f5ac9bf1b38ba95967ab0c452c0de82c92eec720f388157c039741f22b6bbd7b

Analysis

max time kernel
13s
max time network
69s
platform
android-11_x64
resource
android-x64-arm64-20240910-en
resource tags

arch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20240910-enlocale:en-usos:android-11-x64system
submitted
27/03/2025, 17:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Spotify-04.apk
Size

63.9MB
MD5

13ad5000b5ea70928625f4fc1edf96ec
SHA1

f49887d7ec097d488d47c246cc42af8aaabb81e6
SHA256

f5ac9bf1b38ba95967ab0c452c0de82c92eec720f388157c039741f22b6bbd7b
SHA512

c6fef38753fcf37ddbd9661b83199ff82cbe4eee56a19805ba129be0fbe21d2315030586f4861f109ee81a75614c1452b5479877dba441a9c12189ee199401cd
SSDEEP

1572864:qK/tT+7w5WlF0rR5FAnvUBKKiswMODRVeJ+ebf1/VNt5b1N:qfv70Wn8BKKiswMOb6hNtJ

Score

7^/10

discovery evasion execution impact persistence

Malware Config

Signatures

Loads dropped Dex/Jar 1 TTPs 4 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/com.prospolite.gl04/code_cache/1743094831872.dex	4790	com.prospolite.gl04
/data/user/0/com.prospolite.gl04/code_cache/1743094831872.dex	4790	com.prospolite.gl04
/data/user/0/com.prospolite.gl04/code_cache/1743094832311.dex	4835	com.prospolite.gl04:x
/data/user/0/com.prospolite.gl04/code_cache/1743094832311.dex	4835	com.prospolite.gl04:x

Queries information about running processes on the device 1 TTPs 2 IoCs

Application may abuse the framework's APIs to collect information about running processes on the device.

discovery

Process Discovery

T1424

description	ioc	Process
Framework service call	android.app.IActivityManager.getRunningAppProcesses	com.prospolite.gl04
Framework service call	android.app.IActivityManager.getRunningAppProcesses	com.prospolite.gl04:x

Declares services with permission to bind to the system 3 IoCs

description	ioc
Required by chooser target services to bind with the system. Allows apps to modify targets that handle user actions.	android.permission.BIND_CHOOSER_TARGET_SERVICE
Required by remote views services to bind with the system. Allows apps to share and display views across different processes.	android.permission.BIND_REMOTEVIEWS
Required by telecom connection services to bind with the system. Allows apps to manage phone call aspects such as call setup and notifications.	android.permission.BIND_TELECOM_CONNECTION_SERVICE

Queries information about active data network 1 TTPs 2 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.prospolite.gl04:x
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.prospolite.gl04

Requests dangerous framework permissions 25 IoCs

description	ioc
Allows an app to post notifications.	android.permission.POST_NOTIFICATIONS
Allows read only access to phone state, including the current cellular network information, the status of any ongoing calls, and a list of any PhoneAccounts registered on the device.	android.permission.READ_PHONE_STATE
Allows read access to the device's phone number(s).	android.permission.READ_PHONE_NUMBERS
Allows an application to receive SMS messages.	android.permission.RECEIVE_SMS
Required to be able to connect to paired Bluetooth devices.	android.permission.BLUETOOTH_CONNECT
Allows an app to access approximate location.	android.permission.ACCESS_COARSE_LOCATION
Allows an app to access precise location.	android.permission.ACCESS_FINE_LOCATION
Allows an application to access any geographic locations persisted in the user's shared collection.	android.permission.ACCESS_MEDIA_LOCATION
Required to be able to access the camera device.	android.permission.CAMERA
Allows an application to read the user's contacts data.	android.permission.READ_CONTACTS
Allows an application to record audio.	android.permission.RECORD_AUDIO
Allows applications to use exact alarm APIs.	android.permission.SCHEDULE_EXACT_ALARM
Allows an application to send SMS messages.	android.permission.SEND_SMS
Allows an application to write the user's contacts data.	android.permission.WRITE_CONTACTS
Allows an application to write to external storage.	android.permission.WRITE_EXTERNAL_STORAGE
Allows an application to read from external storage.	android.permission.READ_EXTERNAL_STORAGE
Allows an application to read audio files from external storage.	android.permission.READ_MEDIA_AUDIO
Allows an application to read image files from external storage.	android.permission.READ_MEDIA_IMAGES
Allows an application to read video files from external storage.	android.permission.READ_MEDIA_VIDEO
Allows an application to read image or video files from external storage that a user has selected via the permission prompt photo picker.	android.permission.READ_MEDIA_VISUAL_USER_SELECTED
Allows an application to request installing packages.	android.permission.REQUEST_INSTALL_PACKAGES
Allows access to the list of accounts in the Accounts Service.	android.permission.GET_ACCOUNTS
Required to be able to advertise and connect to nearby devices via Wi-Fi.	android.permission.NEARBY_WIFI_DEVICES
Required to be able to discover and pair nearby Bluetooth devices.	android.permission.BLUETOOTH_SCAN
Required to be able to advertise to nearby Bluetooth devices.	android.permission.BLUETOOTH_ADVERTISE

Schedules tasks to execute at a specified time 1 TTPs 1 IoCs

Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.

execution persistence

Scheduled Task/Job

T1603

description	ioc	Process
Framework service call	android.app.job.IJobScheduler.schedule	com.prospolite.gl04

Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

impact

Data Encrypted for Impact

T1471

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	com.prospolite.gl04

com.prospolite.gl04
1⤵
- Loads dropped Dex/Jar
- Queries information about running processes on the device
- Queries information about active data network
- Schedules tasks to execute at a specified time
- Uses Crypto APIs (Might try to encrypt user data)
PID:4790

com.prospolite.gl04:x
1⤵
- Loads dropped Dex/Jar
- Queries information about running processes on the device
- Queries information about active data network
PID:4835

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Scheduled Task/Job

T1603

Persistence

Scheduled Task/Job

T1603

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Credential Access

Discovery

Process Discovery

T1424

System Network Connections Discovery

T1421

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

T1471

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.prospolite.gl04/cache/ad_config.json

Filesize
13KB

MD5
a46c33fa7bf01092a3af5f3f24f5d7cb

SHA1
5937f7a45c98826bb6940f4838c51e0beac01fe3

SHA256
4c06c36cdbe4bf7f818b336a3da60eb38a652c1bf8894f76acee9fe244aed78f

SHA512
2899652e1c250e5b7bbe93ccbe95b9cc58bc99bacb638e7482983a4ac0d4eb57221a7118c1ecb411e5531f9247168089d031710977e5bb73fca7396d45c008c7

Download Submit
/data/data/com.prospolite.gl04/cache/daily_limit.json

Filesize
738KB

MD5
3f2cf63e3912efaef5b0411aa29f32d1

SHA1
11254ca497308b8592128b067d7fd8431f21cb19

SHA256
db3c33bc6e1c0d049466280c32bd7419f9708f53ca8f5f95d584ef281996918f

SHA512
ed67a8e39112e35ee2766ff3563449d1759ad1f724c083223ab72e5a6f0cc263fe4955f6dfae99e18cf355089fd2afb70e74e9087963876ed43e19f24cccb7c4

Download Submit
/data/data/com.prospolite.gl04/cache/daily_limit.json

Filesize
23.3MB

MD5
86ffa63715d72da41454e73424e347de

SHA1
9f4ba3268c5c01b5d7028d7999ad45d0861d42b4

SHA256
2c156cd72f5e9a9075bb744ae9b2e4d27659f2411e3ef06ef20f7620f0d3b32f

SHA512
bd043a06123e749dca513aec01379569bf1017753f8ebced746f2450e4f7241019153dcbe1b571d8eb5a806eab7af396eea44cb96e45e59a991344e921ebef30

Download Submit
/data/data/com.prospolite.gl04/code_cache/1743094831872.dex

Filesize
2KB

MD5
b5226ede1106261e7c438744eee9a864

SHA1
352593a2577dbaa67b26eefc1629a19cc2c9c2da

SHA256
3834c792435933cd916d886f9842894316a99339a0368f7bae255b53683a515a

SHA512
7e410caae4666f8473266cac4bd163f7f2093d3f2e8778b50d347eeffe3cd4ed37e0d8b84c38ae85a28b7e50a2a2db3e8661ec51b71a1d9db876e98827aef627

Download Submit
/data/data/com.prospolite.gl04/files/down.apk

Filesize
100.2MB

MD5
333a24cf651818e2c34eb027b6536b30

SHA1
a1e389c212f0a1579e61ae5b6865c2ce2528defd

SHA256
9ad4607b04eeba623633002354593584a6fe8ffd28119d8879e6175909fe71ad

SHA512
b6f976d4fe6e1bc4162cf2dce33081cffdd3862bd11f358980d354ac12f065c062a6e7d96527b57101ab3005802e966007aa686fa912516f8bf2850363acc6ce

Download Submit
/data/data/com.prospolite.gl04/no_backup/androidx.work.workdb-wal

Filesize
190KB

MD5
3584112564b525d8529f7cb434bdb893

SHA1
5ea5380f182583f893a4ed0f5e44bf1e655bafda

SHA256
cad4bd6e1a6fb97cea9d02ac3f2c9c0e90c62064f7b018cf26b0a806e1489b6e

SHA512
d0707bfb543654740e117d42a60a955726c61d4844deca05570d1066f6757c0279de0b7b2003d5dcbecbd31466b6b300b3d61a45224699a200c90b13ba5dea27

Download Submit
/data/data/com.prospolite.gl04/no_backup/androidx.work.workdb-wal

Filesize
3.9MB

MD5
df69d816ee1dba352071c1d7e335f335

SHA1
99d4f49afcd05b2e43a9e807c74789251b2025bd

SHA256
4925fde2f9dccf52342bef7f7e7658def9f50bb26f86439bec38860229052f1e

SHA512
f106f9ca255d962b152098d42117846ffaa4e7a37b21c488fbd92d119a0f26fb85a5b97fd124a822bd687c05d0622e754da9f69bc3fc85e1a71287a7d82a7334

Download Submit
/data/data/com.prospolite.gl04/no_backup/androidx.work.workdb-wal

Filesize
16KB

MD5
6b24f6d327031de036cb5ead4360f12d

SHA1
7186d70abcd345678713c8a97a664eb9b7610e1c

SHA256
46995bb0886678ac64f615bc604d4cb03d15550e5d28f1c4b656f7e23c864f05

SHA512
cfe46ddaa81fd9b2082f2c8e2946aa05d98bbe7a67892a48ad7f2cb5eb7505a2d06ea4c294abd8421e0524816c5f4bd0d263c3c937ef30f5e9e5575ef79b03fc

Download Submit
/data/data/com.prospolite.gl04/wabox/data/app/com.spotify.music/lib/arm64/tmp.MgcfQL

Filesize
9KB

MD5
af3d98fde530eff3fb68d887aed0536b

SHA1
735aa535bc94b23a3a02a8248c7f2baf7f632b8a

SHA256
b3d2d4bd3eb068ed624d406d8626b7300e8f65e7aa6863e08a736984fc0ecea2

SHA512
b01f2d8c852c0c8f86707dbb15c94e4293551a186707f4135a120c139daf1527fb67ae24d9f94a6886169248f9b32d1717bdab90d2d73e430c5998139bdb05bc

Download Submit
/data/data/com.prospolite.gl04/wabox/data/app/com.spotify.music/lib/arm64/tmp.Zpn5nS

Filesize
1.8MB

MD5
d261740413e38f5d677bebdbf565dd81

SHA1
70985e921f8ff37db8b482f8a38805db3775a648

SHA256
e10babbd2cc691becae6cddf47dfc71a4a68dbc8090094530eaa864729c10b09

SHA512
f367e2808a07abc99898975a6e79bda435d85ae35dcf5ad4855fad21d386817dbc5c43fd232dc3e913acbb465739ba47a10802c8b8f2eb3185adce9356f90f00

Download Submit
/data/data/com.prospolite.gl04/wabox/data/app/com.spotify.music/lib/arm64/tmp.tZRNlA

Filesize
9KB

MD5
cc6cf9b4774c77480df5e6c368a44af9

SHA1
d7c17fcb44b30a6efe89d436aa102abe52e008a6

SHA256
41e9a793c43a0f4fddb19e33f346bace464f30f888ba7b9eaf96294ea115bfb6

SHA512
be98315c6f4a6a6d6ecf923d85b313c72a1cc279cc833244a69cff4ffe65144ac841a840f1cdb38490955db9cd1f933158aa635b24a9bc5f9af14992fcb0eec0

Download Submit
/data/data/com.prospolite.gl04/wabox/data/app/com.spotify.music/package.ini

Filesize
217KB

MD5
1e4c35ee5b558431d8c67a7baa2cb4b2

SHA1
042451755766943e88372abb6ccd6f05b0b2820c

SHA256
eade28d557037cdfa72c6e52a9c712e7d0f6736b4b64f3e5098498360a6c17d4

SHA512
55c0c32ab4e2274091c04c914f9cba209a023615d5173f6b61b0cca3553a74243622640a9a810d2afbcc6610d5b28790cc17306c2ad51427832b7904723468b9

Download Submit
/data/data/com.prospolite.gl04/wabox/data/app/com.spotify.music/sig.conf

Filesize
2KB

MD5
c8cf950bc47770b83e348cfa17595353

SHA1
637b677e616957b507ab305028c6757a40aa0fad

SHA256
15b8279ea793990745b2d10030552b53a52d5683b2614dd2fc5ba1cebdd082f8

SHA512
1d49e8cfddc23ae4282cf8a09dfb9b4df22037e262f3e54ccee7ef65912472be3a471a3211321aec4fb14cbb7c11ba4286cf8322daa550dc10f3a244bcd13fcd

Download Submit
/data/data/com.prospolite.gl04/wabox/data/app/com.whatsapp/base.apk

Filesize
100.2MB

MD5
16832ff7276c25fc85f96a461598fa67

SHA1
30e46cecb352b661f1b2b52ce3cf7f0459e79374

SHA256
c4ce2f65ff736694df2e566e388ee872c9e94d74fb2300ecf10354d9b6f88f57

SHA512
7e3c4f58799757a416e540e44ebe6c9d2b2f9f276578e280c9273fd48f72c24f06c01a8ec6db43e548df6e018da17fd2926f98a1ae7e81a6631926e3e7492949

Download Submit
/data/data/com.prospolite.gl04/wabox/data/app/com.whatsapp/lib/arm64/tmp.lrlHrQ

Filesize
202KB

MD5
aefab65bcbc093ed5fed92e3acdf2169

SHA1
3ccf6749b80d151767af17986574db5d3d77357f

SHA256
7ff24c29739ed17ca7078f75c1b337220043e0b9bd3e206f7811a8a0f0a0ea7c

SHA512
767530852f196c47bcd547b131b85f721cace9029f513be3aadbeda8ddc973d556112938b8af478abcaced710492a09878b64ce7ba1a100286ed0bc185099e29

Download Submit
/data/data/com.prospolite.gl04/wabox/data/app/com.whatsapp/lib/arm64/tmp.yi37DG

Filesize
11KB

MD5
fcbf76ba141946088f7344118586937e

SHA1
dcec7cda2c3c81937f0dea99e35f2110579a8b28

SHA256
87a03f5228e4a446a46835da2dadd4b9332e00ea33d97270ce1e695ae206d2d2

SHA512
c7a9793104da654cd039f9bb2c9c8e46dd36262d65c02eb5d7728ec498483cdfdc9ee45ae160563e27ef84f0470c8f76c64a7c6ea7fefd544f7882fb380b109a

Download Submit
/data/data/com.prospolite.gl04/wabox/data/app/com.whatsapp/package.ini

Filesize
697KB

MD5
15ee22085e438b400d92fddc475066c3

SHA1
32061ba76860f5ef26c60906641bf0eeb566219f

SHA256
dabd5e629c2295ee8fd47d5b9f7b40b2eb5c85b8b67c9a70f6eb19ff3af438ab

SHA512
ea8022284984aceae1f84797211cb72a5c29e974015d8dd6b15e99a0043133df5c8fa7ccfa4dc29947d197e29c684f21e3ad5e4eab088e19e4800605c316c43b

Download Submit
/data/data/com.prospolite.gl04/wabox/data/app/com.whatsapp/sig.conf

Filesize
2KB

MD5
8b88b155c65d8b57d5a48a3d902bbe59

SHA1
0d38e8f4fef7d3a93d319bb4507dfec25b667e96

SHA256
92e4566154c81b3cd50a2a9043cd07d6a7704673aae521f854971116780bf9e3

SHA512
450b23cee0d38e41000ad32a0bdadb90ad4794b164af6931504d9281044d6cd660a391ea93ec38881d6ba59d8139dbb369a4491a578f65fac40d018dfed8f213

Download Submit
/data/data/com.prospolite.gl04/wabox/data/app/system/packages.conf

Filesize
148B

MD5
fcaf5076889745c3b4619044cf29f861

SHA1
5c1fb67f7a76be943be730a5a2f4bf5550cd9374

SHA256
940cb7fffc3355dd2c3aba5a7d0524c67e827adb1f8bbaa6b579a6ce5da74744

SHA512
f5b562828881f41ac6a414f789e6083ed5823b37fd76047f0e4aba7004ee5a801cc5e2cb610cac4f45783e289f4ff4b763e5f77fe6baa61fecdf53a7f77bfdd7

Download Submit
/data/data/com.prospolite.gl04/wabox/data/app/system/packages.conf

Filesize
264B

MD5
8c428ce3f5bf83fe7533af70183deb3b

SHA1
8079b8996a9ed69df08cc50855c4af4d8ffcd276

SHA256
845267cb8fb88102836f62e51f5d7f86f04429aac1e9b7c9ea3501b629fd40d4

SHA512
d15478d122ad8fdd417fcba5be52d3b99ef2f96be39748bd1995aeda8a4c3bc9a2634308c48071b5618aede4a3ca2ff105616bf9180d40713ec44266297bb878

Download Submit
/data/data/com.prospolite.gl04/wabox/data/app/system/sync/accounts.xml

Filesize
4KB

MD5
7e858c4054eb00fcddc653a04e5cd1c6

SHA1
2e056bf31a8d78df136f02a62afeeca77f4faccf

SHA256
9010186c5c083155a45673017d1e31c2a178e63cc15a57bbffde4d1956a23dad

SHA512
d0c7a120940c8e637d5566ef179d01eff88a2c2650afda69ad2a46aad76533eaace192028bba3d60407b4e34a950e7560f95d9f9b8eebe361ef62897d88b30cb

Download Submit
/data/data/com.prospolite.gl04/wabox/data/app/system/sync/stats.bin

Filesize
32KB

MD5
bb7df04e1b0a2570657527a7e108ae23

SHA1
5188431849b4613152fd7bdba6a3ff0a4fd6424b

SHA256
c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479

SHA512
768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

Download Submit
/data/data/com.prospolite.gl04/wabox/data/app/system/sync/status.bin

Filesize
512B

MD5
f21e858326e24f2cfa9def31c9095a55

SHA1
2d421c0f54ab95958a5923db75c48b8554ddb369

SHA256
340170e2aeb5a674de32788a06ed216fabb2746e4a2d1c0ee776f48a3fd07381

SHA512
3311d5d8033fbb0ee1674da9958e7f78d5c78630c7f0741fb5c51a5e6896d3e4b771c4d1fd2a820a997169dee6ec52891b6d07105c541d6578e57bc190f00dbb

Download Submit
/data/data/com.prospolite.gl04/wabox/data/app/system/uids.conf

Filesize
185B

MD5
54424ebb74a0939f6697fb694ce8bdf6

SHA1
9d624b7d659cb82d2149fe9bc7f9f7af1e817119

SHA256
dbc3ada3932795d3ee249abd526fbb15d42e825ec17d72a2bcfd9a9b44698e3c

SHA512
21b74570d224a5730a98e99e50cf9b7c822ecbc4327b9f0cbf34400991a04c194e65ca2eceebbf804b5184537ce560c8176c7eb64763bf91104a477c13e6b3c7

Download Submit
/data/data/com.prospolite.gl04/wabox/data/app/system/uids.conf

Filesize
210B

MD5
8964a75c3ec96886adda7c3c57afdc56

SHA1
04c801b5adc7c6f6e565f8818b65628d4253400f

SHA256
78e167342b9f024053c5c2b7fed69d3ae3ee687399d993e3650b805d8f0b0976

SHA512
763a5d0acc9e2d79701cc486d8b0ae5852884e3a3a57a6d59e99296d2488b5a96ef7355d0129850d4e3f5d92ec1e65c90a6104bce82e69f3e94978b5932250eb

Download Submit
/data/data/com.prospolite.gl04/wabox/data/system/users/0.xml

Filesize
159B

MD5
2ae695aa5dab64b4ae05c43c6a35eec1

SHA1
b1ed2ac2cb72be31802f1f216066ccce1033d366

SHA256
865a155fc1d774c31095dc3a9bd570cc2d7eb6b37d5935b1c6915782cb53adb1

SHA512
fc9f5c96a0e35c03c66f70d1353503820e53de924c41d375c29b5bc202c8b276a3bcfffe213fd07f5814ff1f156a12ca81d63db960be9ad5fa350373b09872b4

Download Submit
/data/data/com.prospolite.gl04/wabox/data/system/users/userlist.xml

Filesize
54.7MB

MD5
a80da0adbbe4e66ac3d901445b534d2a

SHA1
846f5873c9e2a2a709a41fb8562c7ded53202fb6

SHA256
8a14c8b75318d90927e054b8336276bb8263801de2a2b1a9310f33f2c0cce2ac

SHA512
632074f5f6bc861994835b524493b9af1e11b1c1a207cc622d5f03e1d999491432b8c7e400234d3c79ee429578e81942d5b61bdd5b20b060c1e207bbd0e763e8

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads