bbf2abd9c3c84ba1c266298928f9f15adf4d971d4f6168a7fac31d35f0bbfcc6

Analysis

max time kernel
629s
max time network
623s
platform
android_x64
resource
android-x64-arm64-20240624-es
resource tags

androidarch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20240624-eslocale:es-esos:android-11-x64system
submitted
23-08-2024 15:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Rebel Inc Mod v1.16.5_(AndroidApkData.net).apk
Size

83.6MB
MD5

dd5339c229c45e7d458f6d8324bb2055
SHA1

4873e4cf2005f7ff85d030781f413424dad0dd6c
SHA256

bbf2abd9c3c84ba1c266298928f9f15adf4d971d4f6168a7fac31d35f0bbfcc6
SHA512

fa3bf279ff95a374ee2626200e7f47ec726f0a1b47073097333a284237a05e5cbea6265cff8f396683d616a10a9c3534f68eed9b305929e3e88c4b2860fb5f2c
SSDEEP

1572864:oNJ46bpZi7VJeDdwO2Ipr205N6FWTkp6ylvYg2/ZGCnZQnCrmy/z2ZMKK:QiupZ8VMpwoNZ2Okp6yl72hGCnqnCrmc

Score

8^/10

discovery evasion execution persistence

Malware Config

Signatures

Checks if the Android device is rooted. 1 TTPs 1 IoCs

evasion

System Information Discovery

T1426

ioc	Process
/system/app/Superuser.apk	com.ndemiccreations.rebelinc

Loads dropped Dex/Jar 1 TTPs 2 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/data/com.ndemiccreations.rebelinc/files/851ebe56/851ebe56	4439	com.ndemiccreations.rebelinc
/data/data/com.ndemiccreations.rebelinc/files/851ebe56/851ebe56	4439	com.ndemiccreations.rebelinc

Queries information about active data network 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.ndemiccreations.rebelinc

Reads information about phone network operator. 1 TTPs
discovery

System Network Configuration Discovery
T1422

Schedules tasks to execute at a specified time 1 TTPs 1 IoCs

Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.

execution persistence

Scheduled Task/Job

T1603

description	ioc	Process
Framework service call	android.app.job.IJobScheduler.schedule	com.ndemiccreations.rebelinc

Checks CPU information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	com.ndemiccreations.rebelinc

Checks memory information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	com.ndemiccreations.rebelinc

com.ndemiccreations.rebelinc
1⤵
- Checks if the Android device is rooted.
- Loads dropped Dex/Jar
- Queries information about active data network
- Schedules tasks to execute at a specified time
- Checks CPU information
- Checks memory information
PID:4439

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Scheduled Task/Job

T1603

Persistence

Scheduled Task/Job

T1603

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Discovery

System Information Discovery

T1426

System Network Configuration Discovery

T1422

System Network Connections Discovery

T1421

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.ndemiccreations.rebelinc/databases/com.google.android.datatransport.events

Filesize
56KB

MD5
864c0ad1054853cbbd9ff936e77a2719

SHA1
458e0a33510be6c46f353d0e80d31f39538c74b7

SHA256
4588660e801280eeb90062cd19a2f2989d03c556f47c5cbcb27371cea894dc54

SHA512
da992b4153ae0f5973d94686f70ba122b5bf8a13dfdee78954bb5096b8c9d0ff6a75b0c7b09a7bb5355199dcb2065c00f716567fff7232b6bda9d9724c76a8df

Download Submit
/data/data/com.ndemiccreations.rebelinc/databases/com.google.android.datatransport.events-journal

Filesize
512B

MD5
15be3d72a8c1199cc37aa2da3afb092b

SHA1
958682599ba75a61d1d905048f8cca83a6e91d03

SHA256
8b66ad885610cdc3a88ee910f9043c5758da5319e4ab0da4bb42e6b7b590a4ba

SHA512
9e51ca11abe42b7e6efa4b5a3afcb71a92f6321ed73f24466ba3a00c817dd18a397e026cd4a0a289debec4353387cbc126f69036dc5bc9af8fa5d2455301c921

Download Submit
/data/data/com.ndemiccreations.rebelinc/databases/com.google.android.datatransport.events-journal

Filesize
8KB

MD5
e12a983118c8d154ce2284133c6e3eba

SHA1
dc87985dd895a9ac530e6971c80843869254dabe

SHA256
727b6a1561d87afc1e00ad5466449e6132e79142cab9ed304ff64d2fbf25a8d4

SHA512
e34286bc0fa3d26fbe4b7b2d412a72d6e77cc005960dcab7715d0fa5a3b623acaa4579a2822d57b75503e1e96a64ef3547f3667607c801b043676b99c61f9b6b

Download Submit
/data/data/com.ndemiccreations.rebelinc/databases/com.google.android.datatransport.events-journal

Filesize
8KB

MD5
4f0969d0474b43709f9fbe49e657217f

SHA1
508400af55db3268e28df0571388a8bb9094cce7

SHA256
f891a3e939d930bc413bd1a350e39ce7d627e25bf36c25c9ed98cbf85a0253fc

SHA512
ae0f48bab4e5cb84fc779b0048d2b702f6e433a0444669feb04a4f6fc754fa2728daa22dc2fdeb084542eac0fe5fdfbd1caa4bedca49dfcb42156c75dcb8a717

Download Submit
/data/data/com.ndemiccreations.rebelinc/databases/com.google.android.datatransport.events-journal

Filesize
24KB

MD5
1086473de0182cb10a0c4ffaaa0d105f

SHA1
82e95c1837d0a61f8525d0c037f9bc3df08bf204

SHA256
58825aee1eb949021adb60696c99c447b9ac87a7e40bb402d5b5badd7963dbc9

SHA512
c060e451a9d17473829de6117f3adf8b720273994811c316b5fa8710e2d27fecae1d978420e7fb65892e536eb78407fe198556eabbe7e01db79ffc982a78e43c

Download Submit
/data/data/com.ndemiccreations.rebelinc/databases/com.google.android.datatransport.events-journal

Filesize
16KB

MD5
c37fe99c0b6fa73d190027323df3ae3b

SHA1
98e1f04523df8c3513f6af2d99a09e6b5d71d78e

SHA256
344b3894410f73acb1810499d240c3e636bc17b60583f871f80791c47acd76d0

SHA512
5002f02408e1b1a070bd1c49da836790d06ec8c6af7ceb697dac9de2bca8f09b2f331201711279a6e0fa14461fbcf158a3c91e7c75924c4f3d8678440d2a52ca

Download Submit
/data/data/com.ndemiccreations.rebelinc/databases/com.google.android.datatransport.events-journal

Filesize
20KB

MD5
1a4c740257526f57548a5b15abfbc42f

SHA1
5e2f249ce5acff2d85328b2b46cc7e7e971da3a6

SHA256
b4bb41dd261e155723c81c6c6431610ce9d328bf35b9f256a86b8e15295cda56

SHA512
976705f6503866258154fda84bd8c3da32cde79fcc1b68538ec9f560fb6fe6265e82493fcc34272c13cb5b31d55b87efc49d885f742217ed6c2ff78558a49fc8

Download Submit
/data/data/com.ndemiccreations.rebelinc/files/851ebe56/851ebe56

Filesize
234KB

MD5
cdac00b31c4509503c75d7f4a0752365

SHA1
02559d6118d27322c2be84c8f1699c7c5c68327c

SHA256
e975ba3293549d488505973b4fe27c48b91995a235cf16f1080869071020852c

SHA512
8ae0959dc733c809f45fae30226dd6e9fe60ee596bc4a72b08766e6daf05cf61e72378c7f50647ccb936af8adf9b07c2dfa78061b410e37b697cf6eafc84bbb6

Download Submit
/proc/4519/timerslack_ns

Filesize
8B

MD5
d46bf94e9eb1d22281a71504685082ac

SHA1
e4e0629aef7425ba63e897bc471f8625de44edd3

SHA256
2ddb67b8a8c259ffaff61a5abdd38f5b5d6f1c6e2af4344c85b17b77af2451cc

SHA512
68a1a1fd4de784e3a2e0e956d0a63ac4ca540ef90e7fd9a2ddc92cf68e52e29792db64f6615054a6e5460467f0b7abe055c899136d98ce6ebab3d580bc55ec86

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads