Analysis
-
max time kernel
74s -
max time network
130s -
platform
android_x86 -
resource
android-x86-arm-20240624-en -
resource tags
androidarch:armarch:x86image:android-x86-arm-20240624-enlocale:en-usos:android-9-x86system -
submitted
29-06-2024 22:08
Static task
static1
Behavioral task
behavioral1
Sample
5c43c36704c0804497fda81174602e8ef049a2159309a7ed31685f1658bfc5e5.apk
Resource
android-x86-arm-20240624-en
Behavioral task
behavioral2
Sample
5c43c36704c0804497fda81174602e8ef049a2159309a7ed31685f1658bfc5e5.apk
Resource
android-x64-20240624-en
Behavioral task
behavioral3
Sample
5c43c36704c0804497fda81174602e8ef049a2159309a7ed31685f1658bfc5e5.apk
Resource
android-x64-arm64-20240624-en
General
-
Target
5c43c36704c0804497fda81174602e8ef049a2159309a7ed31685f1658bfc5e5.apk
-
Size
2.1MB
-
MD5
d02c8f836d7c5d118e009afd2f5fa0b7
-
SHA1
45572d9f76b1919b5c18ef8d406b5f758cc3f499
-
SHA256
5c43c36704c0804497fda81174602e8ef049a2159309a7ed31685f1658bfc5e5
-
SHA512
06e0de7f9dc5eb25b9e6a50ce1a6c5ccb06910536f4e2223adcf8acf1cdeffa1e98d7460b62949758f2c94421c5b2b9a623b6b0fda1f16902670a7e401bc2e07
-
SSDEEP
49152:6Fql0C3GNA34Nbh/4ezw4/q88QhmXdFMT1at3H95pFYtv4:v0JNA34NPw4y8nB1gdU4
Malware Config
Signatures
-
Loads dropped Dex/Jar 1 TTPs 6 IoCs
Runs executable file dropped to the device during analysis.
Processes:
com.govkrportalmai.co.kr/system/bin/dex2oat --debuggable --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --debuggable --generate-mini-debug-info --dex-file=/data/user/0/com.govkrportalmai.co.kr/app_ui.App/newobfs/0.pobfs --output-vdex-fd=43 --oat-fd=44 --oat-location=/data/user/0/com.govkrportalmai.co.kr/app_ui.App/newobfs/oat/x86/0.odex --compiler-filter=quicken --class-loader-context=&/system/bin/dex2oat --debuggable --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --debuggable --generate-mini-debug-info --dex-file=/data/user/0/com.govkrportalmai.co.kr/app_ui.App/newobfs/1.pobfs --output-vdex-fd=43 --oat-fd=44 --oat-location=/data/user/0/com.govkrportalmai.co.kr/app_ui.App/newobfs/oat/x86/1.odex --compiler-filter=quicken --class-loader-context=&ioc pid process /data/user/0/com.govkrportalmai.co.kr/app_ui.App/newobfs/0.pobfs 4310 com.govkrportalmai.co.kr /data/user/0/com.govkrportalmai.co.kr/app_ui.App/newobfs/0.pobfs 4337 /system/bin/dex2oat --debuggable --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --debuggable --generate-mini-debug-info --dex-file=/data/user/0/com.govkrportalmai.co.kr/app_ui.App/newobfs/0.pobfs --output-vdex-fd=43 --oat-fd=44 --oat-location=/data/user/0/com.govkrportalmai.co.kr/app_ui.App/newobfs/oat/x86/0.odex --compiler-filter=quicken --class-loader-context=& /data/user/0/com.govkrportalmai.co.kr/app_ui.App/newobfs/0.pobfs 4310 com.govkrportalmai.co.kr /data/user/0/com.govkrportalmai.co.kr/app_ui.App/newobfs/1.pobfs 4310 com.govkrportalmai.co.kr /data/user/0/com.govkrportalmai.co.kr/app_ui.App/newobfs/1.pobfs 4362 /system/bin/dex2oat --debuggable --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --debuggable --generate-mini-debug-info --dex-file=/data/user/0/com.govkrportalmai.co.kr/app_ui.App/newobfs/1.pobfs --output-vdex-fd=43 --oat-fd=44 --oat-location=/data/user/0/com.govkrportalmai.co.kr/app_ui.App/newobfs/oat/x86/1.odex --compiler-filter=quicken --class-loader-context=& /data/user/0/com.govkrportalmai.co.kr/app_ui.App/newobfs/1.pobfs 4310 com.govkrportalmai.co.kr -
Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
-
Queries the phone number (MSISDN for GSM devices) 1 TTPs
-
Reads the contacts stored on the device. 1 TTPs 1 IoCs
Processes:
com.govkrportalmai.co.krdescription ioc process URI accessed for read content://com.android.contacts/contacts com.govkrportalmai.co.kr -
Acquires the wake lock 1 IoCs
Processes:
com.govkrportalmai.co.krdescription ioc process Framework service call android.os.IPowerManager.acquireWakeLock com.govkrportalmai.co.kr -
Queries information about active data network 1 TTPs 1 IoCs
Processes:
com.govkrportalmai.co.krdescription ioc process Framework service call android.net.IConnectivityManager.getActiveNetworkInfo com.govkrportalmai.co.kr -
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
Processes:
com.govkrportalmai.co.krdescription ioc process Framework service call com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone com.govkrportalmai.co.kr -
Reads information about phone network operator. 1 TTPs
-
Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
Processes:
com.govkrportalmai.co.krdescription ioc process Intent action android.settings.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS com.govkrportalmai.co.kr -
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
Processes:
com.govkrportalmai.co.krdescription ioc process Framework service call android.app.IActivityManager.registerReceiver com.govkrportalmai.co.kr -
Schedules tasks to execute at a specified time 1 TTPs 1 IoCs
Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.
Processes:
com.govkrportalmai.co.krdescription ioc process Framework service call android.app.job.IJobScheduler.schedule com.govkrportalmai.co.kr
Processes
-
com.govkrportalmai.co.kr1⤵
- Loads dropped Dex/Jar
- Reads the contacts stored on the device.
- Acquires the wake lock
- Queries information about active data network
- Queries the mobile country code (MCC)
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Schedules tasks to execute at a specified time
-
/system/bin/dex2oat --debuggable --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --debuggable --generate-mini-debug-info --dex-file=/data/user/0/com.govkrportalmai.co.kr/app_ui.App/newobfs/0.pobfs --output-vdex-fd=43 --oat-fd=44 --oat-location=/data/user/0/com.govkrportalmai.co.kr/app_ui.App/newobfs/oat/x86/0.odex --compiler-filter=quicken --class-loader-context=&2⤵
- Loads dropped Dex/Jar
-
/system/bin/dex2oat --debuggable --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --debuggable --generate-mini-debug-info --dex-file=/data/user/0/com.govkrportalmai.co.kr/app_ui.App/newobfs/1.pobfs --output-vdex-fd=43 --oat-fd=44 --oat-location=/data/user/0/com.govkrportalmai.co.kr/app_ui.App/newobfs/oat/x86/1.odex --compiler-filter=quicken --class-loader-context=&2⤵
- Loads dropped Dex/Jar
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
/data/data/com.govkrportalmai.co.kr/app_ui.App/newobfs/0.pobfsFilesize
2.8MB
MD57836185dc8f50d2ae39579357670b7c7
SHA1b4376ebd25ea7c0809abe721d40211cab97de42e
SHA25682977663278b0daa56cd178e87b7ab2e3621b8147aa6743f79c35891893fc9d1
SHA51274e9ba302e1497911bcbf55c62527f441f9c3a51dfd2b098faeb8adc9f039744c401404b48fb7ce6c5ad526075ea2a7722aae17230fc1c468d2b1bf3d586706d
-
/data/data/com.govkrportalmai.co.kr/app_ui.App/newobfs/1.pobfsFilesize
382KB
MD506bce5cb2abeb69d44848841b12b3be0
SHA1563363c3f987e9f2ee8dab58ddc33f1be93e802f
SHA256aea6ffef21ee597a275d2a88051a9d22f25655475b4e98dd62d31f6574f9f742
SHA5121bb8992c59a727fdcd4f7bf7782f50b634fdb6c31687cb10414d60c97f4f1f1ca90d9d5cd3ffec149a43628c5678bb97455e7dc69e8995937d33f0872920604d
-
/data/data/com.govkrportalmai.co.kr/files/configFilesize
92B
MD52957afdecb5926ac707b0a3f80dd4f39
SHA1ce7c618cfada9a071803a2bcb90e3adda0e12e3c
SHA25689954fd301f257e5e4639ebe7b40e5932def1627cc1e0788e0042903900aba91
SHA512def0720594717e19769ae3e939036b7ca79a8ee227193b7cf2ff886bad5d01ebe5523533d678097ac569a7b9418cf89e01c876176d4bfe0700a07049bce22b93
-
/data/data/com.govkrportalmai.co.kr/files/configFilesize
90B
MD5a78e48a137f39ef5a01cf091eb2aa2f7
SHA1840a65203facb2b539d803b857b1a59d8c1c7937
SHA256eb8889e4f023d20b0dbbd53396b4eaddc07c693c3ddb050170962d14bc96fba9
SHA5125ec4612dbf21c20fdce6e152dedd7f23e97d2013cc5db7444f965104b6d90ed4326ef4b879e64d7a7e0f2e14f38e4f41e0be5e3e5d7618692e09e55125c4dab4