0c97ebf202351d579c1151ea79edadb1195bb5b8823b7d73b600b15f4f13eb8a

Analysis

max time kernel
129s
max time network
137s
platform
android_x86
resource
android-x86-arm-20240624-en
resource tags

androidarch:armarch:x86image:android-x86-arm-20240624-enlocale:en-usos:android-9-x86system
submitted
05-07-2024 01:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0c97ebf202351d579c1151ea79edadb1195bb5b8823b7d73b600b15f4f13eb8a.apk
Size

9KB
MD5

2525745bb64d1284716f7d00726a2fb0
SHA1

87ea1828f7bf3c7c675a8ef7b5b39f0d72a49a4a
SHA256

0c97ebf202351d579c1151ea79edadb1195bb5b8823b7d73b600b15f4f13eb8a
SHA512

53d79f0af347da64fc524bf144911ea9afbb01d56083548db58dc2a11d7c0581e4475472197855164c1215865825b1f3f2ab8b05f02dbf1ee5456c380f24eea4
SSDEEP

192:0Lt7+5Nihm1esfNn5ipBQVDG399zdlPkluTgPdD1IexT0wlbNhSv:0LtVhm1eszi/QdG3vhl8l+IdDaex7PQv

Score

7^/10

evasion impact

Malware Config

Signatures

Loads dropped Dex/Jar 1 TTPs 4 IoCs

Runs executable file dropped to the device during analysis.

evasion

T1407

Processes:

/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.metasploit.stage/files/v2s2rp.jar --output-vdex-fd=45 --oat-fd=46 --oat-location=/data/user/0/com.metasploit.stage/files/oat/x86/v2s2rp.odex --compiler-filter=quicken --class-loader-context=&com.metasploit.stage/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.metasploit.stage/files/met.jar --output-vdex-fd=45 --oat-fd=46 --oat-location=/data/user/0/com.metasploit.stage/files/oat/x86/met.odex --compiler-filter=quicken --class-loader-context=&

ioc	pid	process
/data/user/0/com.metasploit.stage/files/v2s2rp.jar	4275	/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.metasploit.stage/files/v2s2rp.jar --output-vdex-fd=45 --oat-fd=46 --oat-location=/data/user/0/com.metasploit.stage/files/oat/x86/v2s2rp.odex --compiler-filter=quicken --class-loader-context=&
/data/user/0/com.metasploit.stage/files/v2s2rp.jar	4213	com.metasploit.stage
/data/user/0/com.metasploit.stage/files/met.jar	4299	/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.metasploit.stage/files/met.jar --output-vdex-fd=45 --oat-fd=46 --oat-location=/data/user/0/com.metasploit.stage/files/oat/x86/met.odex --compiler-filter=quicken --class-loader-context=&
/data/user/0/com.metasploit.stage/files/met.jar	4213	com.metasploit.stage

Acquires the wake lock 1 IoCs

Processes:

com.metasploit.stage

description ioc process

Framework service call android.os.IPowerManager.acquireWakeLock com.metasploit.stage
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
impact

T1471

Processes:

com.metasploit.stage

description ioc process

Framework API call javax.crypto.Cipher.doFinal com.metasploit.stage

description	ioc	process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.metasploit.stage

description	ioc	process
Framework API call	javax.crypto.Cipher.doFinal	com.metasploit.stage

com.metasploit.stage
1⤵
- Loads dropped Dex/Jar
- Acquires the wake lock
- Uses Crypto APIs (Might try to encrypt user data)
PID:4213

/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.metasploit.stage/files/v2s2rp.jar --output-vdex-fd=45 --oat-fd=46 --oat-location=/data/user/0/com.metasploit.stage/files/oat/x86/v2s2rp.odex --compiler-filter=quicken --class-loader-context=&
2⤵
- Loads dropped Dex/Jar
PID:4275

/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.metasploit.stage/files/met.jar --output-vdex-fd=45 --oat-fd=46 --oat-location=/data/user/0/com.metasploit.stage/files/oat/x86/met.odex --compiler-filter=quicken --class-loader-context=&
2⤵
- Loads dropped Dex/Jar
PID:4299

id
2⤵
PID:4325

getprop ro.build.version.release
2⤵
PID:4345

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.metasploit.stage/files/met.jar
Filesize
67KB

MD5
281c9d5a4014bb0c340f84ed47e2ed0d

SHA1
4bbee90fcc1ba4271806769df315a80559863313

SHA256
c908fc3f589e5f8589ca7698462f0b08383887a331f792d19effa12c2b1282aa

SHA512
96b3aaa3e04ddd3cfd376e1b41b83fa4a39416e1197d43de75b52c10132240f5da6ed35c6fddece5f2c1efb077c6560d2c45d512aa1bac5ca2b0b6b638ea58f7

Download Submit
/data/data/com.metasploit.stage/files/v2s2rp.jar
Filesize
1KB

MD5
dbbd51eee2aac8a8d440f5bb9aafdce3

SHA1
6c2f4df910ab38fcab2d2abc18a7021d25ce9bcc

SHA256
02e2b9b1c8e04cd09054dde4df5260ef33574fb1b6106659c23ae36c5f49603d

SHA512
8db4da89e0633336a88ccfde568b48c8818a2ecdf6c60db76118006cf07502292d9b788d01d774db6be4dd7031cb61cef2aa9d497259048c168b8244f6fa757f

Download Submit
/data/user/0/com.metasploit.stage/files/met.jar
Filesize
159KB

MD5
4a87713e17052e324c77abe59d4cb325

SHA1
5eec2e6d727d1058aa7d16facd939d540e354fbb

SHA256
10a09810f24fbe1b2bbcc23c787d97a7f730c9b7e97c86007da311147de0e344

SHA512
0976acaf3d20226d3aa0beda9eaaeb97afffdd9a3a2ca2a8655dddf69b2c5a04c7a0eb4b3fd232946529409dfb4a1e0bc6e234334bc030bd4e76966e3b3e2048

Download Submit
/data/user/0/com.metasploit.stage/files/met.jar
Filesize
159KB

MD5
402d99e71a07ce7abbcf636dea997f11

SHA1
403cda18669e038b75176c175af004753515c60f

SHA256
fdf8db5a29fce18bf80acd3dec49c30ab7962038ebdff2c7ed9b0a413550d6dc

SHA512
a3a6251bedb46cfb02cb151557d498fc48ee6dec5a6546badef7a8f501de57527dcf1fa6b67ec459ecd394ce9258734b4e43ac088e5b19fd9d7f98cac4c99399

Download Submit
/data/user/0/com.metasploit.stage/files/v2s2rp.jar
Filesize
2KB

MD5
43bdd6c3b9f9dbb3739cb2a0105c2b67

SHA1
85ea490fc77c2aa39c8d71d21fa2f9de6f326897

SHA256
35cb7160d9ae3fb328eb6e87abdd8dfc896c915d31b0efbdd9768e7a4094ad47

SHA512
a2081fdb9ab02725dfee3acaf47699243933d21af2265e5a3b3e08dec98933d588d770ae3c5ed63862931fd9829623c11e80aac9b5ea1e1d82b54ae108b5d5dd

Download Submit
/data/user/0/com.metasploit.stage/files/v2s2rp.jar
Filesize
2KB

MD5
cfb84ada25534b7e1c598210f1b4a23b

SHA1
f6f735f682eca65554e593a026fe26c75ece7f1d

SHA256
5fbca4c9e95c21192b6c0669962b78363bef0a587702b1bc01b1c1e081d34be0

SHA512
2c8c662aec53796c2bb661cefc9e49fc3d66c7e51b02f5add63725fca7ee64ea357dfc0a6d0bf0d1457cbf0b412de7a571374f94d771168b9a2fea0b0b847372

Download Submit