0c4422c814cfefbf68128da0f2558cfe3681f12e91f51f72b525c04f64e9e38e

General

Target
SexChat.apk
Size 3.2MB
Sample260416-g2jflagv2n
SHA256 0c4422c814cfefbf68128da0f2558cfe3681f12e91f51f72b525c04f64e9e38e
MD5 809bc35ffc67980bfac6199001a1885e
SHA1 1e60253703fd919c9d27810071b6f69eaba40ce7
SHA512 7cd18ebb96527faad73ef548fefed21e083da0232785ac5d1c4b2c40695df9ef466beb08a6cd96284aca188f1ae17ac75f533856327d68c7d24d237f6816edaa
SSDEEP 98304:PdMS4Rvez5I7kn7K6MbXgreIuPOMX4yGVnmKAIdj:P0eze7k7ezzx0Q8j
TLSH
T1B6F51256E3A8646EECFB92354B36176941139E978303D6878D69723C2C7F4C06EA1FC8
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

collection defense_evasion discovery evasion impact persistence

Malware Config

Signatures

Loads dropped Dex/Jar 1 TTPs 3 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/ru.titqex.doryux/code_cache/jYfZiMOp.hni	4390	ru.titqex.doryux
/data/user/0/ru.titqex.doryux/code_cache/jYfZiMOp.hni	4427	/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/ru.titqex.doryux/code_cache/jYfZiMOp.hni --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/ru.titqex.doryux/code_cache/oat/x86/jYfZiMOp.odex --compiler-filter=quicken --class-loader-context=&
/data/user/0/ru.titqex.doryux/code_cache/jYfZiMOp.hni	4390	ru.titqex.doryux

Acquires the wake lock 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	ru.titqex.doryux

Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

Application may abuse the framework's foreground service to continue running in the foreground.

defense_evasion persistence

Foreground Persistence

T1541

description	ioc	Process
Framework service call	android.app.IActivityManager.setServiceForeground	ru.titqex.doryux

Queries the mobile country code (MCC) 1 TTPs 1 IoCs

discovery

System Network Configuration Discovery

T1422

description	ioc	Process
Framework service call	com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone	ru.titqex.doryux

Requests changing the default SMS application. 2 TTPs 1 IoCs

collection impact

SMS Messages

T1636.004

SMS Control

T1582

description	ioc	Process
Intent action	android.provider.Telephony.ACTION_CHANGE_DEFAULT	ru.titqex.doryux

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs

persistence

Broadcast Receivers

T1624.001

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	ru.titqex.doryux

Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

impact

Data Encrypted for Impact

T1471

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	ru.titqex.doryux

Checks CPU information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	ru.titqex.doryux

Checks memory information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	ru.titqex.doryux

ru.titqex.doryux
1⤵
- Loads dropped Dex/Jar
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Queries the mobile country code (MCC)
- Requests changing the default SMS application.
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Uses Crypto APIs (Might try to encrypt user data)
- Checks CPU information
- Checks memory information
PID:4390
- /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/ru.titqex.doryux/code_cache/jYfZiMOp.hni --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/ru.titqex.doryux/code_cache/oat/x86/jYfZiMOp.odex --compiler-filter=quicken --class-loader-context=&
  2⤵
  - Loads dropped Dex/Jar
  PID:4427

Network

MITRE ATT&CK Mobile v16

Initial Access

Execution

Persistence

Event Triggered Execution

1

T1624

Broadcast Receivers

1

T1624.001

Foreground Persistence

1

T1541

Privilege Escalation

Defense Evasion

Download New Code at Runtime

1

T1407

Foreground Persistence

1

T1541

Virtualization/Sandbox Evasion

2

T1633

System Checks

2

T1633.001

Credential Access

Discovery

System Information Discovery

2

T1426

System Network Configuration Discovery

1

T1422

Lateral Movement

Collection

Protected User Data

1

T1636

SMS Messages

1

T1636.004

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

SMS Control

Replay Monitor

Loading Replay Monitor...

Downloads

jYfZiMOp.hni.tmp

Path /data/data/ru.titqex.doryux/code_cache/jYfZiMOp.hni.tmp
Size 1.3MB
SHA256 648fb44780997ba8147871785cfde98a1f2d046cbd1a4405f05f4592721b7692
MD5 caa46aa017ab60bc422c4e72aa4c9098
SHA1 8403c4533ce8653edbb7276b1be9e60f40bcdcf7
SHA512 e79578c37d9893fca4cf2d3133ca404e08bb05f38d919bc98774a53ddd01c1570d25e8776484edf67e645013e7114c9a297c703412592799f01922221e4bcceb
SSDEEP 12288:mx1t8Uktf6QUTYkmEyrGv7zw8pzJoLapXwbftYpCN6gZbz1Lm0OYMTRFHaDpIKUC:m3+U8sTorA7zw8pSU6w0FMTnI
TLSH
T1485581F1B7110B51E0D972397CFFCE40F72C698DE2DE7A051514A2B1B94A2F17AA128B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jYfZiMOp.hni.tmp

Path /data/data/ru.titqex.doryux/code_cache/jYfZiMOp.hni.tmp
Size 1.3MB
SHA256 faea3490a4bd75a9c85f812c81e82e8dc47db004f39949d3aceff1baabe11ba5
MD5 71933e5c176118270442ac8508cfcc69
SHA1 4934f25fc1e16d25baf2c6f454638cf4d4b4e2f9
SHA512 23852cf255cfe8dcde74e024e82da915059865383c7e420c54b17620fa6889e11aa5c1d2c413ea76cb2ad79ddd01c1709ef3c3ecb020feccd896742df8d63fd7
SSDEEP 12288:qx1t8Uktf6QUTYkmEyrGv7zw8pzJoLapXwbftYpCN6gZbz1Lm0OYMTRFHaDpIKUC:q3+U8sTorA7zw8pSU6w0FMTnI
TLSH
T1C85581F1B7110B51E0D972397CFFCE40F72C698DE2DE7A051514A2B1B94A2F17AA128B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jYfZiMOp.hni.cur.prof

Path /data/data/ru.titqex.doryux/code_cache/oat/jYfZiMOp.hni.cur.prof
Size 2KB
SHA256 02cb31f0a3359e8f7990ddae0453dee5b60cac630096b2876eeae2675da1d236
MD5 43c2318be1b9170d8fa1e558e1dc4bb7
SHA1 5448692fd0ef595dc1fba8eb898f4561fe3dc391
SHA512 d5430af6645d6f633f70fabd6ea4de97ccb0d3e1f1c1c020be38135122736afe06510689617fa17c7a4a0df36857a045d64da280b88cecd5b983c4be3b2a0dde
TLSH
T1ED514DF90D52B71C7CB056F18381567729F3C5CAE8AC19149CC4E899628D8459D4BCBF
MD5 SHA1 SHA512 TLSH

Submit Download

geo_state.dat

Path /data/data/ru.titqex.doryux/files/geo_state.dat
Size 1B
SHA256 4bf5122f344554c53bde2ebb8cd2b7e3d1600ad631c385a5d7cce23c7785459a
MD5 55a54008ad1ba589aa210d2629c1df41
SHA1 bf8b4530d8d246dd74ac53a13471bba17941dff7
SHA512 7b54b66836c1fbdd13d2441d9e1434dc62ca677fb68f5fe66a464baadecdbd00576f8d6b5ac3bcc80844b7d50b1cc6603444bbe7cfcf8fc0aa1ee3c636d9e339
MD5 SHA1 SHA512

Submit Download

jYfZiMOp.hni

Path /data/user/0/ru.titqex.doryux/code_cache/jYfZiMOp.hni
Size 1.3MB
SHA256 b672e6efa6c0e1dcbd23a3b39aa293a23207817c61a3b6d87ed55a87ce0f3b34
MD5 cd192d74be855e5f511750aa07facb86
SHA1 91b698943f3db6c36681a55c38296383fcb898df
SHA512 9bcab72fedcd252f87e994774995b724df7579af37d38e94c835e92a4ffbe5bbdaddb7ca5de13a7dbeb4bdabdb8e5a8e9fe57d15c0bfa2f5c68d14741a9bf744
SSDEEP 12288:qx1t8Uktf6QUTYkmEyrGv7zw8pzJox+Ngj3oxfsoBKpvNh4dvy6d+CfnyMn0evX/:q3+U8sTorA7zw8pSichmd+Cfn+I
TLSH
T1795571F1B7011B22D0D97635BCFFCE80F72D698DE6DB7A16050452B0B99A1F07AA124B
MD5 SHA1 SHA512 SSDEEP TLSH

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v16

Replay Monitor

Loading Replay Monitor...

Downloads