Analysis
-
max time kernel
15s -
max time network
131s -
platform
android_x86 -
resource
android-x86-arm-20240624-en -
resource tags
-
submitted
23/02/2025, 23:07
General
-
Target
CapCut_Premium.apk
-
Size
10.9MB
-
MD5
548ede0959d30a22484ae452f535a0db
-
SHA1
7b34fc3a7d4f2d6ce38f3f0de08df80ed4859e27
-
SHA256
aba8466f8162846c8adc7be242bb78a346775804de2c14a978d69649b0639c6d
-
SHA512
564feb15f3ff884fee96e3a54793379d969c49d97163d9214707e6c77e50dfe6c61be04dcdb8a444f86ed96844f82a4691093d51f05654ad28ac9c1ad9b618d7
-
SSDEEP
196608:3XeOWRtCAvekoDLWGxXfyzTn9P3m5AC+FX6JagEQVZxkpUSlPJn:3OX/3xYLpxXfyzjtd3FX61PVZx8USlPp
Malware Config
Signatures
-
Loads dropped Dex/Jar 1 TTPs 2 IoCs
Runs executable file dropped to the device during analysis.
-
Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes
-
tfskbi.ztdwnc.yfprwh1⤵
- Loads dropped Dex/Jar
-
/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/tfskbi.ztdwnc.yfprwh/app_veteran/iox.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/tfskbi.ztdwnc.yfprwh/app_veteran/oat/x86/iox.odex --compiler-filter=quicken --class-loader-context=&2⤵
- Loads dropped Dex/Jar
-
Network
MITRE ATT&CK Mobile v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
573KB
MD566733db48d9cba8a319e7e1451336263
SHA1f74be1920661841d7eee576f4be0b8ae2ba028f3
SHA256dfb28b0b140228245af52b34aa9d09cff2925fff9d3d342a741580b75698e091
SHA5124b5f0d8b1421fd8934dcd154ecdaa46f86b157c9973dac5f0808b591195d3a7f061e4ccf0d90942d43921e7178a2161fb07bbb73b4e2b535a5fcaf9472c795a0
-
Filesize
573KB
MD5c491f888e98327a6a43588598dabd1b6
SHA14afdb7524284f7195ddf37ba5e8d1daf0c0b2801
SHA256d0569859013122e742a96e170860862eb814ae93c9aa689db0e0afe4c4084848
SHA5122a1436a153ba0532ea5fab3506fa3c4da30e256b9627bdbaf9d63b6f8298865b6d850e3d990ceb47046b44440bf3b8997937c9f5bc8c4e9ed65f2322a8607a3d
-
Filesize
1.2MB
MD5686bc5e0a5321eef3e910c95bdb4d06c
SHA17db19a9b3001d82e247c1b21d3bfb500c27e9782
SHA256dac86926a8bd886a8b9451eee45b39927b24395afabfde84f6cd42d5b8d24f91
SHA512bb59a9b8d0e007c7f05570e1ae7f640871b2049ea9e35edb3c967a4f67c6bdc58a7842d8fe3cbc2d99f8b169c3ea69e27a673663bfd2f323ae23b735ca135131
-
Filesize
1.2MB
MD5d83f3b2e9163dbfcf3f0b85d4c8ffda7
SHA143bd3678f168a0f0da2413d4f0de6788c88d34c3
SHA2564b81c2ee643d0f68b2b47733c310b24f47827e01f41aedd8153f449900c4ded3
SHA512a4e8b017d92b827f6ec27b7d13325b353322712b55c925fefdb3869a4558c921c5016c9f87601f544c1a89c4b2137c8aef8be5eebab7277a1f07724efa39dacc