Overview
overview
7Static
static
6AdbWinApi.dll
windows7-x64
3AdbWinApi.dll
windows10-2004-x64
3AdbWinUsbApi.dll
windows7-x64
3AdbWinUsbApi.dll
windows10-2004-x64
3Superuser.apk
android-9-x86
6Superuser.apk
android-10-x64
7Superuser.apk
android-11-x64
7adb.exe
windows7-x64
3adb.exe
windows10-2004-x64
3busybox
debian-12-armhf
1motofail
debian-12-armhf
run.bat
windows7-x64
1run.bat
windows10-2004-x64
1su
debian-9-armhf
Analysis
- max time kernel
18s - max time network
137s - platform
android_x86 - resource
android-x86-arm-20240624-en - resource tags
androidarch:armarch:x86image:android-x86-arm-20240624-enlocale:en-usos:android-9-x86system - submitted
20/10/2024, 03:30
Static task
static1
Behavioral task
behavioral1
Sample
AdbWinApi.dll
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
AdbWinApi.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral3
Sample
AdbWinUsbApi.dll
Resource
win7-20240903-en
Behavioral task
behavioral4
Sample
AdbWinUsbApi.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral5
Sample
Superuser.apk
Resource
android-x86-arm-20240624-en
Behavioral task
behavioral6
Sample
Superuser.apk
Resource
android-x64-20240624-en
Behavioral task
behavioral7
Sample
Superuser.apk
Resource
android-x64-arm64-20240624-en
Behavioral task
behavioral8
Sample
adb.exe
Resource
win7-20240903-en
Behavioral task
behavioral9
Sample
adb.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral10
Sample
busybox
Resource
debian12-armhf-20240729-en
Behavioral task
behavioral11
Sample
motofail
Resource
debian12-armhf-20240418-en
Behavioral task
behavioral12
Sample
run.bat
Resource
win7-20240903-en
Behavioral task
behavioral13
Sample
run.bat
Resource
win10v2004-20241007-en
Behavioral task
behavioral14
Sample
su
Resource
debian9-armhf-20240611-en
General
- Target Superuser.apk
- Size 823KB
- Sample241020-d2p2laycpk
- SHA256 8135f47bab91a26adfd563ed4dd22e25f454dfae02a076b6f3cd05604f2068a8
- MD5 65bd72996c68f289c5fa0b81f0874127
- SHA1 ee246d6e91017768e82b2d17e22e4044e4b7da2f
- SHA512 713468d5bce2d42d7d914077a4edc9e2b6d5fef0b657dce302750bb99b4dee3b0859c7722b4ad5b4dc125680f6690c9ee9ecd6baae1bdd21fe927a155765305a
- SSDEEP 12288:vwox9LddQ050PS59VJo1yOjLLfLHNm41awK4OhioC08pYAj4X5yXDn:Iox9XKyOL/tiXoDn
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Queries the mobile country code (MCC) 1 TTPs 1 IoCs
description ioc Process Framework service call com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone com.noshufou.android.su - Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
description ioc Process Framework service call android.app.IActivityManager.registerReceiver com.noshufou.android.su - Checks CPU information 2 TTPs 1 IoCs
description ioc Process File opened for read /proc/cpuinfo com.noshufou.android.su - Checks memory information 2 TTPs 1 IoCs
description ioc Process File opened for read /proc/meminfo com.noshufou.android.su
Processes
Network
MITRE ATT&CK Mobile v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path /data/data/com.noshufou.android.su/databases/su.db
- Size 4KB
- SHA256 0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514
- MD5 f2b4b0190b9f384ca885f0c8c9b14700
- SHA1 934ff2646757b5b6e7f20f6a0aa76c7f995d9361
- SHA512 ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1
- MD5 SHA1 SHA512
- Path /data/data/com.noshufou.android.su/databases/su.db-journal
- Size 512B
- SHA256 8a92427d7b7b0440eed157f495b1ce998dd593171d41efdf7620dfdda43a18be
- MD5 ba7de571087a4b82ea35c96f281536ca
- SHA1 ad0c54329f5ccc25c123426d6245405e7e0a73c7
- SHA512 b669a8f18e7b0730fc91560d2fc4bdb502a44e29c2222e85fd6ee971b577eaf1d6f133faa2321275b07f65405ff324bd8ad2f34e7cb842bddc7db7199c1e7f10
- MD5 SHA1 SHA512
- Path /data/data/com.noshufou.android.su/databases/su.db-shm
- Size 32KB
- SHA256 c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
- MD5 bb7df04e1b0a2570657527a7e108ae23
- SHA1 5188431849b4613152fd7bdba6a3ff0a4fd6424b
- SHA512 768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012
- SSDEEP 3::
- MD5 SHA1 SHA512 SSDEEP
- Path /data/data/com.noshufou.android.su/databases/su.db-wal
- Size 40KB
- SHA256 16e7d48426819a7cfda5b968724a2ba6618aba0d05674ca511dc0375bd6010fd
- MD5 0fe9e562db7152230e011763ecb6f513
- SHA1 3d6c9a24dd749c0d56edd8861cbb8e959f09c3f0
- SHA512 4c54e2cb81420d3d72a409eb6e5b25476b8d2c8d0419923fdb5a40f0370d1f9fc217678dfc669208532ff12b7e79e853efdade173de85e83bbd3753e7d358fd1
- SSDEEP 24:KwbxqzyGSP/HuT8vfqB7NRlgGwq8+g/EGSP/+CDMv:9bczNSP/HuYvfW5nqVTSP/Tu
- MD5 SHA1 SHA512 SSDEEP