735e32509624421703a5b2abacbea655785e66ceadb51dcf5ff44b35075b4ef1

Sharing

Copy URL Twitter E-mail

General

Target
LSPosed-v1.9.1_mod-7145-zygisk-release.zip
Size 2.5MB
Sample261029-3vls2acg36
SHA256 735e32509624421703a5b2abacbea655785e66ceadb51dcf5ff44b35075b4ef1
MD5 ff56cace043bc1e6a157810c02e70742
SHA1 1030e9dcffe304b485f46cb074203b5813aca3b7
SHA512 285c02d69deab40f7d9f1bdb5e640e78452abd298123a9560162e9a8b0079daa20a8598f60b778ecec5d74ffc9ec00cf387b1d441abb06113577d1bc7bb8990b
SSDEEP 49152:MH4DAR9AqgVRpXOX5eh+Xg0FGc4G6qG17+uBvYONpzEccUH2QQX82DHDxTE:MHwAR7g3pXOX7RFG3bxAmcUH2QA8SH1Y
TLSH
T140C5332871F94057FC804D78E9EEF116789F5A806F70D22B92C90EC7A2259D127B2F9D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Targets

- Target
  bin/arm64-v8a/dex2oat
- Size 6KB
- SHA256 67a81660c021af948abbfa069f3aec753e971ed2463b5db144abb051ebcf083a
- MD5 3683aa993ebb9f325e7ba55c34b802c3
- SHA1 098515ba54ed29de0c7eb64a01740da6f491be77
- SHA512 b139d2ce3cbf5832932a1c83ff7ba524d184effa47dec5e11f7da466b4eedcb6745663c4e0d5206cad7a4c0250232f7379dfe0e0cc352d0f7162778ceec27142
- SSDEEP 48:Fy9i82y2CilpXBwmB6SZywc2jzBWb5iI4ZKfcMiKg/C:yd2CirCUhZyo0bx4BMiKg/C
- TLSH
  T14AD14446FF83CA7BD89A033454B70374B6759098A7865303BB0DB6282A233CD789578F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral1 behavioral2 behavioral3 behavioral4
- Target
  bin/armeabi-v7a/dex2oat
- Size 4KB
- SHA256 06e119c3cabd5bde69c629fc5433efd99f19e5208979f0c0e2c8a0220c6a9450
- MD5 2aff60df7e5d92d5f89c930d4f839393
- SHA1 d49d4d09db1f61a0d2ab107f7816037274a0dc6e
- SHA512 1239c1f19135734bbbddf689eb115ce7ddf9a775f50214524f79a4ce1e54663bb0f3c96187dd1986fca4f3b5e62ce473c3dbdca7fafb40c989ee49badf3dab64
- SSDEEP 96:ZPXRd2CiwfUhLoOqTnKfgLsRl/KB/tAX:NhswpnKfgL4/6/
- TLSH
  T16F912DC6F751CC63D8FE0237600703F43539D881D6BB6B23A68C37796D422ACA961789
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral5
- Target
  bin/x86/dex2oat
- Size 4KB
- SHA256 6a8a0e39539aef9afb9b99e05dfddb7a750079043556f04782089f6d39634233
- MD5 33810e80f0df393ecf6fb8b232ef664f
- SHA1 2fe556ceae3fbedeceec931538c9e9b6b9035de5
- SHA512 3c3e130c79324d880fcb778dd2fdf8303fd72c8b314215fdb387719ccf89e9312af99360bcb8ad1968d2fc8cd6a2fe33a224b94990b5ba20d4364dc1cc5ddf5e
- SSDEEP 96:86Mszd2CiXvFUhCxaJHX3Qa/0ce3KyLkroCl8Si:8+sratX3QgWKZ
- TLSH
  T1E4918443B7559A2FE2FE0738009B0769E032D420B7C3831377497B496872A98DA227DE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral6
- Target
  bin/x86_64/dex2oat
- Size 5KB
- SHA256 c739392819df2b4bb2141db27c8202657edbffc183b97f87466f2664e9b17752
- MD5 f25aebc75d7edd94cee28fdd2acad5d3
- SHA1 9cb012e24084802a28bd7d91755c9f60e3370579
- SHA512 697fe4497dfd656c9aedb4691da3bae1655147d34337a6a0a270ce64834701ebc0f5c2e72375c44771bc4902b9d95137590677b0bb28f6a5354fa16f8e0efcde
- SSDEEP 96:Rvyd2CiQ9NUhWPgz7GbrCx+Hveu+Xx48IMaQ6iH:R6sQ9HgXmutLXx4T+
- TLSH
  T15FC13207B7468B2FDC9C033098BB02787730A88EEB424717270576786DB2758D6966DE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral7
- Target
  cli
- Size 517B
- SHA256 16b88d9220c5c8c5f10a19434bf20249a4fe164eb6feaca98c12a23e22ed6660
- MD5 267a919a760dd9833447a5c4877e76bf
- SHA1 d2a284dbe3c69c6a9459267b8007334995592963
- SHA512 a7954360f9b56328faf1141d55f190e324df4d414a0271c0a8244394dd8c1ea01f8502180a523dd4b77d5dcae44982dfdd69b036bbb2d8773283c001240c125b
- TLSH
  T1E3F09E1D222D536F602BE3B86802CC7B0AF84FFB28649C24340D708E1F02239E9F56D5
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral10 behavioral11 behavioral8 behavioral9
- Target
  customize.sh
- Size 6KB
- SHA256 edc9027aa0fc3f2a6de0c151782fdd1834a966a62b9068fb2c76494d7f3a964e
- MD5 00e0732ff0d82a53fec80f1299aeb4da
- SHA1 72cb4f5e01c83f72d823f6610923f9b545932527
- SHA512 9f97e8283f6e4135ccd6a1b935eb94be5fc4fea4611859759b1c0ca11a761326d332ad32793f911ec3edb0cb3d56f86249adf246c2892e19744c4dae770da513
- SSDEEP 192:5pKbIkVQzEeuEKUDSjuowIxcmxGtaoQSzh9:5pKbUgjuowI3s9
- TLSH
  T113E12045B1E29DB967ED2940C04219C5B2789FA24E9E3860FD9CF8FC9F3E17059363A4
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral12 behavioral13
- Target
  daemon
- Size 1KB
- SHA256 d16678f691244fffc51cee3948e85da557e3e4a13deed09b014255c86511e439
- MD5 c7d665cc617ea3371c7adcbdb0cee86b
- SHA1 ef215a2291cbcfbf329d19966d41024b8154e6cf
- SHA512 3fc2abb3b8a02b821f012e0eb747a6340e30fa15bb351bb6381c0f52e5e0054ea918d5e7fde670f39b90718d273905f83c93bacafe3e6f504b60c6b539eba8b4
- TLSH
  T1AD210238218EE3B21AEB65E168415084A3B5A23B56801420B45BBEC13B2B71FE4E3E49
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral14 behavioral15 behavioral16 behavioral17
- Target
  daemon.apk
- Size 563KB
- SHA256 b6ee14d702279b5a76d14cc736ae3daf73427d2a7f4960576a179b7dbb3060dc
- MD5 d4b6fd60c32706ac72adb725c453ac0b
- SHA1 83c5e9fa15b4db606edc7bbe8e725d8358fb21fc
- SHA512 2ba0e55d300f86452ae561e2d3f3b2a5671bdcf190a77fbf5eef72a8032919fc1e482db80a2527071010de40dfd37075736d222b19d80c0b2dd0cae3fcb891d2
- SSDEEP 12288:FqnX97H4EW21Wg2jMZYPGo2xDBI7XZgvCq9yH3aFBRGm6+kV:En9H4EWiNuPgx17vCq9AabRG/+kV
- TLSH
  T167C4E007AECC81BDC4B2817D1D676333EA36BC55572383538B086A39AA633E89F447D5
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral18
- Target
  lib/arm64-v8a/liblspd.so
- Size 190KB
- SHA256 cbad8e181d0af6ad91bc5e1f109e474ec88fbc0781075eddf07b5c193a787150
- MD5 9884edaf023014d3050acc810e105130
- SHA1 d2ab9debd24a7e64c6385dd27da357d57ac32cdf
- SHA512 0487330a7fb29f24f385574f93494f1f8ac5f20a1dc8194e821e5f692db1665a7cbc98c42bd40db6c1df4ced32660b79635cdcc4019d6fe90ca99cab2299833b
- SSDEEP 3072:mjRtUmMI13ZRugc+NAX25PC3MkcLSiCm5aNJgv+/5SV/5Lw9Fdt+496uDlFRa:mNtEIRZRugc+NquPC3JaVgJgv+X9R+4y
- TLSH
  T160147E5BA52C9C32E5CAF4BC5D9142B07432396C4360C3BA1E37462DD69E6E0BF16F62
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral19 behavioral20 behavioral21 behavioral22
- Target
  lib/armeabi-v7a/liblspd.so
- Size 150KB
- SHA256 c1c0b456ad59136fd44e7757e1449469cfa0b7466c46c00fbf515e49eca47fc4
- MD5 c120677327907cdde4f7080b723e52be
- SHA1 102e5cf6f6d63f7ba141f31d0bb9e4bac30b6c3c
- SHA512 4732eb0fb4b4bbebca9453bdb5736169ab7b6616a19fd7586204f0eb517900ba540be7460cfb10a251b740f20b17f513eb6681570554c3bf9699a51bebd0060e
- SSDEEP 3072:4cPvo4xFWL2P2ToXZN/ghq6r4LhjQFCiAqCpZ:4w2C6M/Hi49QFn
- TLSH
  T18DE3D0C3A5448106E6DEC43E3E120E825D38DC6877EA57DA6B88B8397E7E314DF252C5
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral23
- Target
  lib/x86/liblspd.so
- Size 221KB
- SHA256 d1d50f3c5972d62af4d55f721ce8971190b4a041b3861399f87230223aff5d26
- MD5 aa5cf4a60261a933c73e5fbdf0dc6d6b
- SHA1 1be731839a6b90e49f042e35fdfa91205d845c48
- SHA512 2b9976dc68cbccb8287dc68f4ffb5cc11f362a6934dc6a6e9e95a3f694c5f356314e7c53c2176ce55848e4febfcfd17a2b07a699e040eab54013aae8a4457415
- SSDEEP 6144:Q47c+Cu10rwtNQbE3T+mb2C9tvjjxfQP:Rc+Cu10rwvbT+mLJ/xg
- TLSH
  T117247D01EAC24AF5D45B25F9116FDB3EDE392513DC36C606EB85DE2AD433221CB291E8
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral24
- Target
  lib/x86_64/liblspd.so
- Size 234KB
- SHA256 f34df875722993e7a63ec53e6ff0cffefb7670cccbe715b065cdb3ef2452b137
- MD5 412cbbe1ef38c3baaedfd4c4357f7064
- SHA1 686ccc8a88cffe0072c1bf25629bad9d66b03d6e
- SHA512 7d8b3412a964e0e037b3aed0ecce088480a3e175e11f68cb44607cf519aaa96db6d189581aac222cc324bab93f3659236ac6ec5a52d90924815787b1dae9f7c4
- SSDEEP 6144:ITer++1gkej26fralZzaw6FHeSkDMjnf:IV1jXanziFHTzf
- TLSH
  T1E4343A13AAC508BDECECE278479BD13FE631B043D614F21B2B949B061E67F54971A782
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral25
- Target
  manager.apk
- Size 2.6MB
- SHA256 b6cef92c8313499fa18d64e5e1860113e000df82e785c425f9f509266a4666e8
- MD5 b5eb86a421690a8a09400917c39cf0a2
- SHA1 d561eff8aeeacf37b5b818641c3b4fb0dc543260
- SHA512 0987384bc20af02aba00432135256d119c1d15c42ded32782a7b54ef668dca0f421610bfaabfbbde7f1ec8f2c3215cca1ea001a2c78f3a3fecb7f4a5f1e92911
- SSDEEP 49152:fPwjqZ7H2v16NqzgOVGcsGyEnbPegp1uJStM58GDtRsKp:3wjqZT2vDtVGnAJosKp
- TLSH
  T183C5AEAEF79A192EC4BA01FA4C75A276239B5C100A53A7773944331C2C775FC0F98AD9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

persistence evasion
- Loads dropped Dex/Jar
  Runs executable file dropped to the device during analysis.
  evasion
behavioral26 behavioral27 behavioral28
- Target
  post-fs-data.sh
- Size 806B
- SHA256 44a248b6eceb46dbf0bd659cb5eb385b9a8e78843fe0b99abc9e13ceee5f418b
- MD5 bcee103ef3bf6130f9fd09908c3e95f2
- SHA1 18ee96b78ec57cf24267eb8947bc26928ed2d7b5
- SHA512 f1feca4f8b877ece71d80fb4671964b3fe249d2c0e0d01641ef31ee959372bcbec8b645112c24e6f1c70e72a1097f259ca961ed7952901e176f93ebcd48ee4fd
- TLSH
  T19601EB1D2011C3BF4C4002D13B47A1DEF2262257A5ECA460000DBB6E660BC7A3AF38D4
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral29 behavioral30
- Target
  service.sh
- Size 855B
- SHA256 38636a01df5fe81081678ba6da22de247baaf42461b8f507abeb533ff8750288
- MD5 a0da5aefefab53012f89bd0da6f99b15
- SHA1 b4fae27b175849f4ec584db515de392f4ffbaf5f
- SHA512 92d954fed5df8615f86674a0014e9a733e46f8c7c9935e9c5dc323c992a39c9ed1e9532c12a8a9c840a52c2c90edbb8ecea0a5fde6fcb589f8f952a51ed010e1
- TLSH
  T16011CC1C6461E37F8C4102923A07B1EEF267665765E894B1101DAF9E620BC7A2AF78D4
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

MITRE ATT&CK Mobile v16

Initial Access

Execution

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Loads dropped Dex/Jar

MITRE ATT&CK Enterprise v16

MITRE ATT&CK Mobile v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32