Analysis
-
max time kernel
147s -
max time network
151s -
platform
android-9_x86 -
resource
android-x86-arm-20240910-en -
resource tags
-
submitted
27/03/2025, 22:14
General
-
Target
e2f86dc49b6fa03589035944c83a75e440f9cd040723d9948f0610d3c7db6e73.apk
-
Size
181KB
-
MD5
0b9ffb688506065856ff032ca159233a
-
SHA1
b9549d23bfafd3e1c406611fdaa83b48b523b4cc
-
SHA256
e2f86dc49b6fa03589035944c83a75e440f9cd040723d9948f0610d3c7db6e73
-
SHA512
40764719d61c6738b7f9fadf088f52c55e2acc197b08097e1750512f3e3a98e4bb824ef6320f0ea88936b7403e834bdd4d621491f5cccea7ac93f0530df06b17
-
SSDEEP
3072:ehHS5kbM599UB2xzkNG1HQLHxVzLU1hyxCrUZip5U+vt0mhKdU+R3fGAkzR4Sm1w:e9S5koW2xG0wLRVkMFZedlMdUESmqMj8
Malware Config
Signatures
-
Loads dropped Dex/Jar 1 TTPs 4 IoCs
Runs executable file dropped to the device during analysis.
-
Acquires the wake lock 1 IoCs
-
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
-
Performs UI accessibility actions on behalf of the user 1 TTPs 1 IoCs
Application may abuse the accessibility service to prevent their removal.
-
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
-
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
-
Checks CPU information 2 TTPs 1 IoCs
-
Checks memory information 2 TTPs 1 IoCs
Processes
-
com.fsgij.deils1⤵
- Loads dropped Dex/Jar
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Performs UI accessibility actions on behalf of the user
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Checks CPU information
- Checks memory information
-
/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.instagram.lite/files/Factory/Plugins/classes.dex --output-vdex-fd=43 --oat-fd=44 --oat-location=/data/user/0/com.instagram.lite/files/Factory/Plugins/oat/x86/classes.odex --compiler-filter=quicken --class-loader-context=&2⤵
- Loads dropped Dex/Jar
-
Network
MITRE ATT&CK Mobile v15
Persistence
Event Triggered Execution
1Broadcast Receivers
1Foreground Persistence
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
142B
MD5373ffbb0a7a398ef76291b33e8b5a1a3
SHA15f09dda88197bfbf81d2a3ef90c2a6008632e65b
SHA25679e84020811ffff8139b9d00735f9582fcad2a397a00f826b97b23866ae499af
SHA51291de5da5e4764d58af389de79c60391603d4e6acce8d7ff4d29d56fe0feb705808d17744c7cefa8ac03c34c319da653d0dca930ce74acb89ab312cce487e02c2
-
Filesize
185KB
MD575426abf235ef181ede8c3f3e762a7a6
SHA136ffd67a08ed790f6643aa6cb465ab23cf09160b
SHA2562c17fc99ea716badfac9bcfbb510e4cff2ec5020bc848a8fad4fbaf8af0bd911
SHA512affc980442eac4e3c9ea159d2df4176095d1b33ead6e2c80cb4d4c92b836767f0ec261c09bffdfc3fa9d6829b6786b4417cdda57eb75819f9e8f9c6d65fb4236
-
Filesize
185KB
MD5a917464ddddaaba4fd6c2e0d419ef62a
SHA1419511f83ac7723ed2b0044621588c90dbfdf9d1
SHA2565c13bed9bba9f40ea0dff48a37e883bea84cfc87b4f4a3134963b6e8bf9171b5
SHA51291d6007985aea8c116577ca82fd4f15ccac5e67ee04fe3f5e40cc502809a537103b9c3b650fac6655d1341f447ff81de74c1c89fc610385265afb7781459977f