Analysis
-
max time kernel
136s -
max time network
150s -
platform
android-9_x86 -
resource
android-x86-arm-20240910-en -
resource tags
-
submitted
27/03/2025, 04:27
General
-
Target
c7d855979c61bafc116d1c0bfe6d87a1683bea96eecca3820bf0be954b80a237.apk
-
Size
1.6MB
-
MD5
cca20d1e7f3f55f29010317fa987e485
-
SHA1
a3ba674cc763ee71723c64aba0c642ae21038e4f
-
SHA256
c7d855979c61bafc116d1c0bfe6d87a1683bea96eecca3820bf0be954b80a237
-
SHA512
82a8571f3af0f21f6bcb4035e4ff933956972555928b4e241e4f18282bd10e7986eb97f693edcf64d2c8914a414d1ff4cd77b49aaff88ed96faac151e988b235
-
SSDEEP
24576:fbPk8jfSS5uBxAoPusA58aUhpB4qzWtSgw15od04B7S1zD0gBn0B5JbzfSaLx9:A8fSu+7pB4KkS+d04RSWq0B5J3t
Malware Config
Signatures
-
Removes its main activity from the application launcher 1 TTPs 1 IoCs
-
Loads dropped Dex/Jar 1 TTPs 3 IoCs
Runs executable file dropped to the device during analysis.
-
Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
-
Queries account information for other applications stored on the device 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect account information stored on the device.
-
Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
-
Requests enabling of the accessibility settings. 1 IoCs
-
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
Processes
-
yjxq.ysrxjzb.pmnfcfhcqmc1⤵
- Removes its main activity from the application launcher
- Loads dropped Dex/Jar
- Queries account information for other applications stored on the device
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Requests enabling of the accessibility settings.
- Uses Crypto APIs (Might try to encrypt user data)
-
/system/bin/dex2oat --debuggable --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --debuggable --generate-mini-debug-info --dex-file=/data/user/0/yjxq.ysrxjzb.pmnfcfhcqmc/app_DynamicOptDex/UblsZT.json --output-vdex-fd=42 --oat-fd=43 --oat-location=/data/user/0/yjxq.ysrxjzb.pmnfcfhcqmc/app_DynamicOptDex/oat/x86/UblsZT.odex --compiler-filter=quicken --class-loader-context=&2⤵
- Loads dropped Dex/Jar
-
Network
MITRE ATT&CK Mobile v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
578KB
MD52b15bfe77412a422e39679952104b9a6
SHA18cce2265153b4dd61aa77b4759717e70498906fa
SHA256923518ed279338a2137eb02100ae28b188bbec759f37b373b7a4a0d499637b62
SHA512504deeffad11f18c247e3301e63bced4340899f7b002fc5b9c386ac252bbbce75a6ef4bbf414acf9759bf08b71c2270ca32f2cbbbb7a684a588d05acdb4c650c
-
Filesize
578KB
MD5e20bcb07956b38e04defaeab904877d9
SHA1eb70b01eb2c5ed71bfb9d115f1ba8ab49951e0e9
SHA256c80e5a40fe077210ced3f672e424eebb8c8771b4a3bad6cea933213c9ee7f3ec
SHA512b1146c7a1c5e05a5979be43a90cfdf8881921e2f44a5d91f70092b87aa5eb2ce9b8d4e1bc54077615053ce8e01bbad5406cc3426fcfb5ce5ede435bc82a008b3
-
Filesize
148B
MD5417082767407c007f1d4d9e9db7efe1e
SHA1237e0d4baf28f1c3b1f55daaabc7a403fbbf72d0
SHA256df5255354e703647764c5cca3bcc0b9e883b98ca06d7e7dfce49ada06e702a87
SHA5129cfa5810faa78cd314d8e55de8f5de013e7373a7f088ecc3cff1dea6e6b459acb310d055096ea6f17e325a0f73fb8559bcdb3f92ba9bffa911ea207a2cae5b7e
-
Filesize
3B
MD59b5ce67bb2a183c3d5120ca1a59247a4
SHA16d0b039fbb61e01b8b6f428973e3636643fe8041
SHA2562be5b899a1b7fe4a747baeb088f0b554b89c67772af1a62dbb8b6b890e5e85aa
SHA512f52849197c2c3b828db4dc9c0cdcd3d6d57e712ebe0c46511ff4c2d423593138a1c7c788f3a315af0e9bc0cc211c2ab81f125d219f1164ba8e615e6dca67507b