7bb9d049ebd45bfc84e68d03db315f003d040af4a3856315ca75c5166a34503e

General

Target
7bb9d049ebd45bfc84e68d03db315f003d040af4a3856315ca75c5166a34503e.apk
Size 10.9MB
Sample260817-dwp5eahc32
SHA256 7bb9d049ebd45bfc84e68d03db315f003d040af4a3856315ca75c5166a34503e
MD5 7622b200c3e9c4a12413b965b67a8ff4
SHA1 e99fecf4e9edef9c7b44ef2181a814d093da48d5
SHA512 23c9557dd9e999ecab15038314f4198093e8b5c10ad66a1f1151f73ad3ab35aa7d14e1e837e9adbf82fa3ea9d0fb92da337cd84f29a1e4fd26f524bc12323730
SSDEEP 196608:7nB2N9RArFb+/nerbOoOpTik4rhRRplJRjWO1o2rkROBHx7okTT6mm2/vEqN/7aE:7QHarFbCnwtxHDlrjpL+ePdcWaLOp
TLSH
T176B63396AB40563BC876443241AB4B2277A76D9985A3DB1F3A08710CBC73A4C1FFDE5C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

discovery dropper evasion obfuscated persistence

Malware Config

Signatures

Encrypted or packed staged payload inside Android package 1 IoCs

Extracted asset shows near-random entropy without a recognised container header, indicating an encrypted secondary payload staged for runtime decryption and loading. Correlate with any runtime class-loading detection on the same sample.

obfuscated dropper

resource	yara_rule
behavioral1/files/fstream-2.dat	ANDROID_Encrypted_Staged_Asset

Loads dropped Dex/Jar 1 TTPs 3 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/com.uxczdxbhi.vmbzocrqf/app_dex/classes.dex	4287	com.uxczdxbhi.vmbzocrqf
/data/user/0/com.uxczdxbhi.vmbzocrqf/app_dex/classes.dex	4348	/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.uxczdxbhi.vmbzocrqf/app_dex/classes.dex --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/com.uxczdxbhi.vmbzocrqf/app_dex/oat/x86/classes.odex --compiler-filter=quicken --class-loader-context=&
/data/user/0/com.uxczdxbhi.vmbzocrqf/app_dex/classes.dex	4287	com.uxczdxbhi.vmbzocrqf

Queries the mobile country code (MCC) 1 TTPs 1 IoCs

discovery

System Network Configuration Discovery

T1422

description	ioc	Process
Framework service call	com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone	com.uxczdxbhi.vmbzocrqf

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs

persistence

Broadcast Receivers

T1624.001

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	com.uxczdxbhi.vmbzocrqf

Checks CPU information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	com.uxczdxbhi.vmbzocrqf

Checks memory information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	com.uxczdxbhi.vmbzocrqf

com.uxczdxbhi.vmbzocrqf
1⤵
- Loads dropped Dex/Jar
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Checks CPU information
- Checks memory information
PID:4287
- /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.uxczdxbhi.vmbzocrqf/app_dex/classes.dex --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/com.uxczdxbhi.vmbzocrqf/app_dex/oat/x86/classes.odex --compiler-filter=quicken --class-loader-context=&
  2⤵
  - Loads dropped Dex/Jar
  PID:4348

Network

MITRE ATT&CK Mobile v16

Initial Access

Execution

Persistence

Event Triggered Execution

1

T1624

Broadcast Receivers

1

T1624.001

Privilege Escalation

Defense Evasion

Download New Code at Runtime

1

T1407

Virtualization/Sandbox Evasion

2

T1633

System Checks

2

T1633.001

Credential Access

Discovery

System Information Discovery

2

T1426

System Network Configuration Discovery

1

T1422

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

classes.dex

Path /data/data/com.uxczdxbhi.vmbzocrqf/app_dex/classes.dex
Size 2.0MB
SHA256 59eebc38964e67cb1fc9f6500451cd80f2c9f0e2a8801aa356ff0a24182a9121
MD5 c63a47912b460216144f45c4dc278857
SHA1 52e142c6726ddc7428f82c4d69a2630e0d8ad8f2
SHA512 a54d20a20c7eb48acfa912e9beb9ea8483a1b941b4d1e4d481ac1809978b3d843b5d893f54503858a5cce45a1e2c023377c81cd62b8d2b743a20a835c2891f60
SSDEEP 24576:WSDX9o/fnoBnDnBzBuLQ7wURz6jj1axOkUEQYNpBC/84pHWFU3:vRnBzcqRzvUEQYNU3
TLSH
T16EA53A17D956DF66C8BDD33969E603213336B180BB838B1B614DE2B1BC432D52BE52C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

classes.dex

Path /data/data/com.uxczdxbhi.vmbzocrqf/cache/classes.dex
Size 980KB
SHA256 5cb4c116633ea81264fe2542cc8d0f887433699ad0b235e096f6d67dc04a47b7
MD5 7a2a47b871b9f19f5da235bde2d204e7
SHA1 a0aca4fbee566b1ce130e415d061b5fa9fdcc4c7
SHA512 57c699bd567144f53e3dd935811f4f1b66114dfde5b83df1d4e4605faf3e662b0a1c917d08a4fe2c20e2edfd2b91b9859a7cb9ec5989201f9693e8f0dbc8d4e4
SSDEEP 24576:/rbEkH5A+AnVr7Rxg+noUtduGM15Qy0BO:HRHAnV7Rxg+JtgGMr7yO
TLSH
T16525331B64B065D5FF4748A07B1BA7C3A73736BE4F94E81F6A7CC4E19EC804A4A93006
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

classes.zip

Path /data/data/com.uxczdxbhi.vmbzocrqf/cache/classes.zip
Size 980KB
SHA256 2bdb2e43eca7aa3305c5915e4fb8b759ad174fc3a48c96eee28d8e781796fa55
MD5 5d631076a6de8c80f3fac2301f90eb9e
SHA1 519eb451278b9f9ed56bba6d9b2bb13a33fece76
SHA512 20bda897f618089ba286daa57f060de2ac4e229da1e45600596dad85c7cea61dd692fa7a5364c29d4f399423783248c0452c9c72b04f43392ff828d2b028a34e
SSDEEP 24576:brh8KRpAEQnftzRxAAtoUrJccMjhQu8jB:ZDR+nVzRxAALrmcMln8B
TLSH
T14425330B64B065D5FF4748B07B1AA7C3673736BE8F94E85F6A7CC4E19EC804A4A93016
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

classes.dex

Path /data/user/0/com.uxczdxbhi.vmbzocrqf/app_dex/classes.dex
Size 2.0MB
SHA256 dcffc56645a1fc6e093f2ddbf7047ec0c553f59f2b0d1c6905f63cf7c97e4347
MD5 acc9c1156edc7c9bd9bb23ca7b6c9137
SHA1 9dc9a7b984bc9974708a5e29356a2356f3c06026
SHA512 becb7df225f3602583282b27d6615194a7622d9177955ceb855cf555892837c4716e987e0a12280332b3562c6065517ca6633c511e828b62bccbeab597c6b323
SSDEEP 24576:WSDX9o/fnoBnDdN72NSGXxD+ArfZxXmqJHnBg84SIWFU3:vRj7VGh+8Aqw3
TLSH
T100A51917DA12AF27C47D973285E743A56336A1827F43CB1B250C52B0FC8B6852FA67C9
MD5 SHA1 SHA512 SSDEEP TLSH

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v16

Replay Monitor

Loading Replay Monitor...

Downloads