4fcce7c445d89d7de943ec0e0c2fc285d4b25a67950ad7d6bcb50dbcbc4ac29b

Resubmissions

17/01/2025, 08:53

250117-ktnl5azqbl

17/01/2025, 08:53

250117-ktdf6azjet10

17/01/2025, 08:34

250117-kgfqraynfy10

Analysis

max time kernel
6s
max time network
304s
platform
android_x64
resource
android-x64-20240624-en
resource tags

androidarch:x64arch:x86image:android-x64-20240624-enlocale:en-usos:android-10-x64system
submitted
17/01/2025, 08:53

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
4fcce7c445d89d7de943ec0e0c2fc285d4b25a67950ad7d6bcb50dbcbc4ac29b.apk
Size 10.5MB
Sample250117-ktdf6azjet
SHA256 4fcce7c445d89d7de943ec0e0c2fc285d4b25a67950ad7d6bcb50dbcbc4ac29b
MD5 8ebf4bdf9326073fa0577a2e1950e1af
SHA1 7a30345f421c243cbef4dd42d60f5de45b99d580
SHA512 006dd16eee88a56657bafed02d5585d8a04bc98139249f9fb0553382d284a23546071f3bff9e39881150d0ba802f92ac26b1fbd8fb6c5b20f1a6cd6301e40243
SSDEEP 196608:3wGdnljZ/MLUBwiwOYTR8dhTVKZZRa+6Gz4+bpRdS388yngsaFf/FYd9r:3VRRZvai3YOBkRTz/RdS3886gl/FYdF
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

evasion

Malware Config

Signatures

Loads dropped Dex/Jar 1 TTPs 1 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/nmrdiw.xhckto.wotzbp/app_sheriff/ccLObl.json	4940	nmrdiw.xhckto.wotzbp

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
5	api.ipify.org
4	api.ipify.org

nmrdiw.xhckto.wotzbp
1⤵
- Loads dropped Dex/Jar
PID:4940

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ccLObl.json

Path /data/data/nmrdiw.xhckto.wotzbp/app_sheriff/ccLObl.json
Size 573KB
SHA256 97e086bd422edfb25b19a5c358135bed6f11f201914b9d5f171bb3da4b24eda4
MD5 53eeb221635303b30aa63f98d92018a5
SHA1 0bc80cd5795806afeb684c6a05d5d3a7ba968262
SHA512 626d3acf96b30c202559bb169c46126f0629a549cf568e1b318061434e41273fedb6385a1c91676c95cccc9b8e4a1aa0bb91ff12ba0b1b6df7bf66b597e1782e
SSDEEP 12288:5YJ0XjFgQ/qXbjOY4xL/vfNH7y5m9LSyvPLTLqONJC8Gb9w9G:5iITqXv5aLVe5m9L1vPmC08Gb93
MD5 SHA1 SHA512 SSDEEP

Submit Download

ccLObl.json

Path /data/data/nmrdiw.xhckto.wotzbp/app_sheriff/ccLObl.json
Size 573KB
SHA256 7a239f0cc770425914abd361298e39858b80264408ed6574a27af83da3c1ab5c
MD5 04c0f10a3fa92c116a88892b7215cbda
SHA1 595a0efbedb351b9881b56dd4fa6f34a830a7906
SHA512 49a7ee1b543716ad6340e5845af7ab151af3761c36ccc52c34c61e54b9993cb6b486f416ac18ad2016852bcdf838c835aa2a5de769bf1015ef1c4441d2825198
SSDEEP 12288:tbigxjyWbRpyxKhFLLCaELsTfpAEkoPcf8+fWz2MlXyTxBSG3kNI/EATjxVimn:keyWG0fCRLsTRg0h7alD0yD/ie
MD5 SHA1 SHA512 SSDEEP

Submit Download

ccLObl.json

Path /data/user/0/nmrdiw.xhckto.wotzbp/app_sheriff/ccLObl.json
Size 1.2MB
SHA256 01c2dc0c47a460e49a56282e5a3b0becd0b9f260d60139390ed026f83825b570
MD5 bbdde0270e2573891dd7872eccfe5a06
SHA1 b0ee37a19ab30ae509b1280a217f845d37708743
SHA512 41d2ef59b64fb00d4d01218ba84fcafb6ce13532e851d7b8232eaba63e7f18c29f0f5089fc0b22889a6a32c77715fb36ca2b2eb49984d0707b1c28f122a01329
SSDEEP 12288:sNeACJEcG2XT8pms8h/lNg3QiiuvXC3I47sntJkgpmXbM0LKifimUAHmq3BsDv2e:sNeACJ3G6T8pmsGgLibuM5LtfPFTH+
MD5 SHA1 SHA512 SSDEEP

Download

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads