Analysis

  • max time kernel
    177s
  • max time network
    170s
  • platform
    android_x64
  • resource
    android-33-x64-arm64-20240624-en
  • resource tags

    androidarch:arm64arch:x64image:android-33-x64-arm64-20240624-enlocale:en-usos:android-13-x64system
  • submitted
    25-08-2024 22:00

General

  • Target

    d46853b228b04d08f144c26a10f63442df88b19d86f4543131ab8fa8622be010.apk

  • Size

    541KB

  • MD5

    94061338d10b07b246e9b14dfaf43bae

  • SHA1

    1c3a182702cdc980584c59656c4285ce1a64adf9

  • SHA256

    d46853b228b04d08f144c26a10f63442df88b19d86f4543131ab8fa8622be010

  • SHA512

    b23195e67fa39ea04c9809898292df5caeebb0af8c489e4aeb4fca90b16df080f39c3a5976ca1151a711a3563468ce9210b9c7892542dd5589732b2e9b7a3930

  • SSDEEP

    6144:StOn86tpjL+5KH4BhcNrOr4opaz0fJ4ADvtYvekjNoTN4PcXLDzVlkY0wu+OQ:oOn53THLOr4/zM4ADtYvekj04sR0d+OQ

Malware Config

Extracted

Family

octo

C2

https://aiposcmplso1.com/YTFlMzViNjNiNWM3/

https://aiposcmplso2.com/YTFlMzViNjNiNWM3/

https://aiposcmplso42343.com/YTFlMzViNjNiNWM3/

https://aiposcmplsoi343.com/YTFlMzViNjNiNWM3/

https://aiposcmplsoi3467.com/YTFlMzViNjNiNWM3/

rc4.plain

Extracted

Family

octo

C2

https://aiposcmplso1.com/YTFlMzViNjNiNWM3/

https://aiposcmplso2.com/YTFlMzViNjNiNWM3/

https://aiposcmplso42343.com/YTFlMzViNjNiNWM3/

https://aiposcmplsoi343.com/YTFlMzViNjNiNWM3/

https://aiposcmplsoi3467.com/YTFlMzViNjNiNWM3/

AES_key

Signatures

Processes

  • com.leftspecialcybx
    1⤵
    • Loads dropped Dex/Jar
    • Makes use of the framework's Accessibility service
    • Acquires the wake lock
    • Makes use of the framework's foreground persistence service
    • Queries the mobile country code (MCC)
    • Requests accessing notifications (often used to intercept notifications before users become aware).
    • Requests disabling of battery optimizations (often used to enable hiding in the background).
    • Uses Crypto APIs (Might try to encrypt user data)
    PID:4313

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/user/0/com.leftspecialcybx/cache/fkctvucbxw

    Filesize

    449KB

    MD5

    c6448532c346f73207fd965802009092

    SHA1

    6cac27c4486980c0fc726de2c0e83b0f3425ae9e

    SHA256

    be425503911f29c77abda2fc8ce19d0969f232ed482672e1fdaa5bc712717e9a

    SHA512

    75c8cdc4381c792661157bef30aea58bf757ee22613e29d9e23246c0b81007d9de393936bd3eae9a275637051aebbf3a6b0b31b1c81037fbaa9efb658f08be14

  • /data/user/0/com.leftspecialcybx/cache/oat/fkctvucbxw.cur.prof

    Filesize

    376B

    MD5

    874f4d46bb141c4e48238f26e0f6ef92

    SHA1

    8da31524751f1e0bb480901b190b4b3022c66680

    SHA256

    560b2851d58f86e199d4d5b5b5ca379a5960d99a4ca050588e99b8618abac56b

    SHA512

    a24a9371798eddb77af43e5f127cbb83339c49d836a5bb2a07586d8bd3be07721b206a014be7c7ba782c717ce428153adc892ee143b3e45dac465e6747e82745