Analysis

  • max time kernel
    149s
  • max time network
    150s
  • platform
    android-9_x86
  • resource
    android-x86-arm-20240910-en
  • resource tags

    arch:armarch:x86image:android-x86-arm-20240910-enlocale:en-usos:android-9-x86system
  • submitted
    17-12-2024 22:09

General

  • Target

    4993ee53420a56e0112e0ae55be20abe1cf49fe3ec420ad287dbe32e353c9835.apk

  • Size

    541KB

  • MD5

    03e5f7a69c1e8ac9498531e0dd8ae699

  • SHA1

    b4f536de8262c51dd5399421346a46895108b585

  • SHA256

    4993ee53420a56e0112e0ae55be20abe1cf49fe3ec420ad287dbe32e353c9835

  • SHA512

    a0426674c0c065a5467353b61a14dd258bdc3555f734850a747b42535c3f7c59d414a50a124e55943d80b3b0705d815d8d5f342266314d0e40b25d20ea70695b

  • SSDEEP

    12288:ntxWDv1kjbXa1dcjOXCwwvhg8lD7lEkPfYmL93RKOpVnmnx:ntxbjbXa1mOXC7JRlD7O4wmL93AOpFmx

Malware Config

Extracted

Family

octo

C2

https://54ggter6ujfgt.site/NmFkZTc4YWM3ZTk2/

https://kdehrweuybvfrer4.xyz/NmFkZTc4YWM3ZTk2/

https://hrte93jdjyherhh.online/NmFkZTc4YWM3ZTk2/

https://fhw832jedsnhwsefgy.top/NmFkZTc4YWM3ZTk2/

rc4.plain

Extracted

Family

octo

C2

https://54ggter6ujfgt.site/NmFkZTc4YWM3ZTk2/

https://kdehrweuybvfrer4.xyz/NmFkZTc4YWM3ZTk2/

https://hrte93jdjyherhh.online/NmFkZTc4YWM3ZTk2/

https://fhw832jedsnhwsefgy.top/NmFkZTc4YWM3ZTk2/

AES_key

Signatures

Processes

  • com.actyoungff
    1⤵
    • Removes its main activity from the application launcher
    • Loads dropped Dex/Jar
    • Makes use of the framework's Accessibility service
    • Acquires the wake lock
    • Makes use of the framework's foreground persistence service
    • Performs UI accessibility actions on behalf of the user
    • Queries the mobile country code (MCC)
    • Requests accessing notifications (often used to intercept notifications before users become aware).
    • Requests disabling of battery optimizations (often used to enable hiding in the background).
    • Registers a broadcast receiver at runtime (usually for listening for system events)
    • Uses Crypto APIs (Might try to encrypt user data)
    • Checks CPU information
    • Checks memory information
    PID:4351

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/data/com.actyoungff/cache/oat/yqwoodpshjtrkcr.cur.prof

    Filesize

    434B

    MD5

    a948491b6a86a8068b3107459f6513b9

    SHA1

    fdc699ff798f39958e9a7ae16e73e09c3285bbed

    SHA256

    28b0ba2bb0dca92cbe5c39fe2d2e507d598d7a52ac2e68bb1a2644ddbd5e2677

    SHA512

    d7fcf1ab508ec6ca77db00cbb6b0b47fce8e2e799657397f6f2025e19a066f336d33e65345085da859788dd0e5c87637613715182ebcfdffe85964b42a28fa5b

  • /data/data/com.actyoungff/cache/yqwoodpshjtrkcr

    Filesize

    448KB

    MD5

    4bb829e9b50fff2dd6c5dae485233a67

    SHA1

    2114a1484baec0f00b283b8d0c8fb8c826ddeebc

    SHA256

    8a252d4616dbd490ef673f6c995a5439a25c5fa2e5e3cc698943a411d5221d97

    SHA512

    cacb0fa48eda68425d8d07a38016f16c35dddb873608210aa07ab9f5f50c19174064f4bd26286b7c3061023f2d42f7872226fc033a074fb2ac44da9bf9a1d6fc

  • /data/data/com.actyoungff/kl.txt

    Filesize

    28B

    MD5

    6311c3fd15588bb5c126e6c28ff5fffe

    SHA1

    ce81d136fce31779f4dd62e20bdaf99c91e2fc57

    SHA256

    8b82f6032e29a2b5c96031a3630fb6173d12ff0295bc20bb21b877d08f0812d8

    SHA512

    2975fe2e94b6a8adc9cfc1a865ad113772b54572883a537b02a16dd2d029c0f7d9cca3b154fd849bdfe978e18b396bcf9fa6e67e7c61f92bdc089a29a9c355c6

  • /data/data/com.actyoungff/kl.txt

    Filesize

    73B

    MD5

    027cd812ad040c38fbe26a3344b1b2c3

    SHA1

    7d3c5cb3d10a808f08a78c57af0096051f08094d

    SHA256

    13a6b3240a6013053ab89b8e284b18157a823885a2a1ae2dd2094a5cb6a876e4

    SHA512

    a7a04f047524d7f1145f5d3c025532bdd30bc6569b783734756d23ad579387b256c0a5c76adeccef7fa4a5439f01ad631bbd4de2e07baa6baf50f349f4a22cfb

  • /data/data/com.actyoungff/kl.txt

    Filesize

    237B

    MD5

    ae7559bd253654eeea6f1a6ab75d2002

    SHA1

    9111e7fc084fcc86a9d86e615b490223b9325a82

    SHA256

    57c25f2973edc268175851d7082ff25cc1b0802ab3958bab9a7f3c24c64cd51e

    SHA512

    8a2dab9408bcb3fe3122889553797bff42baf9b9e792c949b688927edc1a8a12c4e1954561aa90b9289898e62be3f342aa4e6ef3bc8eaa61fc691661a175edb1

  • /data/data/com.actyoungff/kl.txt

    Filesize

    54B

    MD5

    f0a271997c33a79b6863903e6d71d22e

    SHA1

    4442e458492274fd3bf39889d61b10a96c05c9f9

    SHA256

    f2ab39c6591fa5c8bf1635b1910dcbc6d669b0b399ce78309938c090c8005bdd

    SHA512

    9d7314887fdc97c7e9ac05255d9cb468889240372c81fdb59554e5ac0e28532b5cc765664ab418b7ff7ea88755703a121aae70dd814722826d684eab67443c2e

  • /data/data/com.actyoungff/kl.txt

    Filesize

    437B

    MD5

    a437068b9dc86f5160430ec694650cdd

    SHA1

    647e775e1b4a16a642f332c69feac124ab4063a9

    SHA256

    498ab4744200c3f36b7650371494a73eb805eb028ba2cb9468a8dcb4f34c8f63

    SHA512

    b7f980d99dc5d6106c4c764b46096fc487f9df6cf63e7758428849b14887658faa9a82c5102dffcc1d021da795aaf128d15a2559ba92e849c86d4ac925a23bba