Analysis
- max time kernel
91s - max time network
303s - platform
android_x86 - resource
android-x86-arm-20240624-en - resource tags
androidarch:armarch:x86image:android-x86-arm-20240624-enlocale:en-usos:android-9-x86system - submitted
21/10/2024, 05:53
Static task
static1
Behavioral task
behavioral1
Sample
Chrome.apk
Resource
android-x64-20240624-en
Behavioral task
behavioral2
Sample
Chrome.apk
Resource
android-x64-arm64-20240624-en
Behavioral task
behavioral3
Sample
Chrome.apk
Resource
android-33-x64-arm64-20240624-en
Behavioral task
behavioral4
Sample
Chrome.apk
Resource
android-x86-arm-20240624-en
Behavioral task
behavioral5
Sample
base.apk
Resource
android-x64-20240624-en
Behavioral task
behavioral6
Sample
base.apk
Resource
android-x64-arm64-20240910-en
Behavioral task
behavioral7
Sample
base.apk
Resource
android-33-x64-arm64-20240624-en
Behavioral task
behavioral8
Sample
base.apk
Resource
android-x86-arm-20240910-en
General
- Target Chrome.apk
- Size 13.0MB
- Sample241021-glkzgstdnm
- SHA256 ba25744487f1f3b4b5a63aa93a0a38eefe6d502baf3f7eeeac53efe906006b1a
- MD5 d9162e785a917a279dcffa5664763879
- SHA1 a026c5605aad87dbb71038a0fddcad9dfc2cd569
- SHA512 cc558eeaf393042d76989d3920c9212e183c0c82a8acab0611acc98400e147ee6f9d656db5eef610a4960563be2ce788400912db2f594b9987f7833f8a932683
- SSDEEP 196608:qEbHmchYpkpY+ixom3Sm8JOohCsL2aamSvn1M5UU6AKyvCgwlrSkZ7Z47URr:qSZmpSHixo6StC/AdUaKyvvgrSkhG7Y
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Loads dropped Dex/Jar 1 TTPs 2 IoCs
Runs executable file dropped to the device during analysis.
ioc pid Process /data/user/0/com.venture.nose/app_december/Yg.json 4275 /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.venture.nose/app_december/Yg.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/com.venture.nose/app_december/oat/x86/Yg.odex --compiler-filter=quicken --class-loader-context=& /data/user/0/com.venture.nose/app_december/Yg.json 4248 com.venture.nose
Processes
-
com.venture.nose1⤵
- Loads dropped Dex/Jar
PID:4248 -
/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.venture.nose/app_december/Yg.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/com.venture.nose/app_december/oat/x86/Yg.odex --compiler-filter=quicken --class-loader-context=&2⤵
- Loads dropped Dex/Jar
PID:4275
-
Network
MITRE ATT&CK Mobile v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path /data/data/com.venture.nose/app_december/Yg.json
- Size 2.8MB
- SHA256 a10c5397c973ce87ac75add960119010bfb8a0561116f851b2af457fd02fb0d9
- MD5 77c3d4ddadaa78b3f7ca55da59e50688
- SHA1 f32f1e76e0d1bf9e3cfa7996fcb6739f01b85108
- SHA512 c41977116f324d3ae0e4d53ab2455393e78be68966a5c66ea3b20bffe500eb2614440ff57b8a13ab260ac960b860283f4b5b4f1ec607a8ead23357ea6eb0d104
- SSDEEP 49152:jacQqKKt0+HXNeoVemXAlpL4o/ywPowSrIyXLFEj5jvPnUQ81suZpp:GcNaW9eo2LB6wTu5Ktjv8Q81suZr
- MD5 SHA1 SHA512 SSDEEP
- Path /data/data/com.venture.nose/app_december/Yg.json
- Size 2.8MB
- SHA256 b5b12ca015467a011b6b5a8ee58db391d54eceea12be3734e0dba2f87cd2dbe0
- MD5 67672f90b8c316ed11d16d1379d53fab
- SHA1 b23bfea08cd288e1e4104ef0340cfdbf297e1eb2
- SHA512 77bd15b05bc9dc3bcd41f2ba21d818b7e8a3b91dbe74ad6fd4c7a92c561ce25fa9d9f6310c95255c73dfb7c68689160ca8fd0a6c9b306b91260d752b9ce4ba4b
- SSDEEP 49152:M0L5lyhDnYFYeWXuKq1bPpCSodoN46XeswOAw1Nu5rh74vUcv20ZWlKyWmGW1Q4e:zLehDYqh9H+Jw52o5h4vH20sllWmGAQ5
- MD5 SHA1 SHA512 SSDEEP
- Path /data/user/0/com.venture.nose/app_december/Yg.json
- Size 7.2MB
- SHA256 1ab365c9e6ef6762b41c5761211e0f86fc38275f3faa81a937214115f418684e
- MD5 c85af0a684b3d137f89a2c17541efe1f
- SHA1 a23f5cf69d1ec21ad9b7b1459c5b5d1189da1fdd
- SHA512 e17f31b22f429746574742b7c6ef70707a44806517ae1bff4a2731b2ee80c96e0e06384c5194ee054af08c38fb7b50b448f580f62592bb3f743b1c302f8f4cfe
- SSDEEP 98304:6Y1M3DfG8K62t6bS30O2b0HNQjzuTedHz:6YO3DfTgQzwi
- MD5 SHA1 SHA512 SSDEEP
- Path /data/user/0/com.venture.nose/app_december/Yg.json
- Size 7.2MB
- SHA256 685fbd1790e197bb64912a233eb470ece543823b492e19adec834d79ab58e4a7
- MD5 49743c6747552dc46298339da1485d60
- SHA1 a9a3325b0450ba4438b7bb5e2916b18b1220dc0a
- SHA512 9118a95a0f7702428a054e677390ff36c5b820128f86d17bce2d23c062ce81b7ce5df35fce5b14a7c1fdbab4d12dadfa67ac859b651a30d9f6fe54a79db0ac04
- SSDEEP 49152:WNTs1M3DfGg4t98ajQK625r/UHkzNDvcbhbemu30mDUOfYlOAh0HNwRcihxFuQ4y:6Y1M3DfG8K62t6bS30O2b0HNQufeI4Nz
- MD5 SHA1 SHA512 SSDEEP