Analysis

  • max time kernel
    149s
  • max time network
    163s
  • platform
    android_x64
  • resource
    android-x64-arm64-20240624-en
  • resource tags

    androidarch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20240624-enlocale:en-usos:android-11-x64system
  • submitted
    20/01/2025, 13:27

General

  • Target

    file.apk

  • Size

    4.9MB

  • MD5

    3aa725662c012f2bf54b993467b2edd5

  • SHA1

    d2b8d88803c79e218fad64c736ad23c1386f3181

  • SHA256

    44fbc03f41d9478db9346c22b0d9854a2f2fa39e959a354e26fa8991a0669f12

  • SHA512

    50a7775daccd555bb716eb0a6c5499f5de6f7d9c96a93b8db8e78fbf33d13dd0f52fd016286f5f47c85246cb59517892df20bde403ac15611771cad03470f45d

  • SSDEEP

    49152:wWRsEXk0xyNKmY3XjU45iS7xrG+/G0Lf9xjVKScou/GQnzTT63lUmiLctkc:1RsXWyNjY3Xp5iSRG8PVKLPH8lOQf

Malware Config

Extracted

Family

octo

C2

https://8b230a871b7f1ff2a1ad9f9c07d6e67a.info

AES_key
AES_key

Signatures

Processes

  • com.nstar5machinemodules
    1⤵
    • Loads dropped Dex/Jar
    • Makes use of the framework's Accessibility service
    • Obtains sensitive information copied to the device clipboard
    • Acquires the wake lock
    • Makes use of the framework's foreground persistence service
    • Queries the mobile country code (MCC)
    • Uses Crypto APIs (Might try to encrypt user data)
    • Checks CPU information
    • Checks memory information
    PID:4500

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/data/com.nstar5machinemodules/.global.com.nstar5machinemodules

    Filesize

    48B

    MD5

    046a414913add6f5bb60072c7db819b6

    SHA1

    451ee4f6809260aec622d772fd329c7d0297a842

    SHA256

    b66c1320cb063a1d391c94273572ea6edae76c8c8b0a07f8d75c88686f0df72a

    SHA512

    4e6355f3051ed5e811ab030abde1f5be7f5e1cf33be99cd08477e9b6c015deb1d8bd75a09fb9c7176b8511c5ad0a67abc0902a3531e97564ccb6afc57496a47c

  • /data/data/com.nstar5machinemodules/files/.m

    Filesize

    322KB

    MD5

    77dc50489b9323274732d27dc8a4e803

    SHA1

    0e02a3595b62489d0739d771881da8604d117c65

    SHA256

    c5684e792d1ebefea6aac09fed45911703fd58c899f8a08133d49dd91429a820

    SHA512

    0684a92f3e9c525384cfa53f531afba61e5930e1c27032a7e27e3315f72761b62e122dc34768d8162ba08f9bed53d148aa8dc034b46456bdd211f230637eba58

  • /data/data/com.nstar5machinemodules/oat/x86_64/[email protected]

    Filesize

    353B

    MD5

    bf6a42ce3f578f27fceb3902476e8b35

    SHA1

    3c53316e0d8a22ae2f03d48571de66e69b6b1cf8

    SHA256

    2ed544241bc488154b61aae70581666180ee5d4c1a6ae2bcdc2dc12b0cf6f251

    SHA512

    9ebecfe984fd8dd1cfc35b618f5daeb06260e10d90d2f033020bf29299d5604e6e2124c1ab065f1f8490dc00edcbdeaea2c9e21cd6c7f177ab5cba3e33afe191

  • /data/user/0/com.nstar5machinemodules/[email protected]

    Filesize

    526KB

    MD5

    0ca0ac7aaa3bdf2153febb80fc2318aa

    SHA1

    7dd749da58a973266c035aefb762dc9c0d7b42e3

    SHA256

    87df9c07bdd2706460228a00c7dc5bf75493d89b8606506f93c24e21aa7e8ee3

    SHA512

    4f4efd3a13771b5442c949f4cc1fb2baf20e76653968f2bd1b62bb6a141f69ef13c2de4d5fb4170b3f2fdc29e2d9e0fb4ce90e9e6c662e9443070d998b194a7b