Analysis

  • max time kernel
    146s
  • max time network
    158s
  • platform
    android-11_x64
  • resource
    android-x64-arm64-20240910-en
  • resource tags

    arch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20240910-enlocale:en-usos:android-11-x64system
  • submitted
    08/11/2024, 22:01 UTC

General

  • Target

    4a9ffd7bb29962d6cc668b4a9c5e65957dc7e3ef02630ce6a01fe0fc871e81ff.apk

  • Size

    760KB

  • MD5

    3ed9ade08e0b5c31aec010fe264d7c73

  • SHA1

    0a073df5e06a907a8756211278fef880c354763e

  • SHA256

    4a9ffd7bb29962d6cc668b4a9c5e65957dc7e3ef02630ce6a01fe0fc871e81ff

  • SHA512

    a6b320a129904813de1bc0be5964124a7dc268febd5bbdbc9460510681628b6042f8b6dc02f46cef1be9e5dc86795f70bc71b0d60ead868712f0dcc42ffea846

  • SSDEEP

    12288:z+QfWqa1a8LrewbK5STXb5WmpYshXZPbGwidNpgA:z+Ua1a2ew+STXb5WmD9idNpz

Malware Config

Signatures

Processes

  • cmf0.c3b5bm90zq.patch
    1⤵
    • Makes use of the framework's foreground persistence service
    • Requests enabling of the accessibility settings.
    • Tries to add a device administrator.
    PID:4820

Network

  • flag-us
    DNS
    android.apis.google.com
    Remote address:
    1.1.1.1:53
    Request
    android.apis.google.com
    IN A
    Response
    android.apis.google.com
    IN CNAME
    clients.l.google.com
    clients.l.google.com
    IN A
    172.217.169.14
  • flag-us
    DNS
    www.youtube.com
    Remote address:
    1.1.1.1:53
    Request
    www.youtube.com
    IN A
    Response
    www.youtube.com
    IN CNAME
    youtube-ui.l.google.com
    youtube-ui.l.google.com
    IN A
    216.58.213.14
    youtube-ui.l.google.com
    IN A
    216.58.201.110
    youtube-ui.l.google.com
    IN A
    142.250.200.14
    youtube-ui.l.google.com
    IN A
    142.250.178.14
    youtube-ui.l.google.com
    IN A
    142.250.187.206
    youtube-ui.l.google.com
    IN A
    216.58.204.78
    youtube-ui.l.google.com
    IN A
    142.250.179.238
    youtube-ui.l.google.com
    IN A
    142.250.187.238
    youtube-ui.l.google.com
    IN A
    142.250.180.14
    youtube-ui.l.google.com
    IN A
    142.250.200.46
    youtube-ui.l.google.com
    IN A
    172.217.169.46
    youtube-ui.l.google.com
    IN A
    172.217.16.238
    youtube-ui.l.google.com
    IN A
    172.217.169.14
    youtube-ui.l.google.com
    IN A
    216.58.212.206
  • flag-us
    DNS
    ssl.google-analytics.com
    Remote address:
    1.1.1.1:53
    Request
    ssl.google-analytics.com
    IN A
    Response
    ssl.google-analytics.com
    IN A
    142.250.187.200
  • 172.217.169.14:443
    tls, https
    1.4kB
    40 B
    1
    1
  • 172.217.169.14:443
    android.apis.google.com
    tls
    2.5kB
    6.1kB
    11
    11
  • 216.58.213.14:443
    www.youtube.com
    tls
    2.1kB
    8.3kB
    17
    14
  • 172.217.169.14:443
    android.apis.google.com
    tls
    2.7kB
    6.1kB
    13
    11
  • 216.239.38.223:443
    tls, https
    128 B
    40 B
    2
    1
  • 142.250.187.200:443
    ssl.google-analytics.com
    tls
    1.4kB
    6.3kB
    10
    10
  • 216.239.38.223:443
    tls, https
    128 B
    40 B
    2
    1
  • 142.250.200.14:443
    www.youtube.com
    tls
    135 B
    40 B
    2
    1
  • 172.217.169.33:443
    tls
    135 B
    40 B
    2
    1
  • 216.58.201.97:443
    tls
    135 B
    40 B
    2
    1
  • 216.239.38.223:443
    tls, https
    128 B
    40 B
    2
    1
  • 216.239.38.223:443
    tls, https
    128 B
    40 B
    2
    1
  • 224.0.0.251:5353
    3.8kB
    12
  • 1.1.1.1:53
    android.apis.google.com
    dns
    69 B
    109 B
    1
    1

    DNS Request

    android.apis.google.com

    DNS Response

    172.217.169.14

  • 1.1.1.1:53
    www.youtube.com
    dns
    61 B
    319 B
    1
    1

    DNS Request

    www.youtube.com

    DNS Response

    216.58.213.14
    216.58.201.110
    142.250.200.14
    142.250.178.14
    142.250.187.206
    216.58.204.78
    142.250.179.238
    142.250.187.238
    142.250.180.14
    142.250.200.46
    172.217.169.46
    172.217.16.238
    172.217.169.14
    216.58.212.206

  • 216.58.213.14:443
    www.youtube.com
    https
    1.4kB
    54 B
    1
    1
  • 1.1.1.1:53
    ssl.google-analytics.com
    dns
    70 B
    86 B
    1
    1

    DNS Request

    ssl.google-analytics.com

    DNS Response

    142.250.187.200

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.