Analysis
- max time kernel
155s - max time network
132s - platform
android_x64 - resource
android-33-x64-arm64-20240611.1-en - resource tags
androidarch:arm64arch:x64image:android-33-x64-arm64-20240611.1-enlocale:en-usos:android-13-x64system - submitted
15/06/2024, 00:50
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
1c3d77e05700fce8747e1de9d952fc8566f0db1ba188841746215a20a2ba63a1.apk
Resource
android-33-x64-arm64-20240611.1-en
5 signatures
150 seconds
General
- Target 1c3d77e05700fce8747e1de9d952fc8566f0db1ba188841746215a20a2ba63a1.apk
- Size 2.7MB
- Sample240615-a63ayatalb
- SHA256 1c3d77e05700fce8747e1de9d952fc8566f0db1ba188841746215a20a2ba63a1
- MD5 c9091b647d2444e703d9d3aa5fc43d1b
- SHA1 9c562f10465bda366f56dd8d4af3532246c0de98
- SHA512 f7a646ad2819dd0b0e64818034b9b1c057897f044703c9af25845daf93207a786ea7081d4d7574332efaa261bd4aa05e6d6c6cc93d2cb4fe7b5931b8fd31f4b7
- SSDEEP 49152:EjXLQpeYod+8cqvjN9atSJsCCrcf0+pQkwykx8XiP1U3dpO5EJz6K:EjMpho8ZMj+Iagf0+pQkwGXQ1YdpVuK
- MD5 SHA1 SHA512 SSDEEP
Score
7/10
Malware Config
Signatures
- Loads dropped Dex/Jar 1 TTPs 2 IoCs
Runs executable file dropped to the device during analysis.
ioc pid Process /data/user/0/com.goosmksesmscom/.arm/6E4D52BA.dex 4313 com.goosmksesmscom /data/user/0/com.goosmksesmscom/.arm/6E4D52BA.dex 4476 com.goosmksesmscom:remote - Acquires the wake lock 1 IoCs
description ioc Process Framework service call android.os.IPowerManager.acquireWakeLock com.goosmksesmscom - Queries information about active data network 1 TTPs 1 IoCs
description ioc Process Framework service call android.net.IConnectivityManager.getActiveNetworkInfo com.goosmksesmscom - Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
description ioc Process Intent action android.settings.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS com.goosmksesmscom - Schedules tasks to execute at a specified time 1 TTPs 2 IoCs
Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.
description ioc Process Framework service call android.app.job.IJobScheduler.schedule com.goosmksesmscom Framework service call android.app.job.IJobScheduler.schedule com.goosmksesmscom:remote
Processes
-
com.goosmksesmscom1⤵
- Loads dropped Dex/Jar
- Acquires the wake lock
- Queries information about active data network
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Schedules tasks to execute at a specified time
PID:4313
-
com.goosmksesmscom:remote1⤵
- Loads dropped Dex/Jar
- Schedules tasks to execute at a specified time
PID:4476
Network
MITRE ATT&CK Mobile v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path /data/user/0/com.goosmksesmscom/.arm/6E4D52BA.dex
- Size 2.4MB
- SHA256 021961d52797efef9bb51a8c908b9ebbde9688e748dd2a8874cd814eb80d1540
- MD5 cbfc5117533f02d74f885eb3caa48c42
- SHA1 ef3e6e3c15cce4cadb932d5cced6ffbec0322327
- SHA512 f4dc6ec1d670b43572ea1151f8a0d8c55e9d03b49662206041ad32a48c95963411df9ebf70cc91d868085d110fccfb01898d7ad36cdbbbfb3dfb7ac5757d5146
- SSDEEP 24576:bjnCyQuNXfIOEEAsrfmNZktkfGdn4UXoPA1rwGQ7Uasg540LK/MqA2I:LNXAOE5srONZQeGt4UXRQU0Liy
- MD5 SHA1 SHA512 SSDEEP
- Path /data/user/0/com.goosmksesmscom/files/config
- Size 106B
- SHA256 21250b025f698caa9b860a49c485356205fcc06e7b30edf55ad2b3eb03709aff
- MD5 bdab00f3731c5583044e7ad377dc2d62
- SHA1 154e515a6623fb3d144c44eaab844dbb1bc01657
- SHA512 3f56f9884ef6af770e438359e44ffe9ca15e76426f1bf30e5314a5c4517852498a9ca15d2a53cac78e2ddae190032627fe9b03fb98577ff83ddeb42adccaf614
- MD5 SHA1 SHA512
- Path /data/user/0/com.goosmksesmscom/files/config
- Size 106B
- SHA256 341146b6b622c6baf6b05192365073d0bdc9997f82ff8ace11603dd08020523d
- MD5 1f01667fd267e0fe3d83889d839c5d2b
- SHA1 b0e2ecd26695bf53f3a60fa4bcc75a10450881da
- SHA512 ed3de476c2d851d89ce8c633dc7de244eaeffd02c5f638c46a976355935b85f71301956c9e05cdbc0af6180f88542413f255e21b092b471efa48a13936a94187
- MD5 SHA1 SHA512