Resubmissions

05-08-2024 12:08

240805-pa55aavhjp 10

02-08-2024 15:48

240802-s893nszfkj 10

03-01-2024 17:25

240103-vzshdabae6 10

24-12-2023 19:17

231224-xznwasbhh7 6

14-12-2023 08:27

231214-kclffacdhn 10

03-11-2023 03:07

231103-dmbwesbb4s 10

01-11-2023 22:00

231101-1wx7cadf5y 10

Analysis

  • max time kernel
    329s
  • max time network
    334s
  • platform
    android_x64
  • resource
    android-x64-20240624-en
  • resource tags

    androidarch:x64arch:x86image:android-x64-20240624-enlocale:en-usos:android-10-x64system
  • submitted
    05-08-2024 12:08

General

  • Target

    b38019f9e80c2166a4e09eed0cd15bad651263f0ff3ea26199a08896ffd8e1fc.apk

  • Size

    509KB

  • MD5

    60609814e43a1c814b30435f15d361ed

  • SHA1

    61431ed485c98b8a291e289a7e17e8d3e6db3660

  • SHA256

    b38019f9e80c2166a4e09eed0cd15bad651263f0ff3ea26199a08896ffd8e1fc

  • SHA512

    8efba5603fd4217b9c9c96e28a69f9f262568f76d43fd959d6914694808488f089f01fa92e2d04f44d5aa0859efcfb34fb080dc7b3a49502469598ab90a662fe

  • SSDEEP

    12288:KwGWfjEhy4pNodk6TZFo9nheT5BQ4YvnAu:KnWf0y4GNIsmRvnAu

Malware Config

Extracted

Family

octo

C2

https://84.54.50.100/Njk4Zjk4YjdjODY3/

https://pakuxxxnatationclass.net/Njk4Zjk4YjdjODY3/

https://pakuxxxnatationclass2.net/Njk4Zjk4YjdjODY3/

https://pakuxxxnatationclass3.net/Njk4Zjk4YjdjODY3/

https://pakuxxxnatationclass4.net/Njk4Zjk4YjdjODY3/

https://pakuxxxnatationclass5.net/Njk4Zjk4YjdjODY3/

https://pakuxxxnatationclass6.net/Njk4Zjk4YjdjODY3/

rc4.plain

Extracted

Family

octo

C2

https://84.54.50.100/Njk4Zjk4YjdjODY3/

https://pakuxxxnatationclass.net/Njk4Zjk4YjdjODY3/

https://pakuxxxnatationclass2.net/Njk4Zjk4YjdjODY3/

https://pakuxxxnatationclass3.net/Njk4Zjk4YjdjODY3/

https://pakuxxxnatationclass4.net/Njk4Zjk4YjdjODY3/

https://pakuxxxnatationclass5.net/Njk4Zjk4YjdjODY3/

https://pakuxxxnatationclass6.net/Njk4Zjk4YjdjODY3/

AES_key

Signatures

Processes

  • com.broughtbluea
    1⤵
    • Loads dropped Dex/Jar
    • Makes use of the framework's Accessibility service
    • Obtains sensitive information copied to the device clipboard
    • Acquires the wake lock
    • Makes use of the framework's foreground persistence service
    • Performs UI accessibility actions on behalf of the user
    • Queries the mobile country code (MCC)
    • Registers a broadcast receiver at runtime (usually for listening for system events)
    • Uses Crypto APIs (Might try to encrypt user data)
    • Checks CPU information
    • Checks memory information
    PID:4929

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/data/com.broughtbluea/cache/oat/pxcpq.cur.prof

    Filesize

    405B

    MD5

    8188062d1383c7f0a2e82e169153c056

    SHA1

    fa3551c5be152f7eee60e0fe21de58eef306c10f

    SHA256

    ca0da83d0642bf0b428d5e7963bb5dcb6a9f01dba57d8e0a51ab92ac77fdcbc8

    SHA512

    1ce433db1c36680d8cd15742905322a9be1d26a5e6c4e266417fb855d82e0d98225061cb32fc16918b608d13e5dfd2b87d831461183475e0664cb4a571dc0d1b

  • /data/data/com.broughtbluea/cache/oat/pxcpq.cur.prof

    Filesize

    436B

    MD5

    e130dea45c8f45209112802a35624bba

    SHA1

    b167dbe7e6bf2728a01f6f56553f250a46ab98d1

    SHA256

    91b0870c36692d197f6bd6babf93c6f80f157bc13c0f16acaddd6bd40ae43209

    SHA512

    98ceb413f283d5704554d79db6fa867bb12a99abf603f9f7eb01b18337ec0863f453acce0c6d4cbaddddeae95f63a55bb040a4da8d6c18792662529ed1ba0b81

  • /data/data/com.broughtbluea/cache/pxcpq

    Filesize

    449KB

    MD5

    fb15ea8794c6547c5ca8f58577e433a6

    SHA1

    47c530ac1858cbc7584429190a07c3c4313857ac

    SHA256

    908588c8de2b52b69f30917583d91ac67f96c7682c017df3943d3979c9fc6095

    SHA512

    9cb724a385917e949052b84be546cd61a952474ee8671743034463b356de4c5bc60732b07287c326da65c4cced7f8c8247b348bbb5abb436c86fedbcb4da90c9

  • /data/data/com.broughtbluea/kl.txt

    Filesize

    28B

    MD5

    6311c3fd15588bb5c126e6c28ff5fffe

    SHA1

    ce81d136fce31779f4dd62e20bdaf99c91e2fc57

    SHA256

    8b82f6032e29a2b5c96031a3630fb6173d12ff0295bc20bb21b877d08f0812d8

    SHA512

    2975fe2e94b6a8adc9cfc1a865ad113772b54572883a537b02a16dd2d029c0f7d9cca3b154fd849bdfe978e18b396bcf9fa6e67e7c61f92bdc089a29a9c355c6

  • /data/data/com.broughtbluea/kl.txt

    Filesize

    68B

    MD5

    90143cff461d8a39979dc71faad127fa

    SHA1

    48cfd4bfc948dabe8866f242d24c1dc75603d4a5

    SHA256

    9a032e4f39eb8f9e783f0c3d5db6f5bef61ec7d792ebaabe32e8a89d71529dd3

    SHA512

    90ca045425b6808eafe904d0212a452b3be896bcb0eda7452a64bb6d6a1ab675b4900022d25ef2a07b84bcf2730030e7a3edb824040f7e0e7bba5328fd1f2859

  • /data/data/com.broughtbluea/kl.txt

    Filesize

    76B

    MD5

    574e215a6c3dcfdc05cd8ab358253c1d

    SHA1

    643e850e777cafddc03d85e6f22fb0daab46e926

    SHA256

    c952d1314b8e4a1e45b381448e1df95cf0c54ea1f7ee635f383a02325a8d94d9

    SHA512

    e8a3a566b7f4aa99937d2ab7891ca827cc364060e033ab997c22ac0194820c85985a4d302bb15efcb79da82f4565ead529db98f7348af6e2912072dd326f5fef