Overview

overview

10

Static

static

6

aa09c8cc85...fd.apk

android-9-x86

10

aa09c8cc85...fd.apk

android-10-x64

10

aa09c8cc85...fd.apk

android-11-x64

10

Analysis

  • max time kernel
    149s
  • max time network
    158s
  • platform
    android_x64
  • resource
    android-x64-arm64-20240624-en
  • resource tags

    androidarch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20240624-enlocale:en-usos:android-11-x64system
  • submitted
    02/10/2024, 22:09 UTC

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    aa09c8cc8584b17e4dbdb6cec0676232510e5f03fbff22384c3c10c905bf54fd.apk

  • Size

    276KB

  • MD5

    48c47a3718515a80ca5af18d657a9f45

  • SHA1

    d3aa48443c5a5c0ccd223a389cd253b13e1f211e

  • SHA256

    aa09c8cc8584b17e4dbdb6cec0676232510e5f03fbff22384c3c10c905bf54fd

  • SHA512

    72cafcaab74c843923e7abb3be1c9aaecc3cd37e2257627da3ddedaa8e9915ce4db07bdb4ecb0fc47828032b5fa661e17a4a0c8fc0daea02552744797d3711a9

  • SSDEEP

    6144:3yRstZuwQ4jSWj9uJtIb53LoIYcQ2OK45V89V+aNV/dFK0:3yavuwQpe9uzLIYcQ2T45V8+a//dv

Score
10/10
xloader_apkbankercollectiondiscoveryevasionimpactinfostealerpersistencestealthtrojan

Malware Config

Extracted

Family

xloader_apk

C2

http://91.204.227.39:28844

DES_key
1
4162356431513332

Signatures

Processes

  • com.incm.bshe
    1⤵
    • Checks if the Android device is rooted.
    • Removes its main activity from the application launcher
    • Loads dropped Dex/Jar
    • Reads the content of the MMS message.
    • Acquires the wake lock
    • Makes use of the framework's foreground persistence service
    • Requests changing the default SMS application.
    • Requests disabling of battery optimizations (often used to enable hiding in the background).
    • Uses Crypto APIs (Might try to encrypt user data)
    PID:4590

Network

  • flag-us
    DNS
    docs.google.com
    Remote address:
    1.1.1.1:53
    Request
    docs.google.com
    IN A
    Response
    docs.google.com
    IN A
    216.58.212.206
  • flag-us
    DNS
    docs.google.com
    Remote address:
    1.1.1.1:53
    Request
    docs.google.com
    IN A
  • flag-us
    DNS
    ssl.google-analytics.com
    Remote address:
    1.1.1.1:53
    Request
    ssl.google-analytics.com
    IN A
    Response
    ssl.google-analytics.com
    IN A
    216.58.201.104
  • flag-us
    DNS
    android.apis.google.com
    Remote address:
    1.1.1.1:53
    Request
    android.apis.google.com
    IN A
    Response
    android.apis.google.com
    IN CNAME
    clients.l.google.com
    clients.l.google.com
    IN A
    142.250.187.206
  • flag-gb
    GET
    https://docs.google.com/document/d/1s0n64k12_r9MglT5m9lr63M5F3e-xRyaMeYP7rdOTrA/mobilebasic
    Remote address:
    216.58.212.206:443
    Request
    GET /document/d/1s0n64k12_r9MglT5m9lr63M5F3e-xRyaMeYP7rdOTrA/mobilebasic HTTP/1.1
    User-Agent: Mozilla/5.0 (Linux; Android 6.0; Nexus 5 Build/MRA58N) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/72.0.3626.121 Mobile Safari/537.36
    Accept: text/html,*/*;q=0.8
    Accept-Encoding: gzip
    Accept-Language: zh-CN,zh;q=0.8,en;q=0.6
    Cache-Control: no-cache
    Host: docs.google.com
    Connection: Keep-Alive
    Response
    HTTP/1.1 200 OK
    Content-Type: text/html; charset=utf-8
    x-robots-tag: noarchive
    Cache-Control: no-cache, no-store, max-age=0, must-revalidate
    Pragma: no-cache
    Expires: Mon, 01 Jan 1990 00:00:00 GMT
    Date: Wed, 02 Oct 2024 22:10:00 GMT
    P3P: CP="This is not a P3P policy! See g.co/p3phelp for more info."
    Content-Security-Policy: require-trusted-types-for 'script';report-uri https://csp.withgoogle.com/csp/docs-tt
    Content-Security-Policy: base-uri 'self';object-src 'none';report-uri https://docs.google.com/document/cspreport;script-src 'report-sample' 'nonce-Bxgpj8qSjhWKRdtPeC9fGg' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';worker-src 'self' blob:
    reporting-endpoints: default="/document/d/1s0n64k12_r9MglT5m9lr63M5F3e-xRyaMeYP7rdOTrA/web-reports?bl=editors.documents-frontend_20240924.02_p2&context=eJwV0XlQ1EcWB_D29-v3UwEBUTwQEBQP8AgixotDGGZqYAVJVPoX1iNcoYgGoqKuZ7yzom4KjKKiMtzgOB4YyvuK4IlRomIk0SgJ6sKgBTog4wr79Y9PdXe9V_1e97Op7OtkjWHbFMEiewiWCytsBVsNJjhhJ1iIo2AF4O4k2AhnwTRQCXH9BLvYX7DRAxCHSBfkDBIsxlWwQnfBUgYL9n6IYIlDBbMbLpgbXID3PoL1Gi1YbyiFUWMEyxor2JZxgukmCJYBu6DrU8FmTBTs3iTB_obgIME-m40eVMEmwt1YwZ5C7jzBHsYJ9gJ6Jgo2EB4kCea_QLAwaFqKmvDbOsFeQul6wU7BLxsEewJhGwWbBZN2CKaHjN2C7YNh2YJNgM49gtnvFWzDfvQJG3KxwmiDYAHQo0CwAeAKoyGnUDAj3DQJVgd9jwnmBaxcMEc4XSHYDXh8XrBm8Lwq2DhYAzsg_LpgX0DILbwXdNX4U9gLZZB3W7Dj4HNXsClw_r5gt6GiVrAqeAPyQ8H-80iwg1BUhxichhvw8xPBfgX3Z4KNhey_BSsBhwbBBkM5_AxXoRZevBSsHT60YG6tmBt4QjwshufQ9vHsoLJLcBfsHFXmCi_6qyzCRWWx4OivMg-Y_6nKlsJZuAW1k1X2HHpGqiwoWmVR8CNsmamy3XBSVdmzWJWtn6uyTAiJU9lncDleZTXguAT3wqx0le1cq7IceA6vYMZ3KhOwF_LgCtyCemiEZrDAn841LNanSYqH7XNapB-hLrlFqofNV1qkHZBc3yqlwcBP3kieEB3zRlLh6FiLdBIu-1okd71FGg6z11ikueC6ziJ5Qf8NFmkwtJ2xSJ2wv8oiFcKNBe1SDawIeCetBzXwnfQlxH71ToqHsxnvpCtQPbtDug8TV3VIweB0s0NygZ53O6TeMNXJKmlg4Ear5AkZ26xS1kcGq7QPkvf9T0qDTZ93StuhratT6oRzrl1SJcxa0CXNAd8VXdIkkFZ2STZQuJjJh6HuKZPrYVd-N1lf2E2OhsE7JHkEXDNI8h24Wom9LMt3wMNblkfC2c9l-QrMny3LyVCxRZYvQVqlLC-H1gZZtsJSGy5XeXD5NphfTeFvwal9CneBzMapfC9sfTWVZ0Lr26ncCr_PCOD99gRwd3h2OID_F5JdAnkaVHsHco9JgXwkZGQH8l3g4BXE-8Oy8UF8LVxIDOJX4bvUIP491FIwfwI1k4L5I4j8IZjPhs7rwVy5EczLaoL5cRjkP40PBaZO4z0g5ME07uoWwr3gvT6EK-EhPC8ihJfBHXMI_xMuNofwa6CEhnJ7KNsTyo_D0dJQfhGqjaH8PjibQrkbePXX8NHQGK3hrXD-Ww2vgtfLNLwdOlZreLc1Gu62XsOHQd1RDa-HhnINb4ZV9zR8G5x7oOGVMLdJw5PArQX5oPMM41FgGRLGaWgY_5caxv8NK78O47tzwngxmEvC-FsY1xbGJ4MWIqEMjkMDNMM9Ny3_Hf4YruVmGD9CyzUg-2h5H8hJ0PL7KYjDgUVaXgTTlmm5HmwytdwJEkxavumClm-Hg9e0PORXLQ-Hw8-1_Cc476HjVbBwgo6nQ8NEHbfAm_k6_h6scTpuE6_j43_Q8amQ66zn1yHVTc_XwgbIglExej4espL1_OFBPa-HobV6_s8-4TwBbvQN54_g7IBwfhW6rwznDpDYPYIvhAybCJ4Fxhm51GdmLg2CypO5VA2bz-XSLrD_JZeKHudSBXzS00DB0C_WQO4wMMlAnh-tM9A4eLbTQMsLDHTgjIGKIPWsgZZBr7cGcob0NgNtgkPvDFQO2d3yqARGzMsjn9t55AdRXXkUA0WB-WSCp3Py6SXY7c-nvjDsQD6NgYOF-VQMNa35tHNxAeWAIbOAjsHrxwXUDtamApLMBZTyuoAWAZcKqS_ELiykeKh2L6L74J1aRPJPRVQbUUxd_yim7tOLKWFjMS2ArTuL6eaJYqqDU-eL6Qp8YSqhOLj8VwnVQObgUuoXUErD4c76UqoDpaKU7CGo8RDpIO_DISqD04OMdBkOjjFSGbhFGWkYsGgj9YCeSUbqDd5rjeQPw3YbaQxkVRgpH0ZWHabV3ESbINDbRFoYOspEoyB7golKoPxrE52B6StMNAuul5joLvQ6ZSJnWHLaRKvA472JfMEYeYROwJCEI-QDTWlHqCiokUzQL62RhkPJjkY6CpreTZQ2t4mWQ9ujJuoE9Y8m-hJcg83kBc-FmV7BiHIzTQTdGTNFQftlM3VBxh0z7YNp3s0UDYkTmslvXzNNgeZLzfQBHL1byANMEbZKOViFrSKptkpMia0yDy5abJVZHbbKTKutosJSXztlDVi0dsoHKE21U47BtZV2ykOIyrZTYkBf0UuJhqcneykvweGivbL6lr2S0-CgHJvuqCxa4Kg42fU4tbX9pOL42-aqgm4utpFp8SkLk0LjlqQkDPFOSkxJT1u8ZGxiWsLSb5JS05eM-WpxWmp6UmrifD9fP3_fyX7-Y3395n_r93-dgtTP&build-label=editors.documents-frontend_20240924.02_p2&imp-sid=CMzD1Jfb8IgDFWQOEgcdx9UZXg&is-cached-offline=false"
    Referrer-Policy: strict-origin-when-cross-origin
    Content-Encoding: gzip
    Server: ESF
    X-XSS-Protection: 0
    X-Content-Type-Options: nosniff
    Set-Cookie: NID=518=wapVBVvQxqyOtw4HzaLSxSM6gHqsnlPZnoxOxO_AceegTcG0ClLJUjVStJGhGhTyDytaERkxBPTWXh16l5cp4oj-m-LZybuIIyDXIYBiqz-_gNxgPAAFqMXMbrNqCqgkb9OautsLEoKLCuIBjxBw0H7qScCqqeYOcLVQ2kfx2yjit2Yx; expires=Thu, 03-Apr-2025 22:10:00 GMT; path=/; domain=.google.com; Secure; HttpOnly; SameSite=none
    Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
    x-l2-request-path: l2-managed-5
    Transfer-Encoding: chunked
  • flag-gb
    GET
    https://docs.google.com/document/d/1IIB6hhf_BB1DaxzC1aNfLEG1K97LsPsN55AT5pFWYKo/mobilebasic
    Remote address:
    216.58.212.206:443
    Request
    GET /document/d/1IIB6hhf_BB1DaxzC1aNfLEG1K97LsPsN55AT5pFWYKo/mobilebasic HTTP/1.1
    User-Agent: Mozilla/5.0 (Linux; Android 6.0; Nexus 5 Build/MRA58N) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/72.0.3626.121 Mobile Safari/537.36
    Accept: text/html,*/*;q=0.8
    Accept-Encoding: gzip
    Accept-Language: zh-CN,zh;q=0.8,en;q=0.6
    Cache-Control: no-cache
    Host: docs.google.com
    Connection: Keep-Alive
    Response
    HTTP/1.1 200 OK
    Content-Type: text/html; charset=utf-8
    x-robots-tag: noindex, nofollow, nosnippet
    Cache-Control: no-cache, no-store, max-age=0, must-revalidate
    Pragma: no-cache
    Expires: Mon, 01 Jan 1990 00:00:00 GMT
    Date: Wed, 02 Oct 2024 22:10:00 GMT
    P3P: CP="This is not a P3P policy! See g.co/p3phelp for more info."
    Content-Security-Policy: require-trusted-types-for 'script';report-uri https://csp.withgoogle.com/csp/docs-tt
    Content-Security-Policy: base-uri 'self';object-src 'none';report-uri https://docs.google.com/document/cspreport;script-src 'report-sample' 'nonce-JkIie1ZV1XlQB2s62h4e-w' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';worker-src 'self' blob:
    reporting-endpoints: default="/document/d/1IIB6hhf_BB1DaxzC1aNfLEG1K97LsPsN55AT5pFWYKo/web-reports?bl=editors.documents-frontend_20240924.02_p2&context=eJwV0XdU1UcWB_Dx95v7U-EJSMCCVBEVWxAxGmk-XjlABIlR5ydrCS0cogsRUdcaW9wVdXPQKHYeHXw-C4ZjbxGwYZSouBJjlLUtRRf0geAK-_WPz5ly59y5M9fmopNj50y2WREsqpdgObDSVjALHNcIpnUQLB_cHQUb5iyYDiogrp9gF_oLNmoA4hDlIli_QYLNdBUsxF2wAkjxEOz9YMESvQXTDBXMDc7D-xGC9RklWF8ogZGjBds2RrCNYwUzjhcsE3ZA92eCTZ0g2J2Jgj2F0BDB4r8QLB2-nIF6VMEmwO1YwR5DzlzB7scJ9gJ6Jwo2EO4lCRYwXzA9NC7G3fCvNYK9hJK1gp2EX9cJ9gj06wWbDk82CTZxq2DhkLlTsD3gky3YeOjaJZjdbsHW7UPNsC4HI4wyCRYEvfIFGwCuMAr2FghmhusWwerA6ahgQ4CVCeYAp8oFuwaPzgn2CryqBBsLq2ArRFwVbBZob-DNYKzGH8NuKIXcm4IdgxG3BZsE5bWCVcIbkO8L9s8Hgh2AwjrE4BRcg18eCfYbuD8RbAxkPxWsGOyfCeYBZfALVEEtvHgpWDt8aEHvWtE78IJ4SIfn0PZxba-yi3AbNA4qc4UX_VUW6aKyWHAIUJknzPtMZYvhDNyA2s9V9hx6R6ksJEZl0fATbPxKZTvhhKqyJ7EqWztHZVmgjVPZl3ApXmU14LAIeWF6hsq2r1bZXiiBo_AQnsKg71XmDTfhHtRDAzSDFf50rmGxIxqleNgyu0X6CeqSW6R6-OFyi7QVkutbpTQY-OkbyQtiZr6RVDgyxiqdgEt-Vsk93CoNhRmrrNIccF1jlYZA_3VWyQPaTlulLthXaZUK4Nr8dqkGlgW9k9aCGvxO-hpiv3knxcOZzHfSZaie0SHdhQkrOqRQcLzeIblA79sdUl8IdOyUdDBwfafkBZmbO6VtH5k6pT2QvOd_UhpsmNYlbYG27i6pC866dksVMH1-tzQb_JZ1SxNBWt4t2UBBOpMPQd1jJtfDjrwecnhBDzkGPLZK8jC4YpLkW1BVgbksy7fA01eWh8OZabJ8GebNkOVkKN8oyxchrUKWl0LrM1nuhMU2XK705PJNaHo1ib8Fx_ZJ3AWyGgL5btj0KpBnQevbQN4Jv08N4v12BXF3eHIoiP8Hkl2CeRpU-wZzz4nBfDhkZgfzHWA_JIT3hyXjQvhqOJ8Ywqvg-9QQ_neopVD-CGomhvIHEPVjKJ8BXVdDuXItlJfWhPJjMChgMvcGpk7mvUB7bzJ3dNNyF3gfruVKhJbnRmp5Kdxq0vI_4UKzll8BJSyM20HprjB-DI6UhPELUG0O43fB2RLG3WBIfx0fBQ0xOt4K577T8Up4vUTH26FjpY73WKXjbmt13Afqjuh4PTwr0_FmWHFHxzfD2Xs6XgFzGnU8CdxacB6MXnoeDdbBek7eev43Vc__Acu_1fOde_W8CJqK9fwtBLbpuQ4MEAWlcAzkdj23hTtuBv47PBxq4E0wbpiB62BvgoHfTcE-7F9o4IUweYmBh4NNloE7QoLFwDecN_AtcOCKgWt_M_AIOPTcwH-Gc55GXgkLxht5BjybYORWeDPPyN9DZ5yR28Qb-bgfjTwQcpzD-VVIdQvnq2EdbPsoOZzfPxDO68G7Npz_5ZMIngDXnCL4AzgzIIJXQc_lEdweEntG8gWQaRPJt4F5ag598lUODYLAlByqOJFD1fDD2RzaAXa_5lDhHzlUDp_2NlEo9Is1kTsMTDKR10drTDQWnmw30dJ8E-0_baJCSD1joiXQ562JnCGjzUQb4OA7E5VBdo9cKoZhc3NpxM1c8ofo7lyaCYXBeWSBx7Pz6CVo9uWRE_jsz6PRUFKQR0ehpjWPtqfn014wZeXTUXj9Rz61Q2djPklN-ZTyOp8WApcKyAliFxRQPFS7F9Jd8E0tJPnnQqqNLKLuL4qo55QiSlhfRPNh0_Yiun68iOrg5LkiugyzLMUUB5f-XUw1kOVRQv2CSmgo3FpbQnWglJeQHYQ0HCQj5H44SKVwapCZLsGB0WYqBbdoM_kAizFTL-hONFPPJDP5rjZTAPjsNNNo2FZupjwYXnmIVnILbYBgXwsZwHukhUZC9ngLFUPZtxY6DVOWWWg6XC220G3oc9JCzrDolIVWgOd7C_mBZvhhcgJz1GE6DoMTDtMIsKYdpsKQBrKAc1oD-UDx1gY6Arq-jZQ2p5GWQtuDRuoC9WEjfQ2uoU00BJ6LJnoFw8qaaAIYTzdRNLRfaqJuyLzVRHtgsm8zxUDi-Gby39NMk6D5YjN9AHvfFvIAS6StUgadwlaRVFvlgtVWmd5hq8zqtFXmwmI_jbIKug0apadRoxxI1ShFULVco9RCdLZGmQnh5X2UGGg40UdpBfsLdsrKG3bK_mf2ytEpDsrC-Q7KoWl9FUdNr5Ob2k8oDv_dUf9CcrGNSotPWZAUFrcoJWGwb1JiSkZa-qIxiWkJi_-alJqxaPQ36WmpGUmpifP8_fwD_D73Dxjj5z_vO___A3da0qk&build-label=editors.documents-frontend_20240924.02_p2&imp-sid=CJWM75fb8IgDFa6eIAEdZ2w1nw&is-cached-offline=false"
    Referrer-Policy: strict-origin-when-cross-origin
    Content-Encoding: gzip
    Server: ESF
    X-XSS-Protection: 0
    X-Content-Type-Options: nosniff
    Set-Cookie: NID=518=17wVptjeUbOkhlQeX7TR5zySpA33a1lDH_K17aAooTh1KXfYnYYh_-Ry9jfEAprE8LhOTakUKD5490VE1jFKIxtuGSCrhGYrY-pYaOc3JE9veCpc3h5kpoEgVibCdtjbJ1P40ywB6pf3CoraEacSiC4GMF8fCknc6trWzebzQMZt2coP; expires=Thu, 03-Apr-2025 22:10:00 GMT; path=/; domain=.google.com; Secure; HttpOnly; SameSite=none
    Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
    x-l2-request-path: l2-managed-5
    Transfer-Encoding: chunked
  • flag-gb
    GET
    https://docs.google.com/document/d/1s0n64k12_r9MglT5m9lr63M5F3e-xRyaMeYP7rdOTrA/mobilebasic
    Remote address:
    216.58.212.206:443
    Request
    GET /document/d/1s0n64k12_r9MglT5m9lr63M5F3e-xRyaMeYP7rdOTrA/mobilebasic HTTP/1.1
    User-Agent: Mozilla/5.0 (Linux; Android 6.0; Nexus 5 Build/MRA58N) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/72.0.3626.121 Mobile Safari/537.36
    Accept: text/html,*/*;q=0.8
    Accept-Encoding: gzip
    Accept-Language: zh-CN,zh;q=0.8,en;q=0.6
    Cache-Control: no-cache
    Host: docs.google.com
    Connection: Keep-Alive
    Response
    HTTP/1.1 200 OK
    Content-Type: text/html; charset=utf-8
    x-robots-tag: noarchive
    Cache-Control: no-cache, no-store, max-age=0, must-revalidate
    Pragma: no-cache
    Expires: Mon, 01 Jan 1990 00:00:00 GMT
    Date: Wed, 02 Oct 2024 22:12:03 GMT
    P3P: CP="This is not a P3P policy! See g.co/p3phelp for more info."
    Content-Security-Policy: require-trusted-types-for 'script';report-uri https://csp.withgoogle.com/csp/docs-tt
    Content-Security-Policy: base-uri 'self';object-src 'none';report-uri https://docs.google.com/document/cspreport;script-src 'report-sample' 'nonce-HY78H-bs5yW20jLwDHPUIg' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';worker-src 'self' blob:
    reporting-endpoints: default="/document/d/1s0n64k12_r9MglT5m9lr63M5F3e-xRyaMeYP7rdOTrA/web-reports?bl=editors.documents-frontend_20240924.02_p2&context=eJwV0XdU1UcWB_Dx95v7UwEBESwICIIFWxAxFpqPx3v7YAVJos5P1hJaWKILFtS1xhZ3RU0OGkVF5dHB57NgOPYWARtGiYorSYyyQV2KLuijbmC__vE5M_fcOXPvzLV67ujQOZftVASL6CNYFqy3FswMZ2wE09gLlgtuDoKNchJMC2UQM1Cwq4MEGzcYeYhwFsxxqGBzXQTLcxMsaZhgXcMFi_cUzGakYK5wBbrGCNZvnGD9oQjGjhdszwTBtk8UTD9ZsDTYBz0fCzZrimAPpwr2OwQHCfbJHPSgCjYFHkQL9hyyFgr2JEawV9A3XrAh8DhBML_FgoVCw0rUhH9tEuw1FG0W7Bz8uEWwZxC6VbDZMHW3YAZI2y_YIRiRIdhk6D4gmO1BwbYcRp_w5AhqwZYsxDDOKFgA9MkVbDC4wDjIzBPMBHfMgtWA4ynBvICVCGYP50sFuw3PLgv2BjwqBJsIG2A3hN0SbB5o7uLdoK_E38JBKIbse4KdhrEPBPOH0mrByuEdyE8E--apYEchvwY5OA-34Ydngv0Ebi8EmwAZvwtWCHZ1gg2DEvgBKqAaXr0WrA3-aMbcWjA38IBYWA4vofVDbKeya_AAbOxV5gKvBqks3Fll0WDvpzJ3WPSxylbCRbgL1dNU9hL6RqgsKEplkfAdbP9MZfvhrKqyF9Eq27xAZemgiVHZJ3A9VmVVYL8C98LsVJXt3aiyTHgJb6AL5K9UNhQ84RvYD-fgGtyAu1AL9dAEFvjNqYpFj2mQYmHX_GbpO6hJbJZq4esbzdJuSKxtkVJgyEfvJA-ImvtOUuHkBIt0Fq77WCQ3g0UaCXM2WKQF4LLJInnBoC0WaRi0XrBI3XC43CLlwe3FbVIVrAlolzaDGtgufQ7RX7RLsXAxrV26AZVzOqRHMGVdhxQMDnc6JGfo-6BD6g_-Dp2SFoZs7ZQ8IG1np7TnA2OndAgSD_1PSoFtn3ZLu6C1p1vqhksuPVIZzF7cI80HnzU90lSQ1vZIVpC3nMnHoeY5k2thX04v2ZDXS46CYbsleRTcNEryfagow16W5fvg7i3Lo-Hip7J8AxbNkeVEKN0uy9cgpUyWV0NLnSx3wkorLpe7c_keNL6Zzt-DQ9t07gzp9f78IOx448_ToeW9P--En2cF8IEHArgbvDgewP8Dic6BPAUqvQO5-9RAPhrSMgL5PrDzCuKDYNWkIL4RrsQH8QrYkRzE06GagvkzqJoazJ9CxLfBfA503wrmyu1gXlwVzE_DUL8Z3BOYOoP3Ac3jGdzFVcO9oMug4UqYhmeHa3gx3G_U8N_gapOG3wQlJITbQvGBEH4aThaF8KtQaQrhj8DJHMJdwWuQlo-D-igtb4HLS7W8HN6u0vI26Fiv5b02aLnrZi0fATUntbwW6kq0vAnWPdTynXDpsZaXwYIGLU8A12acB71HKI8Ey_BQTp6h_O9qKP8nrP0ylO_PDOUF0FgYyt_DxNZQPg10EAHFcBrqoAkeuur4z_DLSB1vhEmjdFwL8hgdHwCZcTr-KAl5OLJMx_NhxiodN4BVuo47QJxZx7dd0fFdcPSmjmt-0vEwOP5Sx7-Hy-56Xg5LJut5KtRN0XMLvFuk513QGaPnVrF6PulbPfcHTfufeBhkORn4LUh2NfCNsAX2fJBo4E-OGngteFYb-F8GhPE4uO0Yxp_CxcFhvAJ6rw3jdhDfO5wvgTSrcL4HTLOyaMBnWTQUys5mUSV8fSmL9oHtj1mU_2sWlcJHfY0UDO7RRhoNQxKM5PHBJiNNhBd7jbQ610hHLhgpH5IvGmkV9HtvJCdIbTXSNjjWbqQSyOiVTYUwamE2_fVcNi2FMfeyyRcie7JpLuQH5pAZns_PoddgcziHHGHEkRwaD0fzcqgAqlpyaO_yXMoEY3ounYK3v-ZSG3Q25JLUmEtJb3NpGXApjxwhekkexUKlWz49Au_kfDqWmk8lIH-fT9XhBdTz5wLqPbOA4rYW0GLYsbeA7pwpoBo4d7mAbsA8cyHFwPV_F1IVpA8rooEBRTQS7m8uohpQSovIFoLqj5Eesv84RsVwfqiJrsPR8SYqBtdIE40AFmWiPtA3wUT9wXujifxgxH4TjYc9pSbKgdHlx2k9N9M2CPQ2kw48x5ppLGRMNlMhlHxppgswc42ZZsOtQjM9gH7nzOQEK86baR24d5nJBwaOPkFuYIo4QWdgeNwJGgMNKScoP6iezDAwpZ5GQuHuejoJ2v4NlLKggVZD69MG6gb1lwb6HFyCG8kL_isaqR1GlTTSFNBfaKRIaLveSD2Qdr-RDsEM7yaKgvjJTeR7qImmQ9O1JvoD7L2byR3M4dZKCXQKa0VSrZWZhdbKbLhqwdphrczrtFYWwkofG2UD9OhslN56G6VirY1SDZEZNspcMJT2U6Kg_mw_pQXsrtoq6-_aKpl1dsqpmfbKssX2ioN1nzNpbWcVe2P5PyY6W0ekxCYtSQiJWZEUN9w7IT4pNWX5ignxKXEr_5aQnLpi_BfLU5JTE5LjF_n6-Pr5TPP1m-Dju2ip7_8BOcbf_A&build-label=editors.documents-frontend_20240924.02_p2&imp-sid=CK72mNLb8IgDFfwOEgcduTEtFQ&is-cached-offline=false"
    Referrer-Policy: strict-origin-when-cross-origin
    Content-Encoding: gzip
    Server: ESF
    X-XSS-Protection: 0
    X-Content-Type-Options: nosniff
    Set-Cookie: NID=518=HyhQxFZ6CHCNjZLlpLFREaNaZ2V23ZaHDUoaFrIMQlGi7ole485ZHoQF3AFpQeshuFnRD8nyOPHBXzGIqyVwF3L3EmdPQk-vUUTGhU4-Jm_kDLG0CAGNorTGNVjhS_mT8vKST6c9edodzHirekv8ZkeO5JyzXMZ2ey2C49ELQCTFLAZZ; expires=Thu, 03-Apr-2025 22:12:02 GMT; path=/; domain=.google.com; Secure; HttpOnly; SameSite=none
    Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
    x-l2-request-path: l2-managed-5
    Transfer-Encoding: chunked
  • flag-gb
    GET
    https://docs.google.com/document/d/1IIB6hhf_BB1DaxzC1aNfLEG1K97LsPsN55AT5pFWYKo/mobilebasic
    Remote address:
    216.58.212.206:443
    Request
    GET /document/d/1IIB6hhf_BB1DaxzC1aNfLEG1K97LsPsN55AT5pFWYKo/mobilebasic HTTP/1.1
    User-Agent: Mozilla/5.0 (Linux; Android 6.0; Nexus 5 Build/MRA58N) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/72.0.3626.121 Mobile Safari/537.36
    Accept: text/html,*/*;q=0.8
    Accept-Encoding: gzip
    Accept-Language: zh-CN,zh;q=0.8,en;q=0.6
    Cache-Control: no-cache
    Host: docs.google.com
    Connection: Keep-Alive
    Response
    HTTP/1.1 200 OK
    Content-Type: text/html; charset=utf-8
    x-robots-tag: noindex, nofollow, nosnippet
    Cache-Control: no-cache, no-store, max-age=0, must-revalidate
    Pragma: no-cache
    Expires: Mon, 01 Jan 1990 00:00:00 GMT
    Date: Wed, 02 Oct 2024 22:12:03 GMT
    P3P: CP="This is not a P3P policy! See g.co/p3phelp for more info."
    Content-Security-Policy: require-trusted-types-for 'script';report-uri https://csp.withgoogle.com/csp/docs-tt
    Content-Security-Policy: base-uri 'self';object-src 'none';report-uri https://docs.google.com/document/cspreport;script-src 'report-sample' 'nonce-WNHg9PKWW_CaxkVsUwBUDQ' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';worker-src 'self' blob:
    reporting-endpoints: default="/document/d/1IIB6hhf_BB1DaxzC1aNfLEG1K97LsPsN55AT5pFWYKo/web-reports?bl=editors.documents-frontend_20240924.02_p2&context=eJwV0XdU1FcWB_Dn7_fuTwUEJGJBqtiwBRGjkeYw5QysIInK-4W1hBaW6DIW1NWoscXdoG4OGkVFZejgOBYMx94iWDFKVIwkMejGshQ9oAMyrrBf__icV899993rcKafmz2e6bhgmxXBYnoJlgerHAWzwjEnwTSughWCt5tgI9wF00IVJPYX7PwAwcYMFMwCMR6CeQwWLN5TsCJvwdJ9BHs7RLAUf8GchgvmBefg7SjB-owRrC-Uweixgm0bJ9im8YIZJgqWBTug-yPBpk8S7M5kwf6EiHDBPpmFHFTBJsHtBMEaIG-uYPcTBXsGvVMEGwT3UgULni-YDpqW4k34Za1gz6FsnWAn4Kf1gj0E3QbBZsLkrYIZIWunYHtgWI5gE6Frl2DOuwVbvxd5wvo8jDDGLFgo9CoUbCB4whjILUI94LpVsHrod0SwocAqBHOFk5WCXYOHZwV7AX6XBRsPq2ErRF0V7DPQ3MB_wVCDmsJuKIf8m4IdhVG3BZsCZ-8KdhMq6wSrhlcg3xfs3w8E2w_F9TiDk3ANfnwo2M_g_UiwcZDzp2Cl4PJEMB-ogB_hMtTBs-eCdcC7VvStDX0DP0iCxfAU2t-vXVR2AW6Dk6vKPOHZAJVFe6gsAVyDVeYL8z5S2VI4DTeg7mOVPYXeMSoLj1NZLHwPm2aobCccV1X2KEFl6-aoLBs0iSr7BC4mqawWXJcgLszMVNn2NSrLhTI4Ak_hBbRCJwz-WmX-cBPuwS_QAC1ggz_ca1nCqCYpCbbMbpW-h_q0VukxfHOpVdoKaY_bJBMM-vCV5Adx8a8kFQ6Ps0nH4WKgTfI22qThMGu1TZoDnmtt0lAYsN4m-UD7KZvUBXurbVIRXJvfIdXCitA30jpQw95In0PCF2-kJDid9Ua6BDWzOqW7MOmrTikC3K53Sh7Q-3an1BdC3OySFgZtsEt-kLXZLm17z2yX9kDanv9JJtj4aZe0Bdq7u6QuOOPZLVXBzPnd0mwIXNEtTQZpZbfkAEWLmXwQ6huY_Bh2FPSQjUU95Djw2SrJI-CKWZJvweUqzGVZvgW-AbI8Ek5_KsuXYN4sWU6Dyk2yfAFMVbK8HNqeyLIdljpwudqXyzeh-cUU_hrcOqZwD8huDOG74dsXITwb2l6HcDv8Oj2U998Vyr3h0cFQ_l9I8wjjJqgJCOO-k8P4SMjKCeM7wGVoOB8AyyaE8zVwLiWcX4avM8L5P6GOIvhDqJ0cwR9AzHcRfBZ0XY3gyrUIXl4bwY_C4OCp3B-YOpX3As29qdzNS8M94K1Rw5UoDc-P1vByuNWs4X_A-RYNvwJKZCR3hvJdkfwoHC6L5OehxhLJ74K7NZJ7wdABWj4GGuO0vA3OLtTyani5TMs7oHOVlvdYreVe67R8GNQf1vLH8KRCy1vgqztavhnO3NPyKpjTpOWp4NWK-2Dw0_FYsA3RcfLX8X-oOv4vWPmlju_M1fESaC7V8dcQ0q7jWtBDDJTDUZA7dNwR7njp-a_w23A9b4YJI_RcC7nJen43Hfuwb5GeF8PUZXpuBIdsPXeDZKuebzyn51tg_xU91_ys51Fw8Kme_wBnfQ28GhZMNPBMeDLJwG3wap6BvwV7ooE7JBn4hO8MPATy3I38KmR4GfkaWA_b3ksz8vv7jfwx-NcZ-V8_iOLJcK1fFH8ApwdG8cvQc2UUd4GUntF8AWQ5RPNtYJmeRx_MyKPBUHU8j2rgmzN5tAOcf8qj4t_zqBI-7G2mCOifYCZvGJRqJr_31pppPDzabqblhWbad8pMxZBx2kzLoM9rM7lDZruZNsKBN2aqgJwe-VQKI-bm099O5NNCGHUzn4Igtjuf4qE4rICs0DC7gJ6D094C6gfD9hXQWCgrKqAjUNtWQNsXF1IumLML6Qi8_L2QOsDeVEhScyGlvyykRcClIuoHCQuKKAlqvIvpLgRkFJP8QzHVRZdQ919KqOe0EkreUELz4dvtJXT9WAnVw4mzJXQJPrOWUiJc_E8p1UK2Txn1Dy2j4XBrXRnVg1JZRs4Q3niADJD_7gCVw8nBFroI-8daqBy8Yi00DFichXpB71QL9YWANRYKhmE7LTQWtlVaqABGVh-kVdxKGyEswEp68B9tpdGQM9FKpVDxpZVOwbQVVpoJV0utdBv6nLCSOyw5aaWvwPetlQLBEnOIjsGQ5EM0CppMh6g4vJGs0N_USMOhdGsjHQZt3yYyzWmi5dD-oIm6QP2tiT4Hz4hmGgpPRTO9gBEVzTQJDKeaKRY6LjZTN2TdaqY9MDWgheIgZWILBe1poSnQcqGF3oFLQCv5gDXaUakAu3BUJNVRiS91VObCeZujMrPTUZlhd1RUWBropKwGm95JeQdXVjop9yE2x0mJB2NlHyUOGo73UZ6Dy3lnZdUNZyX3iYtyZJqrsmi-q-Lm1OtYVsdxxbWhur5C8nCMMSWlL0iNTFySnjwkIDUlPdO0eMm4FFPy0r-nZmQuGfvFYlNGZmpGyrygwKDgwI-DgscFBs1bGPR_cyPVMg&build-label=editors.documents-frontend_20240924.02_p2&imp-sid=CL-Vu9Lb8IgDFTyFIAEdnnMRkg&is-cached-offline=false"
    Referrer-Policy: strict-origin-when-cross-origin
    Content-Encoding: gzip
    Server: ESF
    X-XSS-Protection: 0
    X-Content-Type-Options: nosniff
    Set-Cookie: NID=518=vQwDEEe5MJ5Z3v_Enw3m6Jm-fR-u-_8lU2t6bwIglbzNZanua2zF6Z_u-aPSnMvPAcp5zE_3wwazhv7kkAv1oi_F9UcjAVi6ShzZpDCd25_4UVUsRBUAaCHI-9ljFRyRGdctSjDFeMqAq0BmfbLE7Vk6dS9bXP1-lTl8jOV60u4r2Bo; expires=Thu, 03-Apr-2025 22:12:03 GMT; path=/; domain=.google.com; Secure; HttpOnly; SameSite=none
    Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
    x-l2-request-path: l2-managed-5
    Transfer-Encoding: chunked
  • 216.58.201.104:443
    ssl.google-analytics.com
    tls
    2.1kB
     6.3kB
     10
    9
  • 142.250.187.206:443
    tls, https
    1.5kB
     40 B
     1
    1
  • 142.250.187.206:443
    tls, https
    1.5kB
     40 B
     1
    1
  • 142.250.187.206:443
    android.apis.google.com
    tls
    6.5kB
     9.1kB
     24
    23
  • 216.58.212.206:443
    https://docs.google.com/document/d/1s0n64k12_r9MglT5m9lr63M5F3e-xRyaMeYP7rdOTrA/mobilebasic
    tls, http
    2.0kB
     19.3kB
     19
    21

    HTTP Request

    GET https://docs.google.com/document/d/1s0n64k12_r9MglT5m9lr63M5F3e-xRyaMeYP7rdOTrA/mobilebasic

    HTTP Response

    200
  • 216.58.212.206:443
    https://docs.google.com/document/d/1IIB6hhf_BB1DaxzC1aNfLEG1K97LsPsN55AT5pFWYKo/mobilebasic
    tls, http
    1.9kB
     19.3kB
     17
    21

    HTTP Request

    GET https://docs.google.com/document/d/1IIB6hhf_BB1DaxzC1aNfLEG1K97LsPsN55AT5pFWYKo/mobilebasic

    HTTP Response

    200
  • 91.204.227.39:28844
    120 B
     40 B
     2
    1
  • 91.204.227.39:28844
    60 B
     40 B
     1
    1
  • 91.204.227.39:28844
    120 B
     40 B
     2
    1
  • 91.204.227.39:28844
    60 B
     40 B
     1
    1
  • 91.204.227.39:28844
    60 B
     40 B
     1
    1
  • 91.204.227.39:28844
    60 B
     40 B
     1
    1
  • 142.250.179.228:443
    tls, https
    1.7kB
     40 B
     4
    1
  • 142.250.179.228:443
    www.google.com
    tls
    11.1kB
     11.0kB
     30
    37
  • 91.204.227.39:28844
    60 B
     40 B
     1
    1
  • 91.204.227.39:28844
    60 B
     40 B
     1
    1
  • 91.204.227.39:28844
    60 B
     40 B
     1
    1
  • 91.204.227.39:28844
    60 B
     40 B
     1
    1
  • 91.204.227.39:28844
    60 B
     40 B
     1
    1
  • 216.58.212.206:443
    https://docs.google.com/document/d/1s0n64k12_r9MglT5m9lr63M5F3e-xRyaMeYP7rdOTrA/mobilebasic
    tls, http
    1.7kB
     19.3kB
     14
    18

    HTTP Request

    GET https://docs.google.com/document/d/1s0n64k12_r9MglT5m9lr63M5F3e-xRyaMeYP7rdOTrA/mobilebasic

    HTTP Response

    200
  • 216.58.212.206:443
    https://docs.google.com/document/d/1IIB6hhf_BB1DaxzC1aNfLEG1K97LsPsN55AT5pFWYKo/mobilebasic
    tls, http
    1.8kB
     18.9kB
     15
    14

    HTTP Request

    GET https://docs.google.com/document/d/1IIB6hhf_BB1DaxzC1aNfLEG1K97LsPsN55AT5pFWYKo/mobilebasic

    HTTP Response

    200
  • 91.204.227.39:28844
    60 B
     40 B
     1
    1
  • 91.204.227.39:28844
    60 B
     40 B
     1
    1
  • 91.204.227.39:28844
    60 B
     40 B
     1
    1
  • 91.204.227.39:28844
    60 B
     40 B
     1
    1
  • 91.204.227.39:28844
    60 B
     40 B
     1
    1
  • 91.204.227.39:28844
    60 B
     40 B
     1
    1
  • 224.0.0.251:5353
    3.7kB
     11
  • 1.1.1.1:53
    docs.google.com
    dns
    122 B
     77 B
     2
    1

    DNS Request

    docs.google.com

    DNS Request

    docs.google.com

    DNS Response

    216.58.212.206

  • 1.1.1.1:53
    ssl.google-analytics.com
    dns
    70 B
     86 B
     1
    1

    DNS Request

    ssl.google-analytics.com

    DNS Response

    216.58.201.104

  • 1.1.1.1:53
    android.apis.google.com
    dns
    69 B
     109 B
     1
    1

    DNS Request

    android.apis.google.com

    DNS Response

    142.250.187.206

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/user/0/com.incm.bshe/files/dex
    Filesize

    483KB

    MD5

    e12d777273c3f474433d79bc6f46513c

    SHA1

    ded0831d8bda2885bb178161575a3edb4c358549

    SHA256

    bc13812bbf18e78aa81d1e49fd2b62864069620846c56e94d70dbe0c6d64d7f4

    SHA512

    e09b08a56793a36f0ccc40db82f05f0ff8597597cc1b1afd0b1fbdc472a8cfbaae9e40a205f4b85a7652b045a442b0822e808e224d603fdab5e2e5a23141297b

    Download Submit

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.