79edf7da20c5f28c2d2d7934ff8019f384b3767173b128d20e18ed958c689c73

Sharing

Copy URL Twitter E-mail

General

Target
LSPosed-v1.9.2_mod-7174-zygisk-release.zip
Size 2.5MB
Sample261029-3vj97scg34
SHA256 79edf7da20c5f28c2d2d7934ff8019f384b3767173b128d20e18ed958c689c73
MD5 585a8f45e3fbac77931ef19074c71fad
SHA1 57bebdf25283b9322d8c32062d1874ec81fe0e5f
SHA512 9ddaf92c88f90478d29b2af41fda59a49c43fa00ed437924a773500045de5d196bf9728d627a3e6e0a3af1e28ca29fe36c05dae978d2f0996906ef2588eb1fb5
SSDEEP 49152:sztGTzx7cd4fTH/7AkK1+Jzpl1KjbuYdVp4sIW0nzlXQ2lnkqqRi:sztIzx704fTH/UpoJzplOuanIWE0A
TLSH
T15CC5336788605D5BFC3B4973E9D0273865CE6322441BF6C183125079EA69E8D2FE2FC8
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Targets

- Target
  bin/arm64-v8a/dex2oat
- Size 6KB
- SHA256 58e2f7ff61189c61ea313eac6931de0ad88f75fbb3198c779b142b6ea117b555
- MD5 58caf260ef1af12805b11d9e05d42b67
- SHA1 7009a2a6ca38500fa6c99220611065b5aa88a3ed
- SHA512 800b720c0282194d589cf6e08073cfe6e0cbe5e083212c2604e7ead289e196a5f2bf74d5da06cf426c33a028f3351ef672e05c6cc1ced5a330e070845173e30c
- SSDEEP 48:H39i82y2CilpHB765qVCyxvq2WqRfa1b5iI49KfcMyqg/C:xd2Ci7lcdCq1WS1bx4FMyqg/C
- TLSH
  T16BD10342FF43CA7BD89E077454E70364B632A0D8978753039B0DA62D5A223CD79A5F8E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral1 behavioral2 behavioral3 behavioral4
- Target
  bin/armeabi-v7a/dex2oat
- Size 4KB
- SHA256 6bca0c8b6c7831d9bcbac5416e5036d7db5b6fb563b1dceccf338dbf2c610f97
- MD5 68e85d3a9b284dc12b874ce8489e9b3e
- SHA1 627c1bdc8a5a5af18e5adfdc80a5becdc2cf5065
- SHA512 ed5fa8221ceaee57433de76ef4d2361b47fd4c89c0c51e881ac5a0354b800344641d9d79afccd3d2f12060fa222ed111b0825bd3a08742f43d09949d084d619d
- SSDEEP 96:ZPXId2CiwycQoOqTnlvcgLSRl/KB/tAX:N4swLnNcgL2/6/
- TLSH
  T1ED913CC6F751CC63D8FE0237640303E43939D881D66B6B23A68C36796C4229CB961788
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral5
- Target
  bin/x86/dex2oat
- Size 4KB
- SHA256 793db96e7a11125d0bfd5fc0eba843d9d68262b7aa4df673fe45ef933373ebb7
- MD5 649cdc7aacf212b4fc1801b24cb8cd20
- SHA1 1603250c9a967db34de35c737722697c179ad46e
- SHA512 1c972f40d95c4726f92be8cdd89dd3b9c37eaec7f55f7a2f49fa80b61f3e11d84829a219dc04b38c7969968541e2601afd60764778ecb527737f3697f59823be
- SSDEEP 96:86MsOEd2CiXvIcXxBqX3Qa/0ce3KWLkroCl8Si:8tEsVcX3QgWKt
- TLSH
  T164916343B7519A2FD2FE073804AB0769E432D420B7C3831377497B996872698DA2279E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral6
- Target
  bin/x86_64/dex2oat
- Size 5KB
- SHA256 88641c375e67b62960a8339cf1489b537504ad20e82836b405058f1c0b88b769
- MD5 31a901712ce25a28132bbfdf2b7769dc
- SHA1 cba0490b281250be9efc57e455857f6e10bbefdc
- SHA512 adfb21cac7b3e313b7f30bb6eadfdf14e908d642c73e78d6f8ee844d5a413aee55f78c303f7f06a1b8ca851ecc573704971b33e5d593fdc9b832ed539609a901
- SSDEEP 96:RDd2CictgcIi5WWGHi8oCwuQMH5eu7x4dMaAIcli:RDsct15bThumex4P
- TLSH
  T1C4C12407B785DA3EDC9C033099BB02743630A48EFF828617274875B86DB1358D65B6DD
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral7
- Target
  cli
- Size 517B
- SHA256 16b88d9220c5c8c5f10a19434bf20249a4fe164eb6feaca98c12a23e22ed6660
- MD5 267a919a760dd9833447a5c4877e76bf
- SHA1 d2a284dbe3c69c6a9459267b8007334995592963
- SHA512 a7954360f9b56328faf1141d55f190e324df4d414a0271c0a8244394dd8c1ea01f8502180a523dd4b77d5dcae44982dfdd69b036bbb2d8773283c001240c125b
- TLSH
  T1E3F09E1D222D536F602BE3B86802CC7B0AF84FFB28649C24340D708E1F02239E9F56D5
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral10 behavioral11 behavioral8 behavioral9
- Target
  customize.sh
- Size 6KB
- SHA256 5c9062c3fb6665feb48139b59110894ae1d24cfc3cefcecdbe5a098afb31207f
- MD5 7a6750f751af46c8938ba4fb860a8785
- SHA1 98ebe3189955568fd4deffc8d380acdfe507c492
- SHA512 2e0a577deb48615217b2b689df72afb5464411d47c983b0dd5428cc80e036eb32d051c507962f9e69a9db66018eca8667ad5a9182a2ea9fa2f109d712b2e1ac7
- SSDEEP 192:5pKbIkVQzEeuEKULSjuowIxcmxGtaoQSzh9:5pKbUQjuowI3s9
- TLSH
  T1D1E13045B1E19DB967ED2940C04219C5B2789FA24E9E3860FD9CF8FCAF3E17049363A4
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral12 behavioral13
- Target
  daemon
- Size 1KB
- SHA256 d16678f691244fffc51cee3948e85da557e3e4a13deed09b014255c86511e439
- MD5 c7d665cc617ea3371c7adcbdb0cee86b
- SHA1 ef215a2291cbcfbf329d19966d41024b8154e6cf
- SHA512 3fc2abb3b8a02b821f012e0eb747a6340e30fa15bb351bb6381c0f52e5e0054ea918d5e7fde670f39b90718d273905f83c93bacafe3e6f504b60c6b539eba8b4
- TLSH
  T1AD210238218EE3B21AEB65E168415084A3B5A23B56801420B45BBEC13B2B71FE4E3E49
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral14 behavioral15 behavioral16 behavioral17
- Target
  daemon.apk
- Size 562KB
- SHA256 94558f7c09e715e219f46beade1a81f97f150df49834df33678214d47ea1b7e7
- MD5 e3b51e4a497d4bb452ecc8fe55b71f71
- SHA1 0457127699d4783ba74b75b31d431c14efdb5c5b
- SHA512 5daf452d49c7ffec584cc1fb17b367235ce0b7b2003a6c7f8d768858a175c2812a0307098516348e72ee738552496f49d9109850417d01b4889ecd2ccdd66474
- SSDEEP 12288:vY5D/xJzBUeoStP606Z51ZlmEofVTvV8c3xBT8w+wUB+k0:Ap/xZFtPuA8HB+k0
- TLSH
  T140C4D01BAB8C51BED8F6817D19A75336E732BC14433783534B082A3CAA677E88F05795
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral18
- Target
  lib/arm64-v8a/liblspd.so
- Size 187KB
- SHA256 74376cdf2677286b3c3a63d2833af59004948d325aef3ac3dd1f62e4bf2f4c0f
- MD5 4597d62b50f39ef28952de1760b68fd1
- SHA1 dddc9869f5214133593dc4b41fb53c622c85e3e9
- SHA512 5d778925e0acc1d8a1418927c81afd400461e288b75f5a9c39b2b3f893a89aa7fe2eda2a77e80cc79a64efd56513614d0ec95302de80e5d1bf71c39123c2ec19
- SSDEEP 3072:U1we03A0Ew02rEZ1w2n03b5c/KTBXlT/3K246xh09JmP4l3zIoTbyAp2FPgT8XO:U1wXA0Ew0Jnw2nyb5xbr4c09EAF3726Y
- TLSH
  T107148E579A1C8832EAC6F0BD1E5052B07833392C4365C3B91F27463EEBCA5D47A56B63
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral19 behavioral20 behavioral21 behavioral22
- Target
  lib/armeabi-v7a/liblspd.so
- Size 147KB
- SHA256 97e49af599c7e16b15174aa9b9f8b5e6ea301e25d666f6ff78198ee2f51fc2c3
- MD5 1ceb3b1c8df7224398f2c16ada9135cd
- SHA1 869a018875491633787bdd1909785c2da0f88890
- SHA512 3c4de22936d1eadea91f4003c3b6a6e88fbbd03ffd3d9989bbcd3e82b7f411acc724888f1608e1ba74cc845fc70ff602e2bdf2f87e6d26175cbf94046295404d
- SSDEEP 3072:pMljl8oAO3MQgvidmXqTnvw+U2zNBUUV:KP8oAOcQgAZc2zQ
- TLSH
  T1F9E3D0D79884041BC6DFC83F39124E816D389C9873E6A76E1B49BC3E7879218EE355C9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral23
- Target
  lib/x86/liblspd.so
- Size 215KB
- SHA256 d2f76d1e6cfe58a8bf667d01c84293b196519c8cd78eacd73aeb8f22c1c56987
- MD5 b9285fae7ce0c0f2f624dafd8d99f86f
- SHA1 ed4cddadc5837fe7f4526737c084e5e0967e85f8
- SHA512 29743096bfcc44bd5f560a4db9779075e69bd57316402eaa9e9a0176dfdbe78e8519cb4e190466647b0226e4bc6cc7556a80d0b8c1919dfc0948104845f89c5b
- SSDEEP 3072:BVJzgHq/y8pVDRfXGAv5kvVRenDgUTDdsbK5esAG/fTk7wx48gbD3RXyta4YSoi:aKasVFXRrDgUTDdsGEvG/fTFKCei
- TLSH
  T129246C41DAC28AF5D42B76FA062FD73EDE261913DD75C216EB84AD29C433225CF182D8
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral24
- Target
  lib/x86_64/liblspd.so
- Size 230KB
- SHA256 563242fd74bb6c595e5946adb836924db054765c6c31f2a31661a8113a468b34
- MD5 33596c29abfcae56942166520541e9a3
- SHA1 f7b84e024e7d14f8c0c7b13f38244ecccbaadc4c
- SHA512 46c81303d6a52e89bc1d89a22ebfc035edf8f03fc604d13882e1c270d0ab4525f9a91e154bf8454fcb091cff57621ef0f85d314aea77d1a767e4c986cceeecd0
- SSDEEP 3072:MgKRcj23uFSu0+Z+tpXht8oIKvFUwqHLAUqaoL/U16IkxGK:jWU+3Xf8XKvFoKtL/UMx
- TLSH
  T198344A27AA8908BDECECE174478FD17FD731F4439610F21B27806B065A67E549B2A7C2
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral25
- Target
  manager.apk
- Size 2.6MB
- SHA256 cdce0494175bb700a402a2c073a921a5c2087a3b916749d66fc18cb79bfd1f91
- MD5 01417592b25b0cfe4f36dfd218bec902
- SHA1 97e922693992226d423d071e4d77db0f8743921c
- SHA512 97809b635cacb18b3b645da670f1b0e8cf74bce541aa9a3a07c8fdf702bb83e85ed3cce8b6d0f0cbabce4eb99e4b04f19fb53f57c3418ee7203dbb7317faa335
- SSDEEP 49152:jSat7jxXjdUk6J4JzpnDI1hl+riqLo5HTiLpCku:jSg7j9juzKJzpn0lepCku
- TLSH
  T1FCC5AEAEF75A192ED4BA00FA4C75A276639B5C100A5397633944332C2C776FC0F98ED9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

persistence evasion
- Loads dropped Dex/Jar
  Runs executable file dropped to the device during analysis.
  evasion
behavioral26 behavioral27 behavioral28
- Target
  post-fs-data.sh
- Size 842B
- SHA256 be07bbfeee735a9cae47ddce1f8d669434583286750132b3c64ff7d03b9b5ff1
- MD5 0da2f1cc9e67df975c43c5472b40fce7
- SHA1 eb9105cd721a588897b947d89587dde38d6fbd19
- SHA512 a04219884f53cd73784f81c8ee7b05ced69c449651370bd66e9583f31f838dfbf71faf8d7c96189e74d1fb0272072332e7eb0b7038da1321a276fc38188a96fd
- TLSH
  T1BF01C81D205193BF4C4102D23B87A1DEF2262657A9ECA460001DBB6E660BD7A3AF28D4
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral29 behavioral30
- Target
  service.sh
- Size 855B
- SHA256 38636a01df5fe81081678ba6da22de247baaf42461b8f507abeb533ff8750288
- MD5 a0da5aefefab53012f89bd0da6f99b15
- SHA1 b4fae27b175849f4ec584db515de392f4ffbaf5f
- SHA512 92d954fed5df8615f86674a0014e9a733e46f8c7c9935e9c5dc323c992a39c9ed1e9532c12a8a9c840a52c2c90edbb8ecea0a5fde6fcb589f8f952a51ed010e1
- TLSH
  T16011CC1C6461E37F8C4102923A07B1EEF267665765E894B1101DAF9E620BC7A2AF78D4
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

MITRE ATT&CK Mobile v16

Initial Access

Execution

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Loads dropped Dex/Jar

MITRE ATT&CK Enterprise v16

MITRE ATT&CK Mobile v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32