Analysis
- max time kernel
24s - max time network
31s - platform
android-9_x86 - resource
android-x86-arm-20250917-en - resource tags
arch:armarch:x86image:android-x86-arm-20250917-enlocale:en-usos:android-9-x86system - submitted
22/10/2025, 15:02
Static task
static1
4 signatures
Behavioral task
behavioral1
Sample
33565f0c856702bf634b8d48b4fbd753fe690108d41a75612d3b345875c2a7b4.apk
Resource
android-33-x64-arm64-20250917-en
4 signatures
30 seconds
Behavioral task
behavioral2
Sample
33565f0c856702bf634b8d48b4fbd753fe690108d41a75612d3b345875c2a7b4.apk
Resource
android-x86-arm-20250917-en
5 signatures
30 seconds
Behavioral task
behavioral3
Sample
base.apk
Resource
android-33-x64-arm64-20250917-en
18 signatures
30 seconds
Behavioral task
behavioral4
Sample
base.apk
Resource
android-x86-arm-20250917-en
20 signatures
30 seconds
General
- Target 33565f0c856702bf634b8d48b4fbd753fe690108d41a75612d3b345875c2a7b4.apk
- Size 9.1MB
- Sample251022-seysjsew4b
- SHA256 33565f0c856702bf634b8d48b4fbd753fe690108d41a75612d3b345875c2a7b4
- MD5 42df59bac7404263d66ac3440ec01674
- SHA1 ed559510f5a3d0c2601edb660fef38cb3e14c9d8
- SHA512 0d06cece6faf38433f9f8d0f461ae94e4ab933bcdd7c4da1b8ee62c039bd320400d7b3af1c3263729d6c325bc04749ff1ebd999330368828c8d1f161e10a75ce
- SSDEEP 196608:mmVdtFSla0otPw4DU89ZZnTB45rwWuRtNMWVkhGCwFM:Zdxw4DU89ZZTS5rRuJ/Vk6FM
- MD5 SHA1 SHA512 SSDEEP
Score
7/10
Malware Config
Signatures
- Loads dropped Dex/Jar 1 TTPs 2 IoCs
Runs executable file dropped to the device during analysis.
ioc pid Process /data/user/0/com.similar.brother/app_random/XXX.json 4230 /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.similar.brother/app_random/XXX.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/com.similar.brother/app_random/oat/x86/XXX.odex --compiler-filter=quicken --class-loader-context=& /data/user/0/com.similar.brother/app_random/XXX.json 4204 com.similar.brother - Queries the mobile country code (MCC) 1 TTPs 1 IoCs
description ioc Process Framework service call com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone com.similar.brother - Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
description ioc Process Framework service call android.app.IActivityManager.registerReceiver com.similar.brother - Checks CPU information 2 TTPs 1 IoCs
description ioc Process File opened for read /proc/cpuinfo com.similar.brother - Checks memory information 2 TTPs 1 IoCs
description ioc Process File opened for read /proc/meminfo com.similar.brother
Processes
-
com.similar.brother1⤵
- Loads dropped Dex/Jar
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Checks CPU information
- Checks memory information
PID:4204 -
/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.similar.brother/app_random/XXX.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/com.similar.brother/app_random/oat/x86/XXX.odex --compiler-filter=quicken --class-loader-context=&2⤵
- Loads dropped Dex/Jar
PID:4230
-
Network
MITRE ATT&CK Mobile v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path /data/data/com.similar.brother/app_random/XXX.json
- Size 1.8MB
- SHA256 f3d0573aa6347c81ae01b7d63380bdb231c2b371c186c821b70b62fdc3ba3862
- MD5 8ab3b99de12837518266e98adf5cd79c
- SHA1 6286da3940025e89fde58ab52c399eaf3267ddd2
- SHA512 b2c4ba2a3c849280153031e72d06a725e278f791f47b1e452c48e52e2e5ce77c59024a0e943de05fa0bff6b62e6d65913d32c92af76cfd5745fe306e6d7176cb
- SSDEEP 49152:OHl6oLHGEeaZb+1P6sW6KMWggjEfRbCAA:OHwke861o3ERbCAA
- MD5 SHA1 SHA512 SSDEEP
- Path /data/data/com.similar.brother/app_random/XXX.json
- Size 1.8MB
- SHA256 0b02ca3a421cc40ce8175cfc4bf351e90b465e46c0c761d6b3ead5236016c0a5
- MD5 3e872758c81372c601062bce7190c7d0
- SHA1 586c8f0bd89cdf52865874ecc8c6eeacc960d858
- SHA512 80b614cc011f9fd93d2b6a43ef5fd259280431a99e92b250f0aa3084feaa954ebbada95fc84964ad67dc39f27d868c609d71ba5bfcd51803f418dc34e0156383
- SSDEEP 49152:B+noKUPAGi27GSVw+gx3oopHycTqxaGubHhIQaR3fCDUAmIx3S:BeoKdFoopRlGSCTR3BUS
- MD5 SHA1 SHA512 SSDEEP
- Path /data/user/0/com.similar.brother/app_random/XXX.json
- Size 4.4MB
- SHA256 c810f65bd4eaeb32b44d7b9fd40c01d62b81dac67db71880ba65ffc51c524f97
- MD5 0fc8a7b6a1efd60f67367764e2d0759f
- SHA1 6f6c8e3e4bcd92929f9d6a436e0ca4f9cd4a3da7
- SHA512 54805932a2ad7355f3d0c1148a4007c31eeb8b22b6210bc0ea9e9ef3c8360171bc1a647b85705fce8a035bd32ca28f25cbb4f17fd4fc2d73f445427ae2abb9b5
- SSDEEP 49152:JlgAu6SvK62Cvk88plbTc3IKadANrtAaEA7SoRSE:vVuBK62CvAbo3GANrS9A7SoRD
- MD5 SHA1 SHA512 SSDEEP
- Path /data/user/0/com.similar.brother/app_random/XXX.json
- Size 4.4MB
- SHA256 d2153c348a2145cf3dfad6ca42b517505c3169a3906393f77c69d064d8e69da0
- MD5 51cfb820f65cfaa8f70dd3896b7bffe5
- SHA1 77d8f7451c27888e5af6cf620aac2dd71c7590d3
- SHA512 b936a464ba40408c665440145eecb937fc6fa5a192ed8bceba98e72c02f0b81bd202cdc538c2001bca50d386e724e17b0566e95f34b7ceb9b23530b338baffe2
- SSDEEP 49152:JlgAu6SvK62Cvk88plbTc3IKadANrtAashLlGKbbNB42dmdqSE:vVuBK62CvAbo3GANrScKbbo9dqD
- MD5 SHA1 SHA512 SSDEEP