Analysis

  • max time kernel
    149s
  • max time network
    150s
  • platform
    android-9_x86
  • resource
    android-x86-arm-20240910-en
  • resource tags

    arch:armarch:x86image:android-x86-arm-20240910-enlocale:en-usos:android-9-x86system
  • submitted
    08-09-2024 22:22

General

  • Target

    00f846db2c86c023fe19641c10105342d5d4b715c2c50d9790b0458ddcdeb808.apk

  • Size

    292KB

  • MD5

    f49576f4d131750ad1aef5ba7eef7f4f

  • SHA1

    61f8c234c3a3ba2d9635625ee82732714bc03ec7

  • SHA256

    00f846db2c86c023fe19641c10105342d5d4b715c2c50d9790b0458ddcdeb808

  • SHA512

    1b65ce30bbfbbd2c287c44d2731b3dd61fcaae20074340d30ece8cb57dbd88d572510d3dccd1144d48eeac3e302211196f7b4463e75dbe555c7a309d447b0f86

  • SSDEEP

    6144:f5/N4Li6IbQTQsqmdxuMDcYg8xYh+w3IlDlOlxM+seXf6x71A:f51NnsqUtuWYM+ssMe

Malware Config

Extracted

Family

xloader_apk

C2

http://91.204.227.39:28844

DES_key

Signatures

Processes

  • com.zbuu.karr
    1⤵
    • Checks if the Android device is rooted.
    • Removes its main activity from the application launcher
    • Loads dropped Dex/Jar
    • Reads the content of the MMS message.
    • Acquires the wake lock
    • Makes use of the framework's foreground persistence service
    • Requests changing the default SMS application.
    • Requests disabling of battery optimizations (often used to enable hiding in the background).
    • Registers a broadcast receiver at runtime (usually for listening for system events)
    • Uses Crypto APIs (Might try to encrypt user data)
    PID:4260

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/data/com.zbuu.karr/files/dex

    Filesize

    483KB

    MD5

    ae9c12585483e8f440602e44dedfc892

    SHA1

    9605a4070f7c3d7e180c319b3125751233b655ef

    SHA256

    6bae5b64c4d0c9b7777a8ff1d198eff5a89fc4b1e2489e0b13e2751b5e2e33cd

    SHA512

    cf958ae50832841f5921c82a8ac0ed3822afb6361648fb2d2c2cc99a17ff4a22343594e0599836342fd9cbeccc6c05623505f1c0d87197f296d5a917c5e7b33c

  • /data/data/com.zbuu.karr/files/oat/dex.cur.prof

    Filesize

    1KB

    MD5

    e6e36ea6fb2898ec0f8d1da48aa65558

    SHA1

    cb7edd25f1542bfc7885ee228a7809a1ca6827e5

    SHA256

    52692886f1d1aa4ae3b25ef55b47e97eec4e965f28b3db8724d5802d6aff403a

    SHA512

    b496782ddbfeedcdcff411a2f32c747e9945eba3b9bfe8d9f4ce0e969396116ff1005139035b38953e434b510e89b3c604aa147a6179531d05a09fbd109ecc83