4e52f85b5be6cdcfc8a3493c0d56e99494a36871e53ef90ea915015a9fcbbdff

General

Target
4e52f85b5be6cdcfc8a3493c0d56e99494a36871e53ef90ea915015a9fcbbdff.apk
Size 29.9MB
Sample260819-wh5l2sstd1
SHA256 4e52f85b5be6cdcfc8a3493c0d56e99494a36871e53ef90ea915015a9fcbbdff
MD5 e673f474ef3fbfb60c9ae9c32829d4bf
SHA1 44c4be3ecc83a30db2483eb9895e30ec48fb6eaf
SHA512 903ab32139331c0fcd72bdaf3f99081252a2622861f43be495a1fa6ac695757b4906bce36dc14cdedde8001346dadb7c301ce1e3cacb1cea1c4056c4bcda7c3e
SSDEEP 786432:ctCiCLBpRFLh2AeNlUCwCeoJeZcFQGUBuLbXOQgJ:ctCiCLBTFLhpeNlBwCeoJEcFQGKuLLUJ
TLSH
T1DB67231AEFC87A6BC5F74236587A55254C430C44838BCA82EE9A752C2C776F1B71DBC8
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery evasion persistence

Malware Config

Signatures

Loads dropped Dex/Jar 1 TTPs 4 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/com.jojo.sellfupdater/app_behave/OArhW.web	4380	/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.jojo.sellfupdater/app_behave/OArhW.web --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/com.jojo.sellfupdater/app_behave/oat/x86/OArhW.odex --compiler-filter=quicken --class-loader-context=&
/data/user/0/com.jojo.sellfupdater/app_behave/OArhW.web!classes2.dex	4380	/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.jojo.sellfupdater/app_behave/OArhW.web --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/com.jojo.sellfupdater/app_behave/oat/x86/OArhW.odex --compiler-filter=quicken --class-loader-context=&
/data/user/0/com.jojo.sellfupdater/app_behave/OArhW.web	4355	com.jojo.sellfupdater
/data/user/0/com.jojo.sellfupdater/app_behave/OArhW.web!classes2.dex	4355	com.jojo.sellfupdater

Attempts to obfuscate APK file format 1 TTPs
Applies obfuscation techniques to the APK format in order to hinder analysis

Obfuscated Files or Information
T1406

Declares services with permission to bind to the system 1 IoCs

description	ioc
Required by accessibility services to bind with the system. Allows apps to access accessibility features.	android.permission.BIND_ACCESSIBILITY_SERVICE

Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

Application may abuse the framework's foreground service to continue running in the foreground.

defense_evasion persistence

Foreground Persistence

T1541

description	ioc	Process
Framework service call	android.app.IActivityManager.setServiceForeground	com.jojo.sellfupdater

Queries the mobile country code (MCC) 1 TTPs 1 IoCs

discovery

System Network Configuration Discovery

T1422

description	ioc	Process
Framework service call	com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone	com.jojo.sellfupdater

Requests allowing to install additional applications from unknown sources. 1 TTPs 1 IoCs

defense_evasion

Code Signing Policy Modification

T1632.001

description	ioc	Process
Intent action	android.settings.MANAGE_UNKNOWN_APP_SOURCES	com.jojo.sellfupdater

Requests dangerous framework permissions 3 IoCs

description	ioc
Allows an application to read SMS messages.	android.permission.READ_SMS
Allows an application to receive SMS messages.	android.permission.RECEIVE_SMS
Allows an application to send SMS messages.	android.permission.SEND_SMS

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs

persistence

Broadcast Receivers

T1624.001

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	com.jojo.sellfupdater

Checks CPU information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	com.jojo.sellfupdater

Checks memory information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	com.jojo.sellfupdater

com.jojo.sellfupdater
1⤵
- Loads dropped Dex/Jar
- Makes use of the framework's foreground persistence service
- Queries the mobile country code (MCC)
- Requests allowing to install additional applications from unknown sources.
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Checks CPU information
- Checks memory information
PID:4355
- /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.jojo.sellfupdater/app_behave/OArhW.web --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/com.jojo.sellfupdater/app_behave/oat/x86/OArhW.odex --compiler-filter=quicken --class-loader-context=&
  2⤵
  - Loads dropped Dex/Jar
  PID:4380

Network

MITRE ATT&CK Mobile v16

Initial Access

Execution

Persistence

Event Triggered Execution

1

T1624

Broadcast Receivers

1

T1624.001

Foreground Persistence

1

T1541

Privilege Escalation

Defense Evasion

Download New Code at Runtime

1

T1407

Foreground Persistence

1

T1541

Obfuscated Files or Information

1

T1406

Subvert Trust Controls

1

T1632

Code Signing Policy Modification

1

T1632.001

Virtualization/Sandbox Evasion

2

T1633

System Checks

2

T1633.001

Credential Access

Discovery

System Information Discovery

2

T1426

System Network Configuration Discovery

1

T1422

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

OArhW.web

Path /data/data/com.jojo.sellfupdater/app_behave/OArhW.web
Size 3.6MB
SHA256 a750dd7b6629c6bc56d623115b02c94263fc5fb7ebe13bf6c55ffecd55742342
MD5 52234c255a739fa89d3556062b8d1ce0
SHA1 a332b70707d8756b8b9e6dea7773814a890a48a5
SHA512 4a5b7c65b890def63e7dc34965eb92e12513d496fcb83a86cf220bcb3450227c878aca987f0434a9d6c6057d1cb618cc22192b576a53b83d0a9c1ba608a4b6aa
SSDEEP 98304:yBqHDaT9GcEhK764OGAJrMXZC1mhpyISrz5T30lJeNL7w:VjaxSX4Z49mYzmeNPw
TLSH
T13C063399728E4FF3C442C079B7C4BC70AE990D568CAB42559B1B4F71021BFDE32B65A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OArhW.web

Path /data/data/com.jojo.sellfupdater/app_behave/OArhW.web
Size 3.6MB
SHA256 efcccc35610dcf62c20f59258b319b3bf7c3a59f708da3643bf6ece1b50c95d5
MD5 92644b21c72157d780980c39eb2f4951
SHA1 7cfa8726df55b673532a0bc7350f5a265ad9ec92
SHA512 181f1efd68e9f3bfa87ea20e61581fbb1cc525132622bc886e28eaea77c1b674e77097653082075c99ed55002ee0ae42bb848d73ba1474ab6dd59cb93d30251c
SSDEEP 98304:1FrbKlYan/4UB7F8HHwxNCHqgv1PoiGKP/wTUjcM+VECYq:HKp/8HHwx6FG0JB+gq
TLSH
T174063382C910307F7A0B78018F079DD98859A3D94D4B50EE62FB85C4EEB364BF999732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

profileInstalled

Path /data/data/com.jojo.sellfupdater/files/profileInstalled
Size 24B
SHA256 1ff2ae5b8258f528a81793243b1ec50aa2414d2c79a503375bec461910dd1500
MD5 e859068b829d9cd4c1be6cf87d1ad292
SHA1 3bc4c4ac21d8a9e9c7145aeb6b2de0625694b188
SHA512 57ffe092eadadba20a8e8039a66acbd65862057bddde8dd04a6cdd1d2d11ae4e2191df5077f6c665f5dc3b4f7e0c38d49d94530b05ce07ce5ba331a35be82e27
MD5 SHA1 SHA512

Submit Download

temp_install.apk

Path /data/data/com.jojo.sellfupdater/files/temp_install.apk
Size 13.7MB
SHA256 5df90a0393f61cfbb3d7893801428ced22516890828da35fba93d4ec47c42725
MD5 b6b2ded385e7cca688beb3618aa9d643
SHA1 7af30b6113a329f9ab0e6a72e0509624698330c4
SHA512 d2f5457d81fdbbbf252b7a2806d5c290c79039b25352300cd0f0ca4217cce6cfcc8bc5c1cfc087ee7a16d0c8d57208fa43cb7b6bf970f03c3a2fd84677955dc3
SSDEEP 393216:PYB8tMONZWIsH53s7gYB8t8wYB8tDYB8tAoUUMyjeYB8t5/UlZ:ghONZUcddf81MmjtlZ
TLSH
T1ADE6120AEFC87A6BC5F35236487A59294C430D4447C7D983AD99752C18BB6F0BB1EBC8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OArhW.web

Path /data/user/0/com.jojo.sellfupdater/app_behave/OArhW.web
Size 8.9MB
SHA256 c63c671fe785dace4643baa160fb835520cbd79cf450c8d78f6eea951a6e8069
MD5 afe3ccdf1cde090e55a252d431634d79
SHA1 5a7e292d1b6cd5fbd081964bbca3e5a96f059f98
SHA512 a8a345efe4457bbcb20ff42579ac01c917175b0766b35de504227041fee4cd605401af74679b0dce2c8b5cb0495cddd25072dbe4b55f5130e96b807a0505f92a
SSDEEP 98304:rZrplcCmKW2/mMqPyr1WJE3BwsQkJI+IhpXij:r/lnlQkJI+b
TLSH
T141969D67A606B833D57E873699FB4741AB3310473F239B8B158495BCBCC32C15BAE258
MD5 SHA1 SHA512 SSDEEP TLSH

Download

OArhW.web

Path /data/user/0/com.jojo.sellfupdater/app_behave/OArhW.web
Size 8.9MB
SHA256 f14035133064bad4a8dbccd4b683b6780155298822f44c5d92b93f8e4b23d965
MD5 bb79965a285bff3960ec727f4d85c7fe
SHA1 e9c452833b34f21ed9fc20874fee1928b3aade87
SHA512 37eee7bfc98c31f45337c2cd5eb5c0ff0e6e8fec3325d5398155349fa2e869857b9d8b5b23cb5072d7bda1c458678489b12804f4a10b39b92699fea0dd482abf
SSDEEP 98304:rZrplcCmKW2/mMqPyr1WJE3BwsQF4J+7qJxmi5Kqj:r/lnlQm+7qL
TLSH
T11B96AF67A616BC32D5AEC33ABDFB4300BB3210567763578B1184E9BC7DC32C15A9D298
MD5 SHA1 SHA512 SSDEEP TLSH

Download

OArhW.web!classes2.dex

Path /data/user/0/com.jojo.sellfupdater/app_behave/OArhW.web!classes2.dex
Size 849KB
SHA256 ab999548b900e928c961a742d23334305aab9d7ae24ad3e092f75ace063cc6b2
MD5 d0eda4fd8565b694bb9c291b9121bd54
SHA1 c8ad25057c3eb6bb3bbdc53617130a1f3531fd8c
SHA512 ab8d445647c5b2c612093d611612c99c8edf5ec9da236ce9b3de4c6d0de2c23dffb2cb0229f7b05d1e8b5c6f1a0fb832b77733bc30a01f7146f99ca361d8e1a9
SSDEEP 12288:HL/1Z180acFtoY8CTznB2coguYbAppDGAHoXykBbGj:z1Z1ocFuKznBXodf
TLSH
T1910517A3F62C5E32D05A06B30CE762F1133963D35943AB43AE459569FE8B681E71D32C
MD5 SHA1 SHA512 SSDEEP TLSH

Download

OArhW.web!classes2.dex

Path /data/user/0/com.jojo.sellfupdater/app_behave/OArhW.web!classes2.dex
Size 849KB
SHA256 bddddc355e6af0e007894940dc137c80bed6a4bbb91da0b3b6f7e3177120f1d7
MD5 3a55b0f15295422bc6c23f8a85134115
SHA1 24b8bf9122393b5bfbbd90d963f5492a0815a748
SHA512 5f68cfe7125bea978435c6d9722698d5c695e7a0cc81944cb86bb39972aee5d4dc3f1777384bf26355797823be81945d4614266cc318708b64e377c00452eb06
SSDEEP 12288:HL/1Z180acFtoY8CTznB2coSgQLUXkacj:z1Z1ocFuKznBXoSgtTY
TLSH
T17A0528A3F62C1E31D19A06B70CE722F1133963D75983AB43AE859569FE87281D71D32C
MD5 SHA1 SHA512 SSDEEP TLSH

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v16

Replay Monitor

Loading Replay Monitor...

Downloads