doubletrouble | c247d9ec3fa20803ba769308c66d2b4c836ca0ac90f71d68a07f44d57eb8a501

Analysis

max time kernel
1s
max time network
152s
platform
android-9_x86
resource
android-x86-arm-20250917-en
resource tags

arch:armarch:x86image:android-x86-arm-20250917-enlocale:en-usos:android-9-x86system
submitted
05/11/2025, 15:39

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
c247d9ec3fa20803ba769308c66d2b4c836ca0ac90f71d68a07f44d57eb8a501.apk
Size 3.7MB
Sample251105-s3pvjsas2d
SHA256 c247d9ec3fa20803ba769308c66d2b4c836ca0ac90f71d68a07f44d57eb8a501
MD5 4d46a7821e3759beaba6b3c8660cdfda
SHA1 2639e2b36a46a754f1130c9e8ea460ad2566d6a4
SHA512 f504fe93d87dd799b918e556241d5a72d2fb4de4cc55a3f48b0f688382cb797dd821e64466a8b466cba9fb39a8d5d558f076ecadcfc209c2224e4cc67016d2ef
SSDEEP 98304:SanwBA7LVzWLprvmHeoH+4j032blqgSHFo31D21qz8F/2IbFuCkk7yxF5OSCFVoh:AoH+4oF1F/TuCkxwFVuH
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

banker evasion doubletrouble infostealer rat trojan

Malware Config

Extracted

Family

doubletrouble

104.238.34.15:3889

Signatures

DoubleTrouble
DoubleTrouble is an Android banking trojan, first seen in July 2025.
banker trojan infostealer rat doubletrouble
Doubletrouble family
doubletrouble

Loads dropped Dex/Jar 1 TTPs 2 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/com.logic.conduct/app_will/LGo.json	4256	/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.logic.conduct/app_will/LGo.json --output-vdex-fd=42 --oat-fd=43 --oat-location=/data/user/0/com.logic.conduct/app_will/oat/x86/LGo.odex --compiler-filter=quicken --class-loader-context=&
/data/user/0/com.logic.conduct/app_will/LGo.json	4227	com.logic.conduct

com.logic.conduct
1⤵
- Loads dropped Dex/Jar
PID:4227
- /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.logic.conduct/app_will/LGo.json --output-vdex-fd=42 --oat-fd=43 --oat-location=/data/user/0/com.logic.conduct/app_will/oat/x86/LGo.odex --compiler-filter=quicken --class-loader-context=&
  2⤵
  - Loads dropped Dex/Jar
  PID:4256

Network

MITRE ATT&CK Mobile v16

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

LGo.json

Path /data/data/com.logic.conduct/app_will/LGo.json
Size 400KB
SHA256 c587ed23395e031e8e1610de608162217858db116beea5aa952693738215f3b0
MD5 c62f76d3d7e6e4d68805657b144962e6
SHA1 66552b85fffa4bf53e273c7e76dc1173e23e3464
SHA512 0dcbd0bcb9917524e9d4e5eaf2ecfbbf2083b6bc50dd13955878be4e65f22f47bedc4a453fbafafb835d1a7cf503b3b8f29c9c69bd3cb32bbff79d3b1a868d84
SSDEEP 12288:EkslhjgyXbJoP0KSC6awwhSSFiz85eb0Iut:2lhjgyLJ0SCEwhfF885ebUt
MD5 SHA1 SHA512 SSDEEP

Submit Download

LGo.json

Path /data/data/com.logic.conduct/app_will/LGo.json
Size 400KB
SHA256 e9fcd7341da60f2c3f6a1ae1321e3fe9b9a5ba13f6d32a718652b63c301ae764
MD5 bf18b3ec85344dab38d539fbc4b449f0
SHA1 40a1ac92ed30be1f81291407c7ca36ce51666d23
SHA512 e8dbdc0fc7ecc33d0c4996f28aaa8b975463c475f44b382fed5c1b54c0b833d369eb72ede7ab9b3220591718e7cf7b5d3d73ca06471f74d73d2f04d3348771e7
SSDEEP 6144:0pIaRpTCEKG+7mm6JkTlrkUATHXdMS3ttyt2G0y4yldb4yk0MTLFX/kYdZrmDr:0p3RpTvKzTljuHXdL9FGXp3MFPk8Rsr
MD5 SHA1 SHA512 SSDEEP

Submit Download

LGo.json

Path /data/user/0/com.logic.conduct/app_will/LGo.json
Size 877KB
SHA256 3e9fcfc9754a161eb84046d9c910137863b5e318589332a27988efb15ff995fd
MD5 4242312d019f987ce7160d1cc43b3cd4
SHA1 31c293757eeb3bb54b0579372f652aff89cce5c1
SHA512 9f8be7d7db24d358fe0473e31c565bfa91ca8f1d249031ddbe35a7f5896f6612542c5e78a22120f06dbc114e0682bf33ac3c3b594c963fb3ba2a2bdca26f1222
SSDEEP 12288:2HpEUsed7c7IckALxw3SBBcSnjJ+uYCn7sko+WZ:apXIlk+HMiu+WZ
MD5 SHA1 SHA512 SSDEEP

Download

LGo.json

Path /data/user/0/com.logic.conduct/app_will/LGo.json
Size 877KB
SHA256 df97bacbb32eed527241a0e6343697f45b9a3718f8f603b24fa3f3f8c8a01878
MD5 5d7d272672543f315c8e841e7d15c700
SHA1 77ec70e38f2e77ef5a44f979f9620f8d60bc6575
SHA512 7d2b44d095b31f9202228f00636be4b36bf0e34b6a73e6e43c467b3510b617fe880d3d85de408ee73dca061fdb56352d9453af6028c12ea3e52476132a36db97
SSDEEP 12288:2HpEUsed7cMIuBenjLDCuYDWy4rYV1WTwUsko+WZ:apXI3uBej3CH4cSwUu+WZ
MD5 SHA1 SHA512 SSDEEP

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Mobile v16

Replay Monitor

Loading Replay Monitor...

Downloads