Analysis

  • max time kernel
    6s
  • max time network
    154s
  • platform
    android-10_x64
  • resource
    android-x64-20240910-en
  • resource tags

    arch:x64arch:x86image:android-x64-20240910-enlocale:en-usos:android-10-x64system
  • submitted
    13-11-2024 22:03

General

  • Target

    ef94d055f7d3d318a2d33dcdaa2182fdd7a30c0ca0f9235e20dc6b8211aed14e.apk

  • Size

    4.7MB

  • MD5

    00128fa75ad5dd22f77b0512d3587601

  • SHA1

    8693752601503b77a56d0520569ded251b7348c2

  • SHA256

    ef94d055f7d3d318a2d33dcdaa2182fdd7a30c0ca0f9235e20dc6b8211aed14e

  • SHA512

    92af7968be606a7749b069ee5b9d023569ae82e9af5de58ff08fa0b2681ef445575405f05d46d62ae77ab10751701d791de764dd6f6738e29f1b41064473fa76

  • SSDEEP

    98304:49E62rVCnNf4UlNQ4g/Ho4BAqh3sRHF/T30uqTddAVQrTkJDuJI6lzed+hQrEsCl:KU4g/IJdJim6ls+hQ4zf

Malware Config

Extracted

Family

ermac

C2

http://ytgrfesrjhgf.pro; http://ytgrfesrjhgftf.pro; http://ytgrfesrjhgftfuyfq.pro; http://ytgrfesrjhgftfuyfqsre.pro; http://ytgrfesrjhgftfuyfqsrey.pro

http://ytgrfesrjhgf.pro

AES_key

Extracted

Family

hook

C2

http://ytgrfesrjhgf.pro; http://ytgrfesrjhgftf.pro; http://ytgrfesrjhgftfuyfq.pro; http://ytgrfesrjhgftfuyfqsre.pro; http://ytgrfesrjhgftfuyfqsrey.pro

http://ytgrfesrjhgf.pro

AES_key

Signatures

Processes

  • com.mokusubitivu.zexajo
    1⤵
    • Loads dropped Dex/Jar
    • Obtains sensitive information copied to the device clipboard
    • Queries information about running processes on the device
    • Acquires the wake lock
    • Makes use of the framework's foreground persistence service
    • Queries information about the current Wi-Fi connection
    • Queries the mobile country code (MCC)
    • Registers a broadcast receiver at runtime (usually for listening for system events)
    • Schedules tasks to execute at a specified time
    • Uses Crypto APIs (Might try to encrypt user data)
    • Checks CPU information
    • Checks memory information
    PID:5093

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/data/com.mokusubitivu.zexajo/app_suggest/qOJs.json

    Filesize

    691KB

    MD5

    34eda891de0eddcbd0f2c5cd6b70a436

    SHA1

    8e2bd325df089df52534e4c75d9aadfe0c5bdca8

    SHA256

    92e59e4cf96282d1b450d22c84dec9b10a9d8ee803a4a6255dd3dbab6adb2bb8

    SHA512

    4b26c0ffdb2cd2185db677bb2e8898bf01c372633be44a5f736bbcc171aa1fc4e1ab1dd6c734771df69260ea49cc10813bb801369ae9284d259113da1ac3eacb

  • /data/data/com.mokusubitivu.zexajo/app_suggest/qOJs.json

    Filesize

    691KB

    MD5

    b0cf3eb44021e9ff24a9aff9a6d618e4

    SHA1

    1e8567b94285305637b424289298e9e8103bb68c

    SHA256

    1a9be3cbf38b4306df2a808a52ce709be880db6df93e7a58b240be193f60629d

    SHA512

    f28ed9aa4f8de4221e8bfadfa3a4d09616c00066518d252e70b453f40e1ccbf0a85eb59f09cfa97954725b48182b2cb891f5852aa237d1cfee650c7199cf24c7

  • /data/data/com.mokusubitivu.zexajo/no_backup/androidx.work.workdb

    Filesize

    4KB

    MD5

    f2b4b0190b9f384ca885f0c8c9b14700

    SHA1

    934ff2646757b5b6e7f20f6a0aa76c7f995d9361

    SHA256

    0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514

    SHA512

    ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1

  • /data/data/com.mokusubitivu.zexajo/no_backup/androidx.work.workdb-journal

    Filesize

    512B

    MD5

    a6ee9cd9c2518093cd01ba545cac285a

    SHA1

    dc4507e578385df7bf2bc50c473d4bae1483dcc6

    SHA256

    59af3725f83a8441396bbcbf5ae49ca8a3dcd27dc6b59867123ef7b30063beb5

    SHA512

    b6b20f199159ac9a307ce89579f6039c176cbc4680427012eacb543982c06b5c96c76aa64873e6277fc0c8bc82f75bc7a20d2a35be153f3714e5b6c90a32c785

  • /data/data/com.mokusubitivu.zexajo/no_backup/androidx.work.workdb-shm

    Filesize

    32KB

    MD5

    bb7df04e1b0a2570657527a7e108ae23

    SHA1

    5188431849b4613152fd7bdba6a3ff0a4fd6424b

    SHA256

    c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479

    SHA512

    768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

  • /data/data/com.mokusubitivu.zexajo/no_backup/androidx.work.workdb-wal

    Filesize

    16KB

    MD5

    f3dddb567578484e539f546fcadc7c29

    SHA1

    b2bd687e8bef8776ee89262c68d235664de720eb

    SHA256

    c15a5a5421a16ee393b225678104e2230a5e7077ae4c9760729f540807887916

    SHA512

    f5e53478b16825ea2d9e97fdc0dac2e1497507f007fbe59a0bcc0b234b4344ef15bbe3334a4a3ac891bd00fbbd936a268be6a84f6ced00e8e7d469ee8e480a77

  • /data/data/com.mokusubitivu.zexajo/no_backup/androidx.work.workdb-wal

    Filesize

    108KB

    MD5

    4dde4f0716573181734a3ee5e98ed91e

    SHA1

    30d95aacb811a67352a532fccf4d052ca933c447

    SHA256

    bed57548a7bbd06a490bb047b0370695feefd49e71707a7359383aedb561cc44

    SHA512

    5587ac59a2c1530173c3c3353fd8e151e34fa90b12bf63994efab18cbe937cf76237a75de9712f0edbbe6bfd62090740ba8bb39054d5f65ae0a69121072558cb

  • /data/data/com.mokusubitivu.zexajo/no_backup/androidx.work.workdb-wal

    Filesize

    173KB

    MD5

    5a727e2ffd7863246005a8609c7737a8

    SHA1

    73e75486c67a4ad7d53251dd7049a0fdbd723937

    SHA256

    d44aa54c8606dfad9749740d2d6bccfbc0823ad4158d4dfcf4d6f39aa047ec0c

    SHA512

    6ce6e307a01e6ee68f1b5cbd4dec9a79ac4f0f540c1ba0a3d773a68e4a1b11f9fc26d7aa0aee69f710303055833e5464216f2ad4a1ac39e000a60b81a9fb2b74

  • /data/user/0/com.mokusubitivu.zexajo/app_suggest/qOJs.json

    Filesize

    1.5MB

    MD5

    56f384576200bda9fe2fcf7a0fe0ff1f

    SHA1

    343e91224ef03dc6b323ade4dae19b36fe982a82

    SHA256

    20345681cc4e1b9e271a70f1db9320256e7e905bd60a0bf583f3af0e1adf3456

    SHA512

    4d023dd3f639dec6a6e8f2d2f4d918b942bcd33aeac2917a7610ed8a416917407e9732407b2e74af9498080695e2dc26ef1604a6688dc4c3ff5ec92b363c854f