Analysis

  • max time kernel
    149s
  • max time network
    157s
  • platform
    android-9_x86
  • resource
    android-x86-arm-20240910-en
  • resource tags

    arch:armarch:x86image:android-x86-arm-20240910-enlocale:en-usos:android-9-x86system
  • submitted
    20/01/2025, 13:27

General

  • Target

    file.apk

  • Size

    4.9MB

  • MD5

    3aa725662c012f2bf54b993467b2edd5

  • SHA1

    d2b8d88803c79e218fad64c736ad23c1386f3181

  • SHA256

    44fbc03f41d9478db9346c22b0d9854a2f2fa39e959a354e26fa8991a0669f12

  • SHA512

    50a7775daccd555bb716eb0a6c5499f5de6f7d9c96a93b8db8e78fbf33d13dd0f52fd016286f5f47c85246cb59517892df20bde403ac15611771cad03470f45d

  • SSDEEP

    49152:wWRsEXk0xyNKmY3XjU45iS7xrG+/G0Lf9xjVKScou/GQnzTT63lUmiLctkc:1RsXWyNjY3Xp5iSRG8PVKLPH8lOQf

Malware Config

Extracted

Family

octo

C2

https://8b230a871b7f1ff2a1ad9f9c07d6e67a.info

AES_key
AES_key

Signatures

Processes

  • com.nstar5machinemodules
    1⤵
    • Loads dropped Dex/Jar
    • Makes use of the framework's Accessibility service
    • Acquires the wake lock
    • Makes use of the framework's foreground persistence service
    • Queries the mobile country code (MCC)
    • Registers a broadcast receiver at runtime (usually for listening for system events)
    • Uses Crypto APIs (Might try to encrypt user data)
    • Checks CPU information
    • Checks memory information
    PID:4402

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/data/com.nstar5machinemodules/.global.com.nstar5machinemodules

    Filesize

    48B

    MD5

    046a414913add6f5bb60072c7db819b6

    SHA1

    451ee4f6809260aec622d772fd329c7d0297a842

    SHA256

    b66c1320cb063a1d391c94273572ea6edae76c8c8b0a07f8d75c88686f0df72a

    SHA512

    4e6355f3051ed5e811ab030abde1f5be7f5e1cf33be99cd08477e9b6c015deb1d8bd75a09fb9c7176b8511c5ad0a67abc0902a3531e97564ccb6afc57496a47c

  • /data/data/com.nstar5machinemodules/files/.m

    Filesize

    307KB

    MD5

    4e73947cabb5db3f92ca85004981b754

    SHA1

    6d9667fdb0280ed2dcb782b4683e422a51bdc601

    SHA256

    6db94232e756b90ed437f1bc87dc38cf20fb2e7c7a19a5e40c6c17254b7e234c

    SHA512

    be8b500a7070af1dfb53b0cf1a7b327dadc4e163a6dad905496ac228c58cd1ed87b054533917924455d35e9b300683ae33e1bcdd91935a5dbae1d693c3e13d69

  • Anonymous-DexFile@0xd0178000-0xd01fb910

    Filesize

    526KB

    MD5

    0ca0ac7aaa3bdf2153febb80fc2318aa

    SHA1

    7dd749da58a973266c035aefb762dc9c0d7b42e3

    SHA256

    87df9c07bdd2706460228a00c7dc5bf75493d89b8606506f93c24e21aa7e8ee3

    SHA512

    4f4efd3a13771b5442c949f4cc1fb2baf20e76653968f2bd1b62bb6a141f69ef13c2de4d5fb4170b3f2fdc29e2d9e0fb4ce90e9e6c662e9443070d998b194a7b