3cae06ec8a7224cbdea6093d499bda7a1df1de8fec029bc63e82e7559d6c69b2

General

Target
plugin.apk
Size 330KB
Sample241020-fxb1aashrn
SHA256 76556dae89b8ae56ed6b52bee819a8cd5809ce967d4c1c8386f1ba438057a18f
MD5 a2e1d87e7666a64b69bc5d2bd2750628
SHA1 e82331f06cfcdecc3b0e04dfc41062ef2479ed4f
SHA512 40de9a6ed6f3a2a580afa3eeb7ce87750d71b5e4cb92a175180414b58cb00de18c026c1c1c937d73b09b7d5e0fa4e5dfe026bc5b66afd532f35a326f2f362ff6
SSDEEP 6144:r5dN8DhJ876h6i3X+22I81FDamNi3QS9B4u64e0Oep2uOpOjpCpF1CMqQBwClJi:rOr87Ev3P2ImFWM+U4w4VoLCMlBwCy
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

discovery evasion persistence

Malware Config

Signatures

Loads dropped Dex/Jar 1 TTPs 2 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/com.xpaper.video/files/xpg/xpg.jar	4403	/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.xpaper.video/files/xpg/xpg.jar --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/com.xpaper.video/files/xpg/oat/x86/xpg.odex --compiler-filter=quicken --class-loader-context=&
/data/user/0/com.xpaper.video/files/xpg/xpg.jar	4377	com.xpaper.video

Queries information about active data network 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.xpaper.video

Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.wifi.IWifiManager.getConnectionInfo	com.xpaper.video

Queries the mobile country code (MCC) 1 TTPs 1 IoCs

discovery

System Network Configuration Discovery

T1422

description	ioc	Process
Framework service call	com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone	com.xpaper.video

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs

persistence

Broadcast Receivers

T1624.001

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	com.xpaper.video

Checks memory information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	com.xpaper.video

com.xpaper.video
1⤵
- Loads dropped Dex/Jar
- Queries information about active data network
- Queries information about the current Wi-Fi connection
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Checks memory information
PID:4377
- /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.xpaper.video/files/xpg/xpg.jar --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/com.xpaper.video/files/xpg/oat/x86/xpg.odex --compiler-filter=quicken --class-loader-context=&
  2⤵
  - Loads dropped Dex/Jar
  PID:4403

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Event Triggered Execution

1

T1624

Broadcast Receivers

1

T1624.001

Privilege Escalation

Defense Evasion

Download New Code at Runtime

1

T1407

Virtualization/Sandbox Evasion

1

T1633

System Checks

1

T1633.001

Credential Access

Discovery

System Information Discovery

1

T1426

System Network Configuration Discovery

1

T1422

System Network Connections Discovery

2

T1421

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

daemon

Path /data/data/com.xpaper.video/files/daemon
Size 17KB
SHA256 054a1272e4c0e6272878e6068d7944b0962d8ab79d68bcda8e28a65fc1f5a340
MD5 a094f7f9077482cfd462073dccd0628c
SHA1 2c31ea529559aee3857f2f97a3b19267c1c660de
SHA512 64fd5e2546d5ab60305ba8b82544146f238539509e24fda579ee9518218252521270128ae288f32200e445223e259c148e4fc2f1b17f0b819a72aa80c8ef2dad
SSDEEP 384:CSFAsJl/+JnnnnnnnnnzawMXUvNaobkO9SeFCMsG:BFAsJ2w6pbNSe
MD5 SHA1 SHA512 SSDEEP

Submit Download

xpg.jar.cur.prof

Path /data/data/com.xpaper.video/files/xpg/oat/xpg.jar.cur.prof
Size 141B
SHA256 f2fc88e2ac6ca13987c00573a0900c10bd2b04ca2a20f20258166cc735cc90cf
MD5 313dec4a8419a33fe0416bc6177109a7
SHA1 21ac0d918ddb05286e69f6a8687a0e984998b835
SHA512 ac098a2d5a968ca933de51e91f7fb4d0b80c179dfe45b6c6b56764395392df27cbdd8fc04699c44c4cf639ec32bc1e78a26733505f4ba7fa0075e453f9950597
MD5 SHA1 SHA512

Submit Download

tem.jar

Path /data/data/com.xpaper.video/files/xpg/tem.jar
Size 213KB
SHA256 840448fdc1785cbbf2de82a455ff76366968278795b9f134f98f03de37c73701
MD5 e7e33cd90f2e50ee4b6753458bb1017d
SHA1 b5a804bbb238d4d7b93972ccaa7ef4b250056fcb
SHA512 c27b0b4a9db017da24aab67296b8145d8abd188ca9ffe65f6e0761a63e9414d2ae98c9cc47fe5143b67b48d3ed3a18951fb0486ea9e117f09c9fa24b40d175a4
SSDEEP 6144:XBHx+oUDiZCBfGAtzxsWprPyyGk4TM9MxstfTSaDFyz:xHx+orcBx9sWprPynxTo2aDFyz
MD5 SHA1 SHA512 SSDEEP

Submit Download

xpg.jar

Path /data/data/com.xpaper.video/files/xpg/xpg.jar
Size 213KB
SHA256 f5f91673e9c1eabe872694e1546203a2c50652a68cf65ee1db9aac3e7bde7e15
MD5 24653ebc43b7934908f3aaa44c965478
SHA1 7b114ef77f2bbef0ce95f1683c559caeaa0c373d
SHA512 175d6da1cf6e3cd7f94419fca5c0a70937a3813a977f5f02511fb0ad310f3048d381e7efe1e58572046a74b1576edc2976bde18dfa75cd6b04e341f42fa9d50b
SSDEEP 3072:k2MOwTOEDamNiI67Qwj9Yv3jU4u64D1v2mZFGcxNue119t1udVDQ+Ys4KBCmNlNd:rwTRDamNi30S9v4u64G0YeNWuGzOtpEx
MD5 SHA1 SHA512 SSDEEP

Submit Download

xpg.jar

Path /data/user/0/com.xpaper.video/files/xpg/xpg.jar
Size 420KB
SHA256 2ae11c56be797931cb220c1cbb0c8722f816095d97bbfc834fb7ba6c1018985e
MD5 67e18dd0ba39c0468b4aea092baac18e
SHA1 a0dd58884f1f92dd3793ef0eafe20ba240679557
SHA512 91a8005535feed9c3688556c4be2963265ab64a7d5a18da5157743a519296797c7dd9e0df2b7ce0ecf5f5d4753bdde80194756f3e2cf3b993fae15aaec8f00ef
SSDEEP 6144:Ms9g+j9YwI671B+3rz9eU9lgXyAsDp7Wr3Fr:p9YwzRB+3kVSpIr
MD5 SHA1 SHA512 SSDEEP

Download

xpg.jar

Path /data/user/0/com.xpaper.video/files/xpg/xpg.jar
Size 420KB
SHA256 a1ce51ad603a7be3f63a8f722bcd47543faeb2b8269fcf8d9bb4ccf5d08625c2
MD5 3a842b02dd231038d4a17354f104ab63
SHA1 20d07d04f84cff9494fb8f49de6cb83932b38e36
SHA512 5a092e2176c499aaea3296a966bfb9e67d41ff9e2f1aabda0a48cb621240f1443466bae43ffcf6e6b5a938b78541d457a93289f24cbde8071d242eb6057dcf34
SSDEEP 6144:Ms9g+j9YX6ZQHsWw+kKcDwv9lgXyAsDp7Wr3Fr:p9YX6MsWWG4VSpIr
MD5 SHA1 SHA512 SSDEEP

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads