b71b8bb47805be25fce2ddfc4aa8210bf94478832f61d425d6e38c62a6afcd67

Analysis

max time kernel
428s
max time network
2370s
platform
android_x86
resource
android-x86-arm-20240624-en
resource tags

androidarch:armarch:x86image:android-x86-arm-20240624-enlocale:en-usos:android-9-x86system
submitted
21/07/2024, 19:23

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

AntiSplit-G2 1.3.apk
Size

841KB
MD5

830c0ae3b5c071e96f2107d48055ac0c
SHA1

21cb1bad46974397406244682a585b48cad60a69
SHA256

b71b8bb47805be25fce2ddfc4aa8210bf94478832f61d425d6e38c62a6afcd67
SHA512

dfb61645fbe1aa56eafcc76ed5968cd3efb1f171684e7e9a596aa7cf7d4abff54325adce780de96f8ae095bdc0a19d29b639591955f3eb6a131dee33b4e73862
SSDEEP

24576:wTeXbs47DeqjPliPP4PIVYtVj4iLspGgpzVO2:IibRe0Pli+lMiLuGOP

Score

6^/10

Malware Config

Signatures

Declares services with permission to bind to the system 2 IoCs

description	ioc
Required by telecom connection services to bind with the system. Allows apps to manage phone call aspects such as call setup and notifications.	android.permission.BIND_TELECOM_CONNECTION_SERVICE
Required by chooser target services to bind with the system. Allows apps to modify targets that handle user actions.	android.permission.BIND_CHOOSER_TARGET_SERVICE

Legitimate hosting services abused for malware hosting/C2 1 TTPs 1 IoCs

Web Service

T1102

flow	ioc
248	mediafire.com

Requests dangerous framework permissions 14 IoCs

description	ioc
Allows an application to read the user's contacts data.	android.permission.READ_CONTACTS
Allows an application to write to external storage.	android.permission.WRITE_EXTERNAL_STORAGE
Allows read only access to phone state, including the current cellular network information, the status of any ongoing calls, and a list of any PhoneAccounts registered on the device.	android.permission.READ_PHONE_STATE
Required to be able to access the camera device.	android.permission.CAMERA
Allows an application to record audio.	android.permission.RECORD_AUDIO
Allows access to the list of accounts in the Accounts Service.	android.permission.GET_ACCOUNTS
Required to be able to connect to paired Bluetooth devices.	android.permission.BLUETOOTH_CONNECT
Allows an app to create windows using the type LayoutParams.TYPE_APPLICATION_OVERLAY, shown on top of all other apps.	android.permission.SYSTEM_ALERT_WINDOW
Allows an app to access precise location.	android.permission.ACCESS_FINE_LOCATION
Allows an app to access approximate location.	android.permission.ACCESS_COARSE_LOCATION
Allows an application to read from external storage.	android.permission.READ_EXTERNAL_STORAGE
Allows an app to post notifications.	android.permission.POST_NOTIFICATIONS
Allows an application to read image files from external storage.	android.permission.READ_MEDIA_IMAGES
Allows an application to read video files from external storage.	android.permission.READ_MEDIA_VIDEO

com.tilks.arscmerge
1⤵
PID:4215

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.tilks.arscmerge/files/signing/testkey.past

Filesize
1KB

MD5
dab2cead827ef5313f28e22b6fa8479f

SHA1
74054568f9bf25c23e59498d3458e4d98fbb4b5f

SHA256
0c234449bab53af16510e32102ab99b861a8c5a575cf1daa287d5f25010eb3a6

SHA512
acb7ed9422761aef8995b221aeed72e1bae35ca2ade9f3aafc2abf5c2952669c90fef9d11ec6ecb24d4118d7fac07d46bc941dfdea61b2285f54ee8a1286be49

Download Submit
/data/data/com.tilks.arscmerge/files/signing/testkey.pk8

Filesize
1KB

MD5
1823e4bcadb53e275a8ff8e1b261b7ad

SHA1
92de052cb804dea75f9815a66d7d3f6f911cdb63

SHA256
495675d32e89a149d5abe191f4e9c0e218b9068714e9b53a7c91e164a0741a23

SHA512
b0d46eee477ae57c4dcb417f4f5b7b51691620c51603ed9097bc0d1e39ce94a2d7ade29d1ab80819e3639fd404034dd025c13c824d9cb21ae71ae366a2ce21b1

Download Submit
/storage/emulated/0/Download/X_10.50.1-release.0_APKPure_apks_signed.apk

Filesize
91.6MB

MD5
cfd170b1fba19707f400f50eadeb3d42

SHA1
540a470c49bc5a8cd39f1c654b14439e85e5dbe1

SHA256
e1f41b0e0e50e424ed469fc2bdfb90375712e1da7f8e701348820c0ce75c4858

SHA512
1720545f9fd04b043fd49c536c4ba28406dec31172a00a04b8c91d8d2a02c3634abdf7a9ed7374f404a0d740984ef73a683602c2bffc302bfc5dc706a35f6b68

Download Submit
/storage/emulated/0/Download/_resources.arsc

Filesize
136KB

MD5
69fdf65fdf06a99b155c46a00fc4fc42

SHA1
36dcaf254d369657a4ab24b7f5fcc5e270b2559d

SHA256
07237e27a5558d0c0b43fd924bf175ac687b36cddd966d1fbfef8b0a40cc132c

SHA512
bbb76073003c8890b5fdc6268f1269a09f121c2eae7ef1dda9548747254242d2606a04772e939ef285551035257dbf1933f9a8406322e6085e16a047cb69e0b8

Download Submit
/storage/emulated/0/Download/_resources.arsc

Filesize
1007KB

MD5
377175a4bea05f7e5963ca72ce1af00c

SHA1
41f20e706cf599620c3dcb0e93cfff5935d9f7ec

SHA256
9ecdd8c06862ef7b3ffe6865ef40b7e79ede5634bb00c86dcd0c027b87110d7a

SHA512
6227c5144bd33a2e8f04bd821e6f83248845d8c9b5ce3e76e0c82cf1892ff8189ee6ce24ccf717f276040c4fba643a76c5df7701a1e6d1303db7d0d90e11ea99

Download Submit
/storage/emulated/0/Download/base_resources.arsc

Filesize
2.7MB

MD5
859823280e940bcfb8fb729daf9b78b7

SHA1
5861be896493f56d98f3301941bdf387b0758f10

SHA256
2ca76d3802d1dcfcb9a062927ccbe852a8b6215ff3666177ae07f29918b5f7ff

SHA512
6046b24b508f1903b61d1f25c7f4982c1a2788d3bec378b77ac600c0c6dc30bcade76809acc62149d123e36a2c034a37f2078e47de97f051dd87ad8e61560b7d

Download Submit
/storage/emulated/0/Download/resources.arsc

Filesize
3.1MB

MD5
e3e445bb1e5259a647d790f507e24e42

SHA1
4f3a8407d23e60d59e6ae25797d668bb497691d7

SHA256
7be05be951424acab7e478a8c1d688cb49df7088a5bbd7b1bc3cd9b34e868b16

SHA512
47e4188d9d7d1b29c21feb78af143a154b31da846e925a83de76e8a55329b9dbe67c7503bd3b90ca7a25c6056c738c705c3db16c23dddcd78abe5a98b6036406

Download Submit