Analysis
-
max time kernel
149s -
max time network
150s -
platform
android-9_x86 -
resource
android-x86-arm-20240910-en -
resource tags
-
submitted
27/03/2025, 07:41
General
-
Target
ca0989544a1511c773cf4f9da165e77a3be6d3b86a7b5484558b274ddc79a4b1.apk
-
Size
1.1MB
-
MD5
26f529d46558a35cd93b3f6dc85a213f
-
SHA1
f3c68a5859d92d3048169dd28da19bb105aa0da5
-
SHA256
ca0989544a1511c773cf4f9da165e77a3be6d3b86a7b5484558b274ddc79a4b1
-
SHA512
56173d3d3ff48ef7a43428ae66a1187a83a2064d0cf3fdb6def5f917e9bc050998a347c131ee88b18750e8ce12689a46adad482e5f0735bba91bec93d024c5ed
-
SSDEEP
24576:wqJONrJCTE3x0yCcmMvJO4kc1NWEz1T7hwRq4OaNF:wqJOlt3GyCivJoUII1HhQvOGF
Malware Config
Signatures
-
Removes its main activity from the application launcher 1 TTPs 1 IoCs
-
Loads dropped Dex/Jar 1 TTPs 2 IoCs
Runs executable file dropped to the device during analysis.
-
Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
-
Queries the phone number (MSISDN for GSM devices) 1 TTPs
-
Reads the content of SMS inbox messages. 1 TTPs 1 IoCs
-
Acquires the wake lock 1 IoCs
-
Queries information about active data network 1 TTPs 1 IoCs
-
Tries to add a device administrator. 2 TTPs 1 IoCs
Processes
-
com.qzhaswptmd.abtjut1⤵
- Removes its main activity from the application launcher
- Loads dropped Dex/Jar
- Reads the content of SMS inbox messages.
- Acquires the wake lock
- Queries information about active data network
- Tries to add a device administrator.
-
/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.qzhaswptmd.abtjut/app_yobqpj/veujwlbpb.jar --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/com.qzhaswptmd.abtjut/app_yobqpj/oat/x86/veujwlbpb.odex --compiler-filter=quicken --class-loader-context=&2⤵
- Loads dropped Dex/Jar
-
Network
MITRE ATT&CK Mobile v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Device Administrator Permissions
1Defense Evasion
Download New Code at Runtime
1Hide Artifacts
1Suppress Application Icon
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
366B
MD513cf3216a1603d3ac1f09b5ffbe2fb7b
SHA1b64edb192ce28e0ca44538684f85e9a6bf502837
SHA256136bc74741fc630ae5dc3603ddd7724cf083be50ff068c6cafa2f24839ef0460
SHA512c5092afd6f95ced28106ea5903b5fa9f5f8f9248da740aefce1a80dda31938a1529d10fa781c6fa7524bd9ee9016fe51a1051a87a02a6964587e467458b9c7be
-
Filesize
505KB
MD5f77218ce087763a9a0f915d5066f7518
SHA113b8b5605769af72050d2966fe81fa6cd7eebdb8
SHA256cd66b669be1a99c16d32d8c488a702c3dab660ccd45164ca0f8a27aabe1f30e6
SHA512f3cfc241807143fd74f7d618fb0dc0bca9c898f36d2184140e6bebe8af1382d92360fc3fbf7568b80737994bd926fa087f0da065012b933f303d7d12742d0b63
-
Filesize
1.2MB
MD5d6b31eb36c94db5a959a5257cab637f6
SHA157859ddb41176886a14ebd0a851d9965007fe852
SHA25655fb234a687f462ad632cded85a17578965ea569a4be4028d1a11607013f7110
SHA5121eba6543eeaddbb4ee0034d594afcfc0de9faa0fa6540df6635c712a2568037c577113be7337e3c505e6a10e0137b8428103852cd16eb9197ebea9ff62787495
-
Filesize
1.2MB
MD51f90763017fe68888d0e983cda56002b
SHA192e039e1d7e880b42a559fa4fcf5da19e1b264b2
SHA25637a018553f0fd9b1304cc400f5d566a7ff6606943fc2f1f98c8465054bdfee2a
SHA5129d1e4c757b0edd4dfc03db55aeeedf17cfe84f9026b6c18391b87b3422745ae53e1440f571bb722ddf61dddce0cfbdde155783d9944c9935709494f4923eebfc