Analysis

  • max time kernel
    23s
  • max time network
    157s
  • platform
    android-10_x64
  • resource
    android-x64-20240910-en
  • resource tags

    arch:x64arch:x86image:android-x64-20240910-enlocale:en-usos:android-10-x64system
  • submitted
    22/10/2024, 22:09

General

  • Target

    b181e386fe054ff6346ed0821f382a8201c150d9ca6bc612dfc5335cfe8a2f42.apk

  • Size

    434KB

  • MD5

    073a0b8f8c43e35ed0dd6ce0bd5277a9

  • SHA1

    fb7b0df4329efe94f103467bc1faf4ad959e84ad

  • SHA256

    b181e386fe054ff6346ed0821f382a8201c150d9ca6bc612dfc5335cfe8a2f42

  • SHA512

    ad64057f5fb42ffcfec2764a2a8444a00306d45b2f8e8d65a1b8d8cb73875e57f2bf27fb44453306136a700fa76d240cc1579e710c4dc78a8bfad2cc75199bde

  • SSDEEP

    12288:L/KPDwUEhMBUE8DtuK/fi+JWAxrv4zfhWuODAm/e:+pEaBUVr/fiRQk0ACe

Malware Config

Extracted

Family

xloader_apk

C2

http://91.204.226.105:28844

DES_key

Signatures

Processes

  • com.bdwd.dddv
    1⤵
    • Checks if the Android device is rooted.
    • Removes its main activity from the application launcher
    • Loads dropped Dex/Jar
    • Queries account information for other applications stored on the device
    • Reads the content of the MMS message.
    • Acquires the wake lock
    • Makes use of the framework's foreground persistence service
    • Registers a broadcast receiver at runtime (usually for listening for system events)
    • Uses Crypto APIs (Might try to encrypt user data)
    PID:5134

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/data/com.bdwd.dddv/files/dex

    Filesize

    766KB

    MD5

    f4d3e97741d6170ffdf0fe6434b3bd51

    SHA1

    fd8718ad2332b417c7b432f0b0eaac8cb7a009dd

    SHA256

    42ef6ee6b4c2c26333b3572c8ba6db03a74a23ed6e455a29c65f3249c8adfb3e

    SHA512

    2f98eb992a9c75e6d2f1bfe467db40d4f02fb0f29be99ce21c17b41fcf5a4a3c73e21d63a6c6d5987c7faa72cc26ac69b0206fd988511c37150c54f0b5b39598