d96173d6a98242950fd8797d8b36a8836abce6a991c9f987d84514dee1d7309f

Analysis

max time kernel
5s
max time network
27s
platform
android-9_x86
resource
android-x86-arm-20240910-en
resource tags

arch:armarch:x86image:android-x86-arm-20240910-enlocale:en-usos:android-9-x86system
submitted
21/03/2025, 18:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

base.apk
Size

7.1MB
MD5

ef9ca4ebd1e4f8c345a8ef2c9cbcb756
SHA1

cc378fa2d6b2af6dcf65f8c8608fa5e0306f0f45
SHA256

0ed5e46d9da10084baa9cad664f2f54b15ace995208e171d5c49c56466a64146
SHA512

f9a0abd1d8be2ab13d6cc2c70ef946075bc18f0b0400b0814e0855c617c6506701c8b4f7341d643b52f75049d11ff8ec3bf6b65a3bfaa329b3591700d161980e
SSDEEP

98304:R5iSRG9jujVKjJsDSj76Rs4J3z8pPcoAABKPbfUfmNB6Ae0OR5Y:RrBU1s2j76RH8yoAC+NV

Score

7^/10

evasion

Malware Config

Signatures

Loads dropped Dex/Jar 1 TTPs 1 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/com.handed_wlantestc74/app_buyer/bFUoSrN.json	4436	/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.handed_wlantestc74/app_buyer/bFUoSrN.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/com.handed_wlantestc74/app_buyer/oat/x86/bFUoSrN.odex --compiler-filter=quicken --class-loader-context=&

com.handed_wlantestc74
1⤵
PID:4394
- /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.handed_wlantestc74/app_buyer/bFUoSrN.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/com.handed_wlantestc74/app_buyer/oat/x86/bFUoSrN.odex --compiler-filter=quicken --class-loader-context=&
  2⤵
  - Loads dropped Dex/Jar
  PID:4436

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.handed_wlantestc74/app_buyer/bFUoSrN.json

Filesize
1005B

MD5
9b419dacb611e17f57642e96bc85d879

SHA1
a707e337dfa8c69dfad994557e2f266a1f68edfa

SHA256
4e8aa5cc88340ece3bcbe3b947a8de8717c12778511500db3529f4bb5ceaae56

SHA512
68a35399dfeab4ed7f17ed46ac422d790533c1d5fb359a992b365e15bfc17eebe005b828f0a3de043d615f51dce16bf3395aa6201c7001b2247442ca94661be9

Download Submit
/data/data/com.handed_wlantestc74/app_buyer/bFUoSrN.json

Filesize
1005B

MD5
bf5fd9cbc0ee1f213b37e25eb899776e

SHA1
0a8700c6b743a04709b857e91a73b94e17563fe8

SHA256
3ea0dec6b7ec4309e93430e9c9cc4cd54243d7112b84be7ad4be9dc8dcb36a1c

SHA512
4dd166536690e5637e888265f935d33ed556a9023614e5acdcc7a8a71a03b8fba95785736c02eae6305edfcef16f5c6a332018139101de827470eb6dd78c8158

Download Submit
/data/user/0/com.handed_wlantestc74/app_buyer/bFUoSrN.json

Filesize
1KB

MD5
fd7cf01706c59263c15f2ce3ad438453

SHA1
5b0ac9b2c9fbbaf64bab92df3c1e192169d3da5a

SHA256
6f8088e81d70caf4f4e3a0fcbf7bfa96e9be9f6eee327e3ecef212c7eacaf684

SHA512
88562848d97db96a0cc2fd350ce5ea4fa57b221271d7d249c730084d2fd173c99511206e3625c8d328100ffa9c6bc1785430c8c422251fc8c14b00599a762b87

Download Submit