Analysis
-
max time kernel
6s -
max time network
24s -
platform
android-13_x64 -
resource
android-33-x64-arm64-20240910-en -
resource tags
-
submitted
22/03/2025, 00:13 UTC
General
-
Target
07b114daff3e1edd5e7f1a2f813cd7dda6f3902cda03f1a8f4ecf230efa52ef9.apk
-
Size
10.4MB
-
MD5
f69bc6289179b4ce9f85e736cdc59a24
-
SHA1
a35a253dcde3b6489a7558af9ebb57e89add7fea
-
SHA256
07b114daff3e1edd5e7f1a2f813cd7dda6f3902cda03f1a8f4ecf230efa52ef9
-
SHA512
05f9ec614651e85ea83d0375287efa0fcdebcdd9b8f021120391dcfe3dbb0e87b7cd6fa89370395395d27139cb1f667752f57c89ee662d36b2a379cae8680fd2
-
SSDEEP
196608:fzwwJTKJYA18D7TqdyX3qJsupHdDFy/B+sI3tWjJ4ro6eZhn:fUWe0nNqSitFy5+sI3q2ro6eZJ
Malware Config
Signatures
-
Loads dropped Dex/Jar 1 TTPs 1 IoCs
Runs executable file dropped to the device during analysis.
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes
-
ugoxqk.drmwah.iamvvs1⤵
- Loads dropped Dex/Jar
Network
-
DNSapi.ipify.orgRemote address:1.1.1.1:53Requestapi.ipify.orgIN AResponse -
DNSrcs-acs-tmo-us.jibe.google.comRemote address:1.1.1.1:53Requestrcs-acs-tmo-us.jibe.google.comIN AResponse
-
DNSandroid.apis.google.comRemote address:1.1.1.1:53Requestandroid.apis.google.comIN AResponse
-
224.0.0.251:5353 -
1.1.1.1:53api.ipify.orgdns
DNS Request
api.ipify.org
-
1.1.1.1:53rcs-acs-tmo-us.jibe.google.comdns
DNS Request
rcs-acs-tmo-us.jibe.google.com
-
1.1.1.1:53android.apis.google.comdns
DNS Request
android.apis.google.com
MITRE ATT&CK Mobile v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
573KB
MD5e781cdc207dffcfa4af2a8fb1f03494e
SHA199b0f5b4badbbc9fe34920ad10425c14e81b0157
SHA2566ed524bcba6f49c7c2d1e43b3a97dc2f249153df9f05708e135195458e3fb6bd
SHA51264037687bc224835a1afa2d25edc410cdc3dd14b363820912f80a45a02967e927752b6a279358e2edee066656fa14c7b0888a2dda6c7d8a353217a0285936bdd
-
Filesize
573KB
MD5eda202925347dcdb203a6eb17b2ace2b
SHA1ebda38a837165a73a40e5c17860ecf9f5783c913
SHA2566e0025a94858061b51696d604a9e6f473b39bb975a8132b51bac16355ac76384
SHA5127d052536204863ad15cb9979628a77209cc3ed9cedb71ceea24aff87ae184b77ca6de9ab8fb29f47a695fda1528668f862b519c0d575a82e3edfc461ecc6896c
-
Filesize
1.2MB
MD5fb3d2e0382e456e9074801c4c44213f0
SHA1634808e48135c0b28fc2b02d4f0e946e8478352f
SHA256aec20e3c6cae39a622b921221342b3675b125f11562446e5bc58737124944782
SHA51232ef54a6fc1253b5a7d66bc19bb8c4df8b071cc91f06c011a8f71321b3745d21ede18b2d7e629c7923c89189bb9f502e2d6f501503e6c4a9813eaa12d852d2b3
-
Filesize
29KB
MD58ec15717b00e8263a5bd4b232fba24d1
SHA1c002183f55ae95089be2cc5e00c56a06dbea4f22
SHA256e08f19d0aeb46bfff9d91f445836c63aa4eb120a7f60a77e5cfb61f164c361ad
SHA512e1c995646931f2c57915d194195c055914324c8b3229a5db0ad92bc060b81051ca375c7006175d42883ef25db739863e47a89fdeef761d6c363c6217c6517b20