzbfewsjkwenmcew3hjyfd.security /data/user/0/com.dzbfewsjkwenmcew3hjyfd.security/app_eso2.dnq.lh9o.d3t/obfs/7.obfedex 5044 com.dzbfewsjkwenmcew3hjyfd.security /data/user/0/com.dzbfewsjkwenmcew3hjyfd.security/app_eso2.dnq.lh9o.d3t/obfs/7.obfedex 5044 com.dzbfewsjkwenmcew3hjyfd.security /data/user/0/com.dzbfewsjkwenmcew3hjyfd.security/app_eso2.dnq.lh9o.d3t/obfs/8.obfedex 5044 com.dzbfewsjkwenmcew3hjyfd.security /data/user/0/com.dzbfewsjkwenmcew3hjyfd.security/app_eso2.dnq.lh9o.d3t/obfs/8.obfedex 5044 com.dzbfewsjkwenmcew3hjyfd.security - Queries the phone number (MSISDN for GSM devices) 1 TTPs
- Reads information about phone network operator. 1 TTPs
Network
MITRE ATT&CK Mobile v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path /data/data/com.dzbfewsjkwenmcew3hjyfd.security/app_eso2.dnq.lh9o.d3t/obfs/0.obfedex
- Size 53KB
- SHA256 5b59001125c32437e6e9c0017b578dc872b2564ded264ea68aefba39ea66953a
- MD5 51dff3bd141fa305353d9773aa27111c
- SHA1 b9863a9e38de202d1c6fd2413cbfc55f7309654a
- SHA512 76fce04e02a4dae1f0d4735caa20c60819327decf529f91831ebbb4fa88878dfdc2e833fa9ec169aa3703d6cbf8989b01c2484b1d391991b63c470b05d677900
- SSDEEP 768:hAxL/C72NL0HiJ40XZFWNWOmBmjOK9r1KDE+oiyyJXiN4Bui:SxzCCNeiOKZFWNH1KwJD7mQi
- MD5 SHA1 SHA512 SSDEEP
- Path /data/data/com.dzbfewsjkwenmcew3hjyfd.security/app_eso2.dnq.lh9o.d3t/obfs/1.obfedex
- Size 61KB
- SHA256 109ccc97c218a5da5b53f761c8442b44163bd02295940c3303acea1ec22ad67d
- MD5 cab684a32cf74de27ef553f3f3fb2844
- SHA1 5b04422078e5a12ac347e6ae06a6e96d57a4a940
- SHA512 cb9eb9d4d718b2c144c9a32b2efdb7238ca35eb13d3b6578d6f4abba65eed7800c9998875abb6cc97fadaffa3305857285a60f4b8534a0ce2a661047aecdc0b7
- SSDEEP 768:7RuQAiia4HSyKg6K7aGhsfa1jqM8lUmX0PhoRINwd2wABI:tuEOeDGhH7LmXarNeuI
- MD5 SHA1 SHA512 SSDEEP
- Path /data/data/com.dzbfewsjkwenmcew3hjyfd.security/app_eso2.dnq.lh9o.d3t/obfs/2.obfedex
- Size 18KB
- SHA256 4885c4a4b40d4d03b7fff07e7634b72021280f9a5c4c30e02d76d91e9d61aa02
- MD5 a180d132f539a323179bbcd74cbbcc82
- SHA1 4e0cf9d62a3225be6d3f0e6e20792262d87fc264
- SHA512 6c5da3d046a7736314da469a62913eb3c5ee05e33cf7aa5e3e6b602470153e138f43a7ad03bbcc509c128e3af7dfa80a8484b88bea51431f1d3db7d7d4fe2425
- SSDEEP 384:MI+NoyWJlK2iONu00ClZRxqG0hgZEdruLj:MI+tWrK2I0nlZvqd4L
- MD5 SHA1 SHA512 SSDEEP
- Path /data/data/com.dzbfewsjkwenmcew3hjyfd.security/app_eso2.dnq.lh9o.d3t/obfs/3.obfedex
- Size 15KB
- SHA256 a80f8ad298d075fdac2c288366f87766b9da346e88a179e8591ffa901f63f29f
- MD5 0c564701cfe17f54e710054ea226239e
- SHA1 7a03309d4591e3ebbdc3f0b083ee46a6563134bd
- SHA512 96d52862184eba6dfce8df9adbbc388fa7cdc17020eb7825efba4126357c396994aa4190ac8e7763d966d2b5bf005b02fcd7eff7ed9a8815b93ef3e19000953a
- SSDEEP 384:/3LTjf6Et9EBaBB3irN8kjKC38V3St37kJ6lt04vQk1Kz:PDn9zwrN8eKC38V3s3Qut0B
- MD5 SHA1 SHA512 SSDEEP
- Path /data/data/com.dzbfewsjkwenmcew3hjyfd.security/app_eso2.dnq.lh9o.d3t/obfs/4.obfedex
- Size 5KB
- SHA256 d9843c156dc4e6d018082f9139ac5dd3ef9257cad14c711e4f3d9ca1e4c24984
- MD5 8d5e3a52ba775efe3e9c84c6f65aaf01
- SHA1 2a0e4501a23707b721cdd342958567c23dcc37d4
- SHA512 979856cff5d6d922ae0dc1878532cdc0134bb8d699c36db7c2364d9a829d64a53cf194a7b72bf7f255e69af84bb41133fd5b7a798c82a609a25d52d593cfe6b0
- SSDEEP 96:MD8hPjNhMqhKZx7OPYQw4x4f+p1o1d1aXWbhy11:MIRzMquVOPYQw81p1o1dfyz
- MD5 SHA1 SHA512 SSDEEP
- Path /data/data/com.dzbfewsjkwenmcew3hjyfd.security/app_eso2.dnq.lh9o.d3t/obfs/5.obfedex
- Size 7KB
- SHA256 bd4e497e29b6e1109e8800b85eb48389d6a88c7659b27159871d6eb99fb3dd9d
- MD5 c9c67e5c6f41dd73a54aef5805f5bc31
- SHA1 8bc0149fc900ea1a357f23ee11e7ad4f40d87f81
- SHA512 b697e1d2be7b7185174a275e2a7858f49b83edaa1f08a5ab0e468f126a7759b75243cde58dae9460c23d4c1fcf7789177a7e86a4f7fb44709528f5f08ec0fd7e
- SSDEEP 192:gt2fDTx39GQJxri7/7Ko1Yd++rD+6sLwdv:g8pNGQjiT7Ko1Yd++rS6sch
- MD5 SHA1 SHA512 SSDEEP
- Path /data/data/com.dzbfewsjkwenmcew3hjyfd.security/app_eso2.dnq.lh9o.d3t/obfs/6.obfedex
- Size 4KB
- SHA256 f26e8627c19105e71cf6ac6009cf422a3cf23473c4fd5ce61f0b5e1086c6f7d5
- MD5 b3597d369cf86dee48ce8f7d4f2f5206
- SHA1 0f925790e5bf34734deacd2a4d14a892122952eb
- SHA512 25f4056bb55df31e984a0573c103518f4bba90ee7e36c201c0cd9fd1bbedf329f0c3a2bd9d3ed238ae146d7d24a361a11688dbc72c8e803f0891ee6f9340d51d
- SSDEEP 48:HVtG0UdubE6ClYvmVYqFk9wJp5vKlHixmlkJYty1GlibIg2Ea9fu:1t5iubE6uYvmVYGTdKpSJUlibVV+u
- MD5 SHA1 SHA512 SSDEEP
- Path /data/data/com.dzbfewsjkwenmcew3hjyfd.security/app_eso2.dnq.lh9o.d3t/obfs/7.obfedex
- Size 1KB
- SHA256 ee5a0e8a4ce6ed0d81b2a459eec85ed1352f25e3862e923774d3f76ae09e4b92
- MD5 052dda24190f70b13914df076028b145
- SHA1 902782ae64c24cffbaafd87395a869e3a08784b9
- SHA512 6cb7f0eeaa0e8d97102c1f2489fd925e6eac9bf7e0574abc2b321b4eddb48a3c5710ac698138885079aa66c73d0070727a51fd8fcf4f52efc0556aaa28756cb3
- MD5 SHA1 SHA512
- Path /data/data/com.dzbfewsjkwenmcew3hjyfd.security/app_eso2.dnq.lh9o.d3t/obfs/8.obfedex
- Size 9KB
- SHA256 3e1c2532877fd3dbb5782bf272dfc4e7b6e4d40edba02a1c87b54a4f389aee5d
- MD5 7323b529ee55e4a8cb527168e590bde1
- SHA1 8ff3c45e012ea21f0263565e9e09af16423c4bb2
- SHA512 9be5962ad0a9809d15707dc25f0c83e5ac023912a12088734d9585a9db75749c24bd0f838b4e805d3e34c19bb1ee4d13506194817fb47a460b74cc3eae9219c4
- SSDEEP 96:q9hdg0suBQWLoFlw/7QIpNsRPqHLjXoI99Uqenh2h2u6mNyJDDsfYCOHz3bYmqfK:q3dquGWLoQjrHLsI/jS2h2XmwJ1qfK
- MD5 SHA1 SHA512 SSDEEP
- Path /storage/emulated/0/dzbfewsjkwenmcew3hjyfd.txt
- Size 2B
- SHA256 4fc82b26aecb47d2868c4efbe3581732a3e7cbcc6c2efb32062c08170a05eeb8
- MD5 6512bd43d9caa6e02c990b0a82652dca
- SHA1 17ba0791499db908433b80f37c5fbc89b870084b
- SHA512 74a49c698dbd3c12e36b0b287447d833f74f3937ff132ebff7054baa18623c35a705bb18b82e2ac0384b5127db97016e63609f712bc90e3506cfbea97599f46f
- MD5 SHA1 SHA512