Analysis

  • max time kernel
    35s
  • max time network
    130s
  • platform
    android_x64
  • resource
    android-33-x64-arm64-20240624-en
  • resource tags

    androidarch:arm64arch:x64image:android-33-x64-arm64-20240624-enlocale:en-usos:android-13-x64system
  • submitted
    02/07/2024, 13:28

General

  • Target
    Headshot GFX Tool and Sensitivity settings Guide_1.0_APKPure.apk
  • Size 12.4MB
  • Sample240702-qqnqlsycmk
  • SHA256 a2e9da586411cee6f15412ed34ae8b5f3e324fbe94cb78ae3e1354a612d872f2
  • MD5 SHA1 SHA512 SSDEEP

Malware Config

Signatures

  • Checks if the Android device is rooted. 1 TTPs 1 IoCs
  • Loads dropped Dex/Jar 1 TTPs 31 IoCs

    Runs executable file dropped to the device during analysis.

  • Queries information about running processes on the device 1 TTPs 1 IoCs

    Application may abuse the framework's APIs to collect information about running processes on the device.

  • Acquires the wake lock 1 IoCs
  • Queries information about active data network 1 TTPs 1 IoCs
  • Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
  • Checks memory information 2 TTPs 1 IoCs

Processes

  • com.livevideocallingapps.headshot
    1⤵
    • Checks if the Android device is rooted.
    • Loads dropped Dex/Jar
    • Queries information about running processes on the device
    • Acquires the wake lock
    • Queries information about active data network
    • Uses Crypto APIs (Might try to encrypt user data)
    • Checks memory information
    PID:4322

Network

        MITRE ATT&CK Mobile v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        framework-adservices.jar

        • Path /apex/com.android.adservices/javalib/framework-adservices.jar
        • Size 25KB
        • SHA256 ebf554eca9585be7cc99314e35c844d481ab811456055a1127b3df4641cf2ffb
        • MD5 SHA1 SHA512 SSDEEP

        framework-sdksandbox.jar

        • Path /apex/com.android.adservices/javalib/framework-sdksandbox.jar
        • Size 11KB
        • SHA256 e71199d47af29d61859792529bfee051ebb23b92747d57e402d6af30c8d2a9c2
        • MD5 SHA1 SHA512 SSDEEP

        framework-appsearch.jar

        • Path /apex/com.android.appsearch/javalib/framework-appsearch.jar
        • Size 145KB
        • SHA256 a77cfbc9d66d3fde22540b2e6a5bee8ce21dbeb3f66c0d9121764513188252f7
        • MD5 SHA1 SHA512 SSDEEP

        apache-xml.jar

        • Path /apex/com.android.art/javalib/apache-xml.jar
        • Size 1.2MB
        • SHA256 a592316ce171525b731179a84d91a1f7824d5e7c2c6f713d038163a95f7f3626
        • MD5 SHA1 SHA512 SSDEEP

        bouncycastle.jar

        • Path /apex/com.android.art/javalib/bouncycastle.jar
        • Size 1.4MB
        • SHA256 b12a49fda7dec105cac09b6d77b083d37b1be5d52f4f265790f2e348e5783f06
        • MD5 SHA1 SHA512 SSDEEP

        core-libart.jar

        • Path /apex/com.android.art/javalib/core-libart.jar
        • Size 549KB
        • SHA256 eb3b040c7700fccdc6a637ff9628c0867b6f48ebac4b09c2b5bb4dd77baf3d38
        • MD5 SHA1 SHA512 SSDEEP

        core-oj.jar

        • Path /apex/com.android.art/javalib/core-oj.jar
        • Size 5.0MB
        • SHA256 d9d541d074d858571d60e2964fd39fb74130217fa7c92d74ed1695b0962837cf
        • MD5 SHA1 SHA512 SSDEEP

        okhttp.jar

        • Path /apex/com.android.art/javalib/okhttp.jar
        • Size 397KB
        • SHA256 14d759d0257e1be79263f4ff0bd41548af7f83f7d5f8f5029dae5e58a4687ada
        • MD5 SHA1 SHA512 SSDEEP

        framework-bluetooth.jar

        • Path /apex/com.android.btservices/javalib/framework-bluetooth.jar
        • Size 937KB
        • SHA256 9f51175dca7d241cff99acba4f8e29a1b781f3d16a72baebc8ab7434ded1869c
        • MD5 SHA1 SHA512 SSDEEP

        conscrypt.jar

        • Path /apex/com.android.conscrypt/javalib/conscrypt.jar
        • Size 453KB
        • SHA256 787aa8fdbb20b5a4df8a61213c8df30de929dc610967f32712611b323d89d32d
        • MD5 SHA1 SHA512 SSDEEP

        core-icu4j.jar

        • Path /apex/com.android.i18n/javalib/core-icu4j.jar
        • Size 2.7MB
        • SHA256 baa7c3b0f8df0cb4e6b925b44ccf99dbe35dbf4be00a0ae33c5e4eeb173ce7f5
        • MD5 SHA1 SHA512 SSDEEP

        android.net.ipsec.ike.jar

        • Path /apex/com.android.ipsec/javalib/android.net.ipsec.ike.jar
        • Size 670KB
        • SHA256 dbf99fd2ecc3f0a085855d9a53881b91132da8f0e85dd11d92ee46db01d6ab83
        • MD5 SHA1 SHA512 SSDEEP

        updatable-media.jar

        • Path /apex/com.android.media/javalib/updatable-media.jar
        • Size 482KB
        • SHA256 19eb02aed8c826a9a4b74d11a345e8ecbe1fe5562c5b9d13ac1286efaa4771e9
        • MD5 SHA1 SHA512 SSDEEP

        framework-mediaprovider.jar

        • Path /apex/com.android.mediaprovider/javalib/framework-mediaprovider.jar
        • Size 73KB
        • SHA256 6ae5b642fe117238ea95d6f39931c86cc3e784115a0874e8b742dab88ef9629b
        • MD5 SHA1 SHA512 SSDEEP

        framework-ondevicepersonalization.jar

        • Path /apex/com.android.ondevicepersonalization/javalib/framework-ondevicepersonalization.jar
        • Size 8KB
        • SHA256 f2d356c75b62b631972f29ed268497b3088e80676f34c4f8ea779d30be959b4f
        • MD5 SHA1 SHA512 SSDEEP

        framework-statsd.jar

        • Path /apex/com.android.os.statsd/javalib/framework-statsd.jar
        • Size 73KB
        • SHA256 22481f2149c6f9b6e8873c4419c8fd33fd72c7dd1ef8e968c63ba3a1c8eab914
        • MD5 SHA1 SHA512 SSDEEP

        framework-permission-s.jar

        • Path /apex/com.android.permission/javalib/framework-permission-s.jar
        • Size 173KB
        • SHA256 25c24c41332b5886427c5864067ac491e163a6c729bc219b31183b229e5d3219
        • MD5 SHA1 SHA512 SSDEEP

        framework-permission.jar

        • Path /apex/com.android.permission/javalib/framework-permission.jar
        • Size 612B
        • SHA256 e62333a706d04ca49f917826f49770ad089d134580f050567de912ecac31302c
        • MD5 SHA1 SHA512

        framework-scheduling.jar

        • Path /apex/com.android.scheduling/javalib/framework-scheduling.jar
        • Size 11KB
        • SHA256 a80d2a1dd96cbfd38ed68d8934611f2294ff8f85fce7378500570814d571ce7e
        • MD5 SHA1 SHA512 SSDEEP

        framework-sdkextensions.jar

        • Path /apex/com.android.sdkext/javalib/framework-sdkextensions.jar
        • Size 5KB
        • SHA256 835e58ff912600ddef1b3fa9adaff5d7e2c4b379fbe8adaac065122777b204a5
        • MD5 SHA1 SHA512 SSDEEP

        framework-connectivity-t.jar

        • Path /apex/com.android.tethering/javalib/framework-connectivity-t.jar
        • Size 374KB
        • SHA256 595956d19b204fce5ae88e02999467cd6bee084158ef209fce06958d76806608
        • MD5 SHA1 SHA512 SSDEEP

        framework-connectivity.jar

        • Path /apex/com.android.tethering/javalib/framework-connectivity.jar
        • Size 490KB
        • SHA256 13f8f21e0f6c093ce54e81bbd0e169f605060d68a60070bffb0e1ba2e54a40c0
        • MD5 SHA1 SHA512 SSDEEP

        framework-tethering.jar

        • Path /apex/com.android.tethering/javalib/framework-tethering.jar
        • Size 63KB
        • SHA256 fdabd2584172b86fb29014cb70f61e5995c229db5fe098a80244809bb7bca7cc
        • MD5 SHA1 SHA512 SSDEEP

        framework-uwb.jar

        • Path /apex/com.android.uwb/javalib/framework-uwb.jar
        • Size 102KB
        • SHA256 31ec5ef294c561e6ead889767bd0656714f42998717a947427150d51dbc3b367
        • MD5 SHA1 SHA512 SSDEEP

        framework-wifi.jar

        • Path /apex/com.android.wifi/javalib/framework-wifi.jar
        • Size 985KB
        • SHA256 79bb444346e1086292f96dfd8f859fe6e72fb439c1426db6915aaddb5bd30a65
        • MD5 SHA1 SHA512 SSDEEP

        1664557424545.jar

        • Path /data/data/com.livevideocallingapps.headshot/cache/1664557424545.jar
        • Size 10KB
        • SHA256 8ba015cb192f34326e6a46f765c6712d87c3797661541275c84b9a30ee449eec
        • MD5 SHA1 SHA512 SSDEEP

        1664557424545.vdex

        • Path /data/data/com.livevideocallingapps.headshot/cache/oat/x86_64/1664557424545.vdex
        • Size 948B
        • SHA256 e9e16898bfb89b40c3e9972f977730473d9b45ed0fdc5cbf868ff0e71f064290
        • MD5 SHA1 SHA512

        androidx.work.workdb

        • Path /data/data/com.livevideocallingapps.headshot/databases/androidx.work.workdb
        • Size 4KB
        • SHA256 b9a8194b71a046e8c0eb30995827b582b4bea834f630a5df2483b778a7d7d8a4
        • MD5 SHA1 SHA512

        androidx.work.workdb-journal

        • Path /data/data/com.livevideocallingapps.headshot/databases/androidx.work.workdb-journal
        • Size 512B
        • SHA256 9d7fd598ed988e9fe5bfde708ff4c183c78f7724ff3ac79f5de11f0050b541b6
        • MD5 SHA1 SHA512

        androidx.work.workdb-shm

        • Path /data/data/com.livevideocallingapps.headshot/databases/androidx.work.workdb-shm
        • Size 32KB
        • SHA256 c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
        • MD5 SHA1 SHA512 SSDEEP

        androidx.work.workdb-wal

        • Path /data/data/com.livevideocallingapps.headshot/databases/androidx.work.workdb-wal
        • Size 88KB
        • SHA256 da3ddc2e78688e4d308236ffa13bc294b190d3deb66439f6e5d99f494ff647c2
        • MD5 SHA1 SHA512 SSDEEP

        androidx.work.workdb-wal

        • Path /data/data/com.livevideocallingapps.headshot/databases/androidx.work.workdb-wal
        • Size 16KB
        • SHA256 ff0333ff4d0b6413c7ebf7692d046bf972f5ff7498e0716fa6baefaf47c7fcd4
        • MD5 SHA1 SHA512 SSDEEP

        com.google.android.datatransport.events

        • Path /data/data/com.livevideocallingapps.headshot/databases/com.google.android.datatransport.events
        • Size 40KB
        • SHA256 632907b2357e6d3e99c86012795c6a2eebd1e8c1ee0a64c64878c5c1201413a2
        • MD5 SHA1 SHA512 SSDEEP

        com.google.android.datatransport.events-journal

        • Path /data/data/com.livevideocallingapps.headshot/databases/com.google.android.datatransport.events-journal
        • Size 512B
        • SHA256 829bf7afa6e3e6b64d76fa326e461ed1a109dc8e411d75fd1f89a31cf5d2d51b
        • MD5 SHA1 SHA512

        com.google.android.datatransport.events-journal

        • Path /data/data/com.livevideocallingapps.headshot/databases/com.google.android.datatransport.events-journal
        • Size 8KB
        • SHA256 535a4629e5d5c1ac690913b75a59f7b3bb1e3c92535924d0bc6d027d1700e58f
        • MD5 SHA1 SHA512 SSDEEP

        com.google.android.datatransport.events-journal

        • Path /data/data/com.livevideocallingapps.headshot/databases/com.google.android.datatransport.events-journal
        • Size 8KB
        • SHA256 dc65ca053eb94f34b9327cc3b8b637921f95bfed975089820c764a88120f1615
        • MD5 SHA1 SHA512 SSDEEP

        google_app_measurement_local.db

        • Path /data/data/com.livevideocallingapps.headshot/databases/google_app_measurement_local.db
        • Size 16KB
        • SHA256 18b909096c7c61d51ab076ae8e562effb0d4ada28e2a4ecd0e6b88ef58f6b2a6
        • MD5 SHA1 SHA512 SSDEEP

        google_app_measurement_local.db

        • Path /data/data/com.livevideocallingapps.headshot/databases/google_app_measurement_local.db
        • Size 16KB
        • SHA256 5ab4d86983ad8a103e2ab57e94e2596bc7e6bbf0764851668cc64c94cbe36ded
        • MD5 SHA1 SHA512 SSDEEP

        google_app_measurement_local.db

        • Path /data/data/com.livevideocallingapps.headshot/databases/google_app_measurement_local.db
        • Size 16KB
        • SHA256 82be6eb3c6e9d5dbf1c0c87130bdb40e013687c48502d3f2f56d2d32c5e27312
        • MD5 SHA1 SHA512 SSDEEP

        google_app_measurement_local.db

        • Path /data/data/com.livevideocallingapps.headshot/databases/google_app_measurement_local.db
        • Size 16KB
        • SHA256 09706a7550f7219dd12eb443e56574ab24f1d9cdcd562844366ce621137b4b3b
        • MD5 SHA1 SHA512 SSDEEP

        google_app_measurement_local.db

        • Path /data/data/com.livevideocallingapps.headshot/databases/google_app_measurement_local.db
        • Size 16KB
        • SHA256 7a01eb65460215790677cec8cd135b8206a29f1de927775fbdec8ac1a1a975a9
        • MD5 SHA1 SHA512 SSDEEP

        google_app_measurement_local.db

        • Path /data/data/com.livevideocallingapps.headshot/databases/google_app_measurement_local.db
        • Size 16KB
        • SHA256 a5d7f72cf4c2fad8c62bcf69a3ee201f80713d87f77db8e25700b8058593b0d5
        • MD5 SHA1 SHA512 SSDEEP

        google_app_measurement_local.db-journal

        • Path /data/data/com.livevideocallingapps.headshot/databases/google_app_measurement_local.db-journal
        • Size 512B
        • SHA256 d155b8001ad4768f91f1e5325d7abb51f45078eb391e06deaaffcc6cd5078017
        • MD5 SHA1 SHA512

        google_app_measurement_local.db-journal

        • Path /data/data/com.livevideocallingapps.headshot/databases/google_app_measurement_local.db-journal
        • Size 8KB
        • SHA256 fef42b2a32fc784a02c839fafa9daf137445feb121ca86335b9615e9bc0eba11
        • MD5 SHA1 SHA512 SSDEEP

        google_app_measurement_local.db-journal

        • Path /data/data/com.livevideocallingapps.headshot/databases/google_app_measurement_local.db-journal
        • Size 4KB
        • SHA256 b8fc818a9a15ee80ca66b5696db6f8c930aa724e4141044560ad99c8176dfd0d
        • MD5 SHA1 SHA512 SSDEEP

        google_app_measurement_local.db-journal

        • Path /data/data/com.livevideocallingapps.headshot/databases/google_app_measurement_local.db-journal
        • Size 8KB
        • SHA256 c41d7995cd8b051e9c7e006954dc47624fff0cb35dd5e074db8e17960095c9a0
        • MD5 SHA1 SHA512 SSDEEP

        google_app_measurement_local.db-journal

        • Path /data/data/com.livevideocallingapps.headshot/databases/google_app_measurement_local.db-journal
        • Size 8KB
        • SHA256 435d4fb37980705964e859e30e6fdba34b0b7222525a42eeeff4d25a23ec1f77
        • MD5 SHA1 SHA512 SSDEEP

        google_app_measurement_local.db-journal

        • Path /data/data/com.livevideocallingapps.headshot/databases/google_app_measurement_local.db-journal
        • Size 8KB
        • SHA256 df01048a3951a3c4b6099a6ccb0d370c2067609674e0c1f059c10f5c80c72f8b
        • MD5 SHA1 SHA512 SSDEEP

        PersistedInstallation1504117021718619508tmp

        • Path /data/data/com.livevideocallingapps.headshot/files/PersistedInstallation1504117021718619508tmp
        • Size 568B
        • SHA256 ede1941d81e3df29291f28e540f9c29da6b8bf46c9cd584dcc7f56149fd7e7ff
        • MD5 SHA1 SHA512

        PersistedInstallation4465086660071185591tmp

        • Path /data/data/com.livevideocallingapps.headshot/files/PersistedInstallation4465086660071185591tmp
        • Size 90B
        • SHA256 a60ccacd0110dc332cb3111bcbb5e7978be641e84414e1b1da4b53ba89d7694b
        • MD5 SHA1 SHA512
        • Path /data/data/com.livevideocallingapps.headshot/oat/x86_64/[email protected]
        • Size 58KB
        • SHA256 5ba2439c9bd8ee256da528de4028fc1c11df99efa8e2001839c0cb94a14751b1
        • MD5 SHA1 SHA512 SSDEEP
        • Path /data/user/0/com.livevideocallingapps.headshot/[email protected]
        • Size 3.2MB
        • SHA256 26fb1a790377e11135bf8bfa7552cc2797d351df60154ea032ceeb4463776fdf
        • MD5 SHA1 SHA512 SSDEEP

        1664557424545.jar

        • Path /data/user/0/com.livevideocallingapps.headshot/cache/1664557424545.jar
        • Size 21KB
        • SHA256 9f2d7ff525ca785553557c351812252c0beface31440517e2f19929fe76472b1
        • MD5 SHA1 SHA512 SSDEEP

        androidx.window.extensions.jar

        • Path /system_ext/framework/androidx.window.extensions.jar
        • Size 123KB
        • SHA256 8e6331a07c9f2ac139214c527dcaff2c82d126bbe7bd3420cdc36d6a8c9204b0
        • MD5 SHA1 SHA512 SSDEEP

        androidx.window.sidecar.jar

        • Path /system_ext/framework/androidx.window.sidecar.jar
        • Size 25KB
        • SHA256 9195dc6a1c75a841384050240dfc972e48178964993fba6619788625f4b40d1a
        • MD5 SHA1 SHA512 SSDEEP