db18d04340cda2157b5bb5fee85b3f68c3d73917e43847af95b6f788f892c6d3

General

Target
base.apk
Size 70.4MB
Sample260808-db2mps1yfx
SHA256 db18d04340cda2157b5bb5fee85b3f68c3d73917e43847af95b6f788f892c6d3
MD5 ee856817e65635959056f01ed78a0d80
SHA1 5eeccb9bb600397c7fb9f65341dcadc91fab1ec3
SHA512 24884e96e4254b8ffa52aab709aa6ba8132462344b7a9672276c519846e2f0ccf378a359a98b0b9e1bb8d17ef5e33a75f678ae36e022ab2941e8d10cfeabaf7a
SSDEEP 1572864:DCU9rEx3EdKwFmLGn2L8WjDyGXuel3aW3hcFkFcFnFYFhFMFcFNF+FEFuF2FhFqU:DCUlE52KzLG2JjDvXuep3hcS6tSz6iHJ
TLSH
T17FF7339FE76608DDCEB548F04D3D82A24A625D592443BB3B352473583D332986EACFE4
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

evasion

Malware Config

Signatures

Loads dropped Dex/Jar 1 TTPs 14 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/com.rimac.rimac_surrogas/[email protected]	5102	com.rimac.rimac_surrogas
/data/user/0/com.rimac.rimac_surrogas/[email protected]	5102	com.rimac.rimac_surrogas
/data/data/com.rimac.rimac_surrogas/code_cache/.	5102	com.rimac.rimac_surrogas
/data/data/com.rimac.rimac_surrogas/code_cache/.	5102	com.rimac.rimac_surrogas
/data/data/com.rimac.rimac_surrogas/.	5102	com.rimac.rimac_surrogas
/data/data/com.rimac.rimac_surrogas/.	5102	com.rimac.rimac_surrogas
/data/user/0/com.rimac.rimac_surrogas/cache/.	5102	com.rimac.rimac_surrogas
/data/user/0/com.rimac.rimac_surrogas/cache/.	5102	com.rimac.rimac_surrogas
/data/data/com.rimac.rimac_surrogas/code_cache/.xSCoHc	5102	com.rimac.rimac_surrogas
/data/data/com.rimac.rimac_surrogas/code_cache/.NmWNt	5102	com.rimac.rimac_surrogas
/data/data/com.rimac.rimac_surrogas/.cRMhVg	5102	com.rimac.rimac_surrogas
/data/data/com.rimac.rimac_surrogas/.gxWIr	5102	com.rimac.rimac_surrogas
/data/user/0/com.rimac.rimac_surrogas/cache/.ZPpafZ	5102	com.rimac.rimac_surrogas
/data/user/0/com.rimac.rimac_surrogas/cache/.VJKax	5102	com.rimac.rimac_surrogas

com.rimac.rimac_surrogas
1⤵
- Loads dropped Dex/Jar
PID:5102

Network

MITRE ATT&CK Mobile v16

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Download New Code at Runtime

1

T1407

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

.

Path /data/data/com.rimac.rimac_surrogas/code_cache/.
Size 23KB
SHA256 6d404c65efdea3fd569d8f26fcfb5d5e63bd066cc7e8706f332f2c5539f2e373
MD5 d5683723029681c58ceb7c7753e63b6b
SHA1 834b468543d23621aeb40e4d527afa50cec93933
SHA512 ec1eed94a0142b09360617b3dbc62601e19d18678357c9e0bb39a7588e99374293a2fb4e32fcd4663922336387cab82b12d256d5c3c673b5d581b4614fd7007f
SSDEEP 384:KaHOYs+0+8ttqck5OX5nPeow+3L6iY+pVyvEPnxi713Oz00V/MO24tz5Tadk7FR8:KSOYZ8tHHnw+3LtFiE/47GheO2wxuaFQ
TLSH
T158B2E1AB3C2D56E985E8543D1A983177E2D60DEC8DA546394B23373DBB78825E0C061F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

.

Path /data/data/com.rimac.rimac_surrogas/code_cache/.
Size 328KB
SHA256 53236911a182990149cadabc9f0c1b1be89cba65a56edfa8680f38312ffc2173
MD5 b4da88f8c18335b1c1ed35868c296fe2
SHA1 3643280f038499b1b8eab495297c2b5088b9faea
SHA512 f94aa7615871de18ee2ac0e397852d3f44dbf6b200a8a25fe5b1753666ed320b95e2eb4fbbe611679a1576656821fca77e404833d978bc79ab6b01df27c33687
SSDEEP 6144:BLcZ0Vejhpo/iyS1YbXcgDPmUk8gD239D9b5yQqt1tXyGDggh0D85HFTrd+CdiOt:BLcZ0wjs/hbzcgbk8HRb8HXyGDggNNdj
TLSH
T10E64234B8B47713BC679D4AC057B882C1A83B6454A770E32E7E6769CE3DDC80B95280F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

[email protected]

Path /data/data/com.rimac.rimac_surrogas/oat/x86_64/[email protected]
Size 599B
SHA256 829fd154edacef42f2335faba0be5cbcaca97cadbda212c0d37d9c406fedc21d
MD5 c28d1d377aeca520c3ea278255e74b32
SHA1 b6441858455be5a4b515e9eae7ca11302592627a
SHA512 fe963ba0471a7121d166366786c4e07463d2655ce853728da8c3be0f5f9a3479d46a1503f999ca44aba92fa3543c3ba7beb494ab7057275dc73a8559ed31d36e
TLSH
T12CF0286463EF09C6C78598248FFCD3EB39D05EE5C0904A80DD6844F97A469943681E38
MD5 SHA1 SHA512 TLSH

Submit Download

[email protected]

Path /data/data/com.rimac.rimac_surrogas/oat/x86_64/[email protected]
Size 600B
SHA256 3ec9b9e8db9bc72fc24cb63aa42941c27ea6017eb366761f773835e4c08774da
MD5 b43c5e9cc063cbf03a889beff8f49afe
SHA1 564ece421ea056c76f7dac68dbd395dfdc52b116
SHA512 e53e6922383a18f9046b71987c665feb158eedcde550b9c5505c4e4cfeae4d297baa7bd0790fa99c43c56885b21474ac2d6090aaba3c3f4a2e16f77d6e4031cd
TLSH
T126F0286463EF08C68B8598248FFCD3FB3AD15EE5C4904B80ED6844F97A469843681E38
MD5 SHA1 SHA512 TLSH

Submit Download

[email protected]

Path /data/user/0/com.rimac.rimac_surrogas/[email protected]
Size 42KB
SHA256 365b13c2a86ec8e7e6721b3867d449f1a944574097725314cb4a5c27e2ffe4f1
MD5 8cfd91aa1357134e8558698583cc2c4c
SHA1 ee42011d35185b01ece0b75811571fc76c14c4df
SHA512 808ee35e5e2bcc4d71f622e5c6426eb10957b37aa6848c7506b6d5b41d4f707423445bf006779b0d83c847956bfb59f78203ee40e028103ca78875d23cc10b1a
SSDEEP 768:taCBYF4TJm1K5/j/0F5wZ3DQIRrej1kO8WGDDHOYykpG3xVxV8T32lSBHnO1Jkw:tTBYFGJmw5/Afp3ED2P+w
TLSH
T12C132A8E50E03B71EE8E9574143BDFE1DE62ED38B50277114906AE10CDEE0679F2EA85
MD5 SHA1 SHA512 SSDEEP TLSH

Download

[email protected]

Path /data/user/0/com.rimac.rimac_surrogas/[email protected]
Size 606KB
SHA256 fca4bd18cc45567f77b28c123d93baa227204a3a260a7e0b32e90b584bc4c771
MD5 37d9900a20f5c0eb2d67702e65ab5181
SHA1 5c5ef479ff01726e9f65846fc6bfa1dfcfa5e0fc
SHA512 f270297835b31f4bb5d7de9e7762e6213bc0d247fd2f07570f7c843faaea30af65b79f15d1fe94708528a2f9f6ed40f2ce7c5eea27161a8edc55674790ae4132
SSDEEP 12288:gsDOS3p4msygmBrTSgSZ0s5MGJr0CPUYt4/0woaag3Aybg3uegJ:gsOS3qmrmi6uG9g3rbg+1
TLSH
T1FFD4BF13F852DF3BF56B683615A783E61325D2AC51A2436785CECBA32CC97850BF4B48
MD5 SHA1 SHA512 SSDEEP TLSH

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v16

Replay Monitor

Loading Replay Monitor...

Downloads