f633b69b4028f9cde42c72b796d3cafb525d935b9ab71a68cc4e74993de7fa03

General

Target
f633b69b4028f9cde42c72b796d3cafb525d935b9ab71a68cc4e74993de7fa03.apk
Size 8.6MB
Sample260819-ala1ystdjh
SHA256 f633b69b4028f9cde42c72b796d3cafb525d935b9ab71a68cc4e74993de7fa03
MD5 15c93d07187a38b2bf8f0bc5941e0440
SHA1 dabe6dcc80a0862117812acfaa281b2ef309c5a8
SHA512 6f5aa69b145443860831fc5724a2897e95b5c91e9971c889c88bec142233ee8694460f16be304847a7b30292026b4ae51466be7fa1c8ae9a0bae7d981d032244
SSDEEP 196608:+ol4A6rv15bIQaNN2v9HXbx4anwhh6TS9vwUqK/kLfEs8YqEKxsg:RO5b7amvVLguKwLOCEsRq1ag
TLSH
T1D4961285F748991EC8FB473259FA5232357B8C128F83C697A414327C69BB6D00F99ED8
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

evasion

Malware Config

Signatures

Loads dropped Dex/Jar 1 TTPs 6 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/com.verify.weirdnp/files/arm/classes.dex	4259	com.verify.weirdnp
/data/user/0/com.verify.weirdnp/files/arm/classes.dex	4288	/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.verify.weirdnp/files/arm/classes.dex --output-vdex-fd=44 --oat-fd=45 --oat-location=/data/user/0/com.verify.weirdnp/files/arm/oat/x86/classes.odex --compiler-filter=quicken --class-loader-context=&
/data/user/0/com.verify.weirdnp/files/arm/classes.dex	4259	com.verify.weirdnp
/data/user/0/com.verify.weirdnp/files/arm/classes2.dex	4259	com.verify.weirdnp
/data/user/0/com.verify.weirdnp/files/arm/classes2.dex	4346	/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.verify.weirdnp/files/arm/classes2.dex --output-vdex-fd=44 --oat-fd=45 --oat-location=/data/user/0/com.verify.weirdnp/files/arm/oat/x86/classes2.odex --compiler-filter=quicken --class-loader-context=&
/data/user/0/com.verify.weirdnp/files/arm/classes2.dex	4259	com.verify.weirdnp

com.verify.weirdnp
1⤵
- Loads dropped Dex/Jar
PID:4259
- /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.verify.weirdnp/files/arm/classes.dex --output-vdex-fd=44 --oat-fd=45 --oat-location=/data/user/0/com.verify.weirdnp/files/arm/oat/x86/classes.odex --compiler-filter=quicken --class-loader-context=&
  2⤵
  - Loads dropped Dex/Jar
  PID:4288
- /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.verify.weirdnp/files/arm/classes2.dex --output-vdex-fd=44 --oat-fd=45 --oat-location=/data/user/0/com.verify.weirdnp/files/arm/oat/x86/classes2.odex --compiler-filter=quicken --class-loader-context=&
  2⤵
  - Loads dropped Dex/Jar
  PID:4346

Network

MITRE ATT&CK Mobile v16

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Download New Code at Runtime

1

T1407

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

classes.dex

Path /data/data/com.verify.weirdnp/files/arm/classes.dex
Size 4.4MB
SHA256 2793203fcc87dc075f1a9efbf7cd478934eff82551a61f27e82745056cd4d560
MD5 b9b7908a08589b370769f488642802f9
SHA1 582542097ff65af9eac988f858ea70337eef997e
SHA512 9feddb3cdb5df78490aca9ae58a207aae2aff79d414aa67ff5946b17ed9cd0bb47209fe89b8dcd9bc087ba1086e75758f673bc8741d72dee19286c26784425ba
SSDEEP 49152:bgTsAHg4V/W8euxVYzK62fdk88pmbTc34KaGN3itV6J961c6aUyy4U:esAA4V/gJzK62fdZbo3zN39amkn
TLSH
T160268D17A6014E26C8AE973A65FA0300377022499753C393150AD5BFBDF36E19BE978F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

classes2.dex

Path /data/data/com.verify.weirdnp/files/arm/classes2.dex
Size 45KB
SHA256 16d5b5763b248d8d7f0fa35971df6b438532b36cea99e6b43d8673580469479a
MD5 129a35c80232300e7ba398d30b410eeb
SHA1 8b2f17ddcf59d3de55699ce781eb1f2dcb6f2d94
SHA512 103decd49557e6ea7f6bc521e0c00c2b40b48721e1419dd86d7e02fbff308c3b1e8d0e6ce34a806c36d3b1ab3621fb7a2bc717531e2b2147f0d75eceddf0be74
SSDEEP 768:C3t+8SEHG2W3SlSJtZYJUAMO8XQAV0jMaYHl1lvRWtqHpIfoYDl:587H3W3SoJvgRr4gMRl1lk8IV
TLSH
T1D4232C13E803E97BC66AEAB61AEF4743B323030277D3530A79545AB1A9CF78A0B545C4
MD5 SHA1 SHA512 SSDEEP TLSH