Edit tour

Windows Analysis Report
#U0424#U043e#U0442#U043a#U0438_#U0410#U043b#U0438_16.zip

Overview

General Information

Sample Name:	#U0424#U043e#U0442#U043a#U0438_#U0410#U043b#U0438_16.zip (renamed file extension from apk to zip, renamed because original name is a hash value)
Original Sample Name:	__16.apk
Analysis ID:	1352009
MD5:	ae20248c420c92dfca679c5098071df5
SHA1:	598fae3c2c7a40b137e2208bf064a181636e55f1
SHA256:	91f82850f2a80e724edd7268980f941fcb35b9952463717cd072e1fe0818e35f
Tags:	apkBankersmsagent
Infos:

Detection

Score:	48
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Multi AV Scanner detection for submitted file

May sleep (evasive loops) to hinder dynamic analysis

Creates a process in suspended mode (likely to inject code)

Contains long sleeps (>= 3 min)

Classification

Process Tree

System is w10x64

unarchiver.exe (PID: 6148 cmdline: C:\Windows\SysWOW64\unarchiver.exe" "C:\Users\user\Desktop\#U0424#U043e#U0442#U043a#U0438_#U0410#U043b#U0438_16.zip MD5: 16FF3CC6CC330A08EED70CBC1D35F5D2)

7za.exe (PID: 5760 cmdline: C:\Windows\System32\7za.exe" x -pinfected -y -o"C:\Users\user\AppData\Local\Temp\4z0mgimv.2wq" "C:\Users\user\Desktop\#U0424#U043e#U0442#U043a#U0438_#U0410#U043b#U0438_16.zip MD5: 77E556CDFDC5C592F5C46DB4127C6F4C)

conhost.exe (PID: 4948 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cleanup

Joe Sandbox Signatures

• AV Detection
• Compliance
• Networking
• System Summary
• Hooking and other Techniques for Hiding and Protection
• Malware Analysis System Evasion
• Anti Debugging
• HIPS / PFW / Operating System Protection Evasion
• Language, Device and Operating System Detection

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: #U0424#U043e#U0442#U043a#U0438_#U0410#U043b#U0438_16.zip

Virustotal: Detection: 26%

Perma Link

Source: C:\Windows\SysWOW64\unarchiver.exe

File opened: C:\Windows\WinSxS\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.9672_none_d08f9da24428a513\MSVCR80.dll

Jump to behavior

Source: classes2.dex.2.dr	String found in binary or memory: http://&http://code.google.com/p/a2dp-connect/
Source: classes2.dex.2.dr	String found in binary or memory: http://code.google.com/p/a2dp-connect/
Source: classes2.dex.2.dr	String found in binary or memory: http://developer.android.com/reference/
Source: zzz_tasker122.xml.2.dr, zzz_tasker___adaptive___foreground.xml.2.dr, zzz_tasker220.xml.2.dr, zzz_tasker210.xml.2.dr, zzz_tasker112.xml.2.dr, zzz_adaptive___background_1.xml.2.dr, cust_notification.xml.2.dr, zzz_tasker121.xml.2.dr, zzz_tasker111.xml.2.dr, zzz_tasker021.xml.2.dr, zzz_tasker011.xml.2.dr, zzz_tasker110.xml.2.dr, zzz_tasker___adaptive___monochrome.xml.2.dr, zzz_tasker212.xml.2.dr, zzz_tasker010.xml.2.dr, zzz_adaptive___background.xml.2.dr	String found in binary or memory: http://schemas.android.com/aapt
Source: codeselect_item.xml.2.dr	String found in binary or memory: http://schemas.android.com/apk/res/android
Source: AndroidManifest.xml.2.dr	String found in binary or memory: http://schemas.android.com/tools
Source: classes2.dex.2.dr	String found in binary or memory: http://securesettings.intangibleobject.com/
Source: classes2.dex.2.dr	String found in binary or memory: http://securesettings.intangibleobject.com/8http://steelgirderdev.com/steelgirderdev/gvsettings.html
Source: classes2.dex.2.dr	String found in binary or memory: http://steelgirderdev.com/steelgirderdev/gvsettings.html
Source: classes2.dex.2.dr	String found in binary or memory: http://tasker.joaoapps.com/download.html
Source: classes2.dex.2.dr	String found in binary or memory: http://wiki.devmil.de/tiki-index.php
Source: classes2.dex.2.dr	String found in binary or memory: http://www.afterhoursdevelopers.com/applications/android/synker-android-sync-widget
Source: classes2.dex.2.dr	String found in binary or memory: http://www.tacit.dk/foldersync
Source: classes2.dex.2.dr	String found in binary or memory: http://zoom.dinglisch.net/
Source: classes2.dex.2.dr	String found in binary or memory: http://zoom.dinglisch.net/Zoom.apk
Source: classes2.dex.2.dr	String found in binary or memory: https://Ihttps://ajax.googleapis.com/ajax/libs/chrome-frame/1.0.2/CFInstall.min.js=https://ajax.goog
Source: classes2.dex.2.dr	String found in binary or memory: https://ajax.googleapis.com/ajax/libs/chrome-frame/1.0.2/CFInstall.min.js
Source: classes2.dex.2.dr	String found in binary or memory: https://ajax.googleapis.com/ajax/libs/dojo/1.7.2/dojo/dojo.js
Source: classes2.dex.2.dr	String found in binary or memory: https://ajax.googleapis.com/ajax/libs/ext-core/3.1.0/ext-core.js
Source: classes2.dex.2.dr	String found in binary or memory: https://ajax.googleapis.com/ajax/libs/jquery/1.7.2/jquery.min.js
Source: classes2.dex.2.dr	String found in binary or memory: https://ajax.googleapis.com/ajax/libs/jquery/1.7.2/jquery.min.jsFhttps://ajax.googleapis.com/ajax/li
Source: classes2.dex.2.dr	String found in binary or memory: https://ajax.googleapis.com/ajax/libs/jqueryui/1.8.18/jquery-ui.min.js
Source: classes2.dex.2.dr	String found in binary or memory: https://ajax.googleapis.com/ajax/libs/mootools/1.4.5/mootools-yui-compressed.js
Source: classes2.dex.2.dr	String found in binary or memory: https://ajax.googleapis.com/ajax/libs/prototype/1.7.0.0/prototype.js
Source: classes2.dex.2.dr	String found in binary or memory: https://ajax.googleapis.com/ajax/libs/scriptaculous/1.9.0/scriptaculous.js
Source: classes2.dex.2.dr	String found in binary or memory: https://ajax.googleapis.com/ajax/libs/swfobject/2.2/swfobject.js
Source: classes2.dex.2.dr	String found in binary or memory: https://ajax.googleapis.com/ajax/libs/swfobject/2.2/swfobject.js?https://ajax.googleapis.com/ajax/li
Source: classes2.dex.2.dr	String found in binary or memory: https://ajax.googleapis.com/ajax/libs/webfont/1.0.28/webfont.js
Source: data.xml.2.dr	String found in binary or memory: https://api.telegram.org
Source: classes2.dex.2.dr	String found in binary or memory: https://code.google.com/p/android-scripting/downloads/list
Source: classes2.dex.2.dr	String found in binary or memory: https://issuetracker.google.com/issues/141889136
Source: classes2.dex.2.dr	String found in binary or memory: https://issuetracker.google.com/issues/225186417
Source: classes2.dex.2.dr	String found in binary or memory: https://play.google.com/store/apps/details?id=com.asif.plugin.sendexpect
Source: classes2.dex.2.dr	String found in binary or memory: https://play.google.com/store/apps/details?id=com.balda.touchtask
Source: classes2.dex.2.dr	String found in binary or memory: https://play.google.com/store/apps/details?id=com.benfinnigan.wol
Source: classes2.dex.2.dr	String found in binary or memory: https://play.google.com/store/apps/details?id=com.codecarpet.apndroid.pro
Source: classes2.dex.2.dr	String found in binary or memory: https://play.google.com/store/apps/details?id=com.devuni.flashlight.tasklight
Source: classes2.dex.2.dr	String found in binary or memory: https://play.google.com/store/apps/details?id=com.hastarin.android.udpsender
Source: classes2.dex.2.dr	String found in binary or memory: https://play.google.com/store/apps/details?id=com.icecoldapps.screenshoteasy
Source: classes2.dex.2.dr	String found in binary or memory: https://play.google.com/store/apps/details?id=com.icecoldapps.serversultimate
Source: classes2.dex.2.dr	String found in binary or memory: https://play.google.com/store/apps/details?id=com.icecoldapps.synchronizeultimate
Source: classes2.dex.2.dr	String found in binary or memory: https://play.google.com/store/apps/details?id=com.joaomgcd.autocast
Source: classes2.dex.2.dr	String found in binary or memory: https://play.google.com/store/apps/details?id=com.joaomgcd.autoinput
Source: classes2.dex.2.dr	String found in binary or memory: https://play.google.com/store/apps/details?id=com.joaomgcd.autonotification
Source: classes2.dex.2.dr	String found in binary or memory: https://play.google.com/store/apps/details?id=com.joaomgcd.autoremote
Source: classes2.dex.2.dr	String found in binary or memory: https://play.google.com/store/apps/details?id=com.joaomgcd.autoshare
Source: classes2.dex.2.dr	String found in binary or memory: https://play.google.com/store/apps/details?id=com.joaomgcd.autoshortcut
Source: classes2.dex.2.dr	String found in binary or memory: https://play.google.com/store/apps/details?id=com.terdelle.twilight
Source: classes2.dex.2.dr	String found in binary or memory: https://play.google.com/store/apps/details?id=net.nurik.roman.dashclock
Source: classes2.dex.2.dr	String found in binary or memory: https://play.google.com/store/apps/details?id=org.kman.AquaMail
Source: classes2.dex.2.dr	String found in binary or memory: https://play.google.com/store/apps/details?id=pt.joaormf.mtkcontrol
Source: classes2.dex.2.dr	String found in binary or memory: https://play.google.com/store/apps/details?id=se.badaccess.locale.nfc
Source: actions.xml.2.dr	String found in binary or memory: https://schema.org/Text
Source: classes2.dex.2.dr	String found in binary or memory: https://tasker.joaoapps.com/cgi-bin/nph-validate.cgi
Source: classes2.dex.2.dr	String found in binary or memory: https://tasker.joaoapps.com/cgi-bin/nph-validate.cgi:
Source: classes2.dex.2.dr	String found in binary or memory: https://tasker.joaoapps.com/changes.html
Source: classes2.dex.2.dr	String found in binary or memory: https://tasker.joaoapps.com/guides.html
Source: classes2.dex.2.dr	String found in binary or memory: https://tasker.joaoapps.com/guides.html(https://tasker.joaoapps.com/privacy.html$https://tasker.joao
Source: classes2.dex.2.dr	String found in binary or memory: https://tasker.joaoapps.com/privacy.html
Source: classes2.dex.2.dr	String found in binary or memory: https://tasker.joaoapps.com/profiles
Source: classes2.dex.2.dr	String found in binary or memory: https://tasker.joaoapps.com/userguide
Source: classes2.dex.2.dr	String found in binary or memory: https://tasker.joaoapps.com/userguide/
Source: classes2.dex.2.dr	String found in binary or memory: https://tasker.joaoapps.com/userguide/en/faqs/faq-problem.html#00
Source: classes2.dex.2.dr	String found in binary or memory: https://tasker.joaoapps.com/userguide/en/matching.html
Source: classes2.dex.2.dr	String found in binary or memory: https://tasker.joaoapps.com/userguide/en/variables.html#html
Source: classes2.dex.2.dr	String found in binary or memory: https://tasker.joaoapps.com/userguide/en/variables.html#json
Source: classes2.dex.2.dr	String found in binary or memory: https://taskernet.com/shares/
Source: classes2.dex.2.dr	String found in binary or memory: https://youtu.be/OTLfQfeZRNQ
Source: classes2.dex.2.dr	String found in binary or memory: https://youtu.be/Oufvnh_9RD0
Source: classes2.dex.2.dr	String found in binary or memory: https://youtu.be/Uy4owfsBQKs
Source: classes2.dex.2.dr	String found in binary or memory: https://youtu.be/bCJ3A-PZf5k
Source: classes2.dex.2.dr	String found in binary or memory: https://youtu.be/gGa4OfxmlzU
Source: classes2.dex.2.dr	String found in binary or memory: https://youtu.be/gGa4OfxmlzU(https://youtu.be/pyUxrWArztc?tasker=true
Source: classes2.dex.2.dr	String found in binary or memory: https://youtu.be/pyUxrWArztc?tasker=true
Source: classes2.dex.2.dr	String found in binary or memory: https://youtu.be/rkQRH17H-DY
Source: classes2.dex.2.dr	String found in binary or memory: https://youtu.be/s6EAbLW5WSk

Source: #U0424#U043e#U0442#U043a#U0438_#U0410#U043b#U0438_16.zip

Virustotal: Detection: 26%

Source: C:\Windows\SysWOW64\unarchiver.exe

File created: C:\Users\user\AppData\Local\Temp\unarchiver.log

Jump to behavior

Source: C:\Windows\SysWOW64\unarchiver.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Windows\SysWOW64\unarchiver.exe	Section loaded: C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\276d7f4a20a3c21c3bf6fc9bfc1915a2\mscorlib.ni.dll	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Section loaded: C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sorttbls.nlp	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Section loaded: C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sortkey.nlp	Jump to behavior

Source: classification engine

Classification label: mal48.winZIP@4/514@0/0

Source: unknown	Process created: C:\Windows\SysWOW64\unarchiver.exe C:\Windows\SysWOW64\unarchiver.exe" "C:\Users\user\Desktop\#U0424#U043e#U0442#U043a#U0438_#U0410#U043b#U0438_16.zip
Source: C:\Windows\SysWOW64\unarchiver.exe	Process created: C:\Windows\SysWOW64\7za.exe C:\Windows\System32\7za.exe" x -pinfected -y -o"C:\Users\user\AppData\Local\Temp\4z0mgimv.2wq" "C:\Users\user\Desktop\#U0424#U043e#U0442#U043a#U0438_#U0410#U043b#U0438_16.zip
Source: C:\Windows\SysWOW64\7za.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\unarchiver.exe	Process created: C:\Windows\SysWOW64\7za.exe C:\Windows\System32\7za.exe" x -pinfected -y -o"C:\Users\user\AppData\Local\Temp\4z0mgimv.2wq" "C:\Users\user\Desktop\#U0424#U043e#U0442#U043a#U0438_#U0410#U043b#U0438_16.zip	Jump to behavior

Source: C:\Windows\System32\conhost.exe

Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4948:120:WilError_03

Source: C:\Windows\SysWOW64\unarchiver.exe

File opened: C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorrc.dll

Jump to behavior

Source: C:\Windows\SysWOW64\unarchiver.exe

File opened: C:\Windows\WinSxS\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.9672_none_d08f9da24428a513\MSVCR80.dll

Jump to behavior

Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Windows\SysWOW64\unarchiver.exe TID: 3008

Thread sleep time: -922337203685477s >= -30000s

Jump to behavior

Source: C:\Windows\SysWOW64\unarchiver.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

Source: C:\Windows\SysWOW64\unarchiver.exe

Code function: 0_2_00AAB286 GetSystemInfo,

0_2_00AAB286

Source: C:\Windows\SysWOW64\unarchiver.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

Source: C:\Windows\SysWOW64\unarchiver.exe

Memory allocated: page read and write | page guard

Jump to behavior

Source: C:\Windows\SysWOW64\unarchiver.exe

Process created: C:\Windows\SysWOW64\7za.exe C:\Windows\System32\7za.exe" x -pinfected -y -o"C:\Users\user\AppData\Local\Temp\4z0mgimv.2wq" "C:\Users\user\Desktop\#U0424#U043e#U0442#U043a#U0438_#U0410#U043b#U0438_16.zip

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact	Resource Development	Reconnaissance
Valid Accounts	Windows Management Instrumentation	Path Interception	11 Process Injection	1 Disable or Modify Tools	OS Credential Dumping	21 Virtualization/Sandbox Evasion	Remote Services	Data from Local System	Exfiltration Over Other Network Medium	Data Obfuscation	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Abuse Accessibility Features	Acquire Infrastructure	Gather Victim Identity Information
Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	21 Virtualization/Sandbox Evasion	LSASS Memory	3 System Information Discovery	Remote Desktop Protocol	Data from Removable Media	Exfiltration Over Bluetooth	Junk Data	SIM Card Swap	Obtain Device Cloud Backups	Network Denial of Service	Domains	Credentials
Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	11 Process Injection	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	Steganography			Data Encrypted for Impact	DNS Server	Email Addresses

Source	Detection	Scanner	Label	Link
#U0424#U043e#U0442#U043a#U0438_#U0410#U043b#U0438_16.zip	11%	ReversingLabs
#U0424#U043e#U0442#U043a#U0438_#U0410#U043b#U0438_16.zip	27%	Virustotal		Browse

Source	Detection	Scanner	Label
http://www.afterhoursdevelopers.com/applications/android/synker-android-sync-widget	0%	URL Reputation	safe
http://zoom.dinglisch.net/Zoom.apk	0%	URL Reputation	safe
http://zoom.dinglisch.net/	0%	URL Reputation	safe
https://taskernet.com/shares/	0%	URL Reputation	safe
http://wiki.devmil.de/tiki-index.php	0%	URL Reputation	safe
http://steelgirderdev.com/steelgirderdev/gvsettings.html	0%	URL Reputation	safe
http://steelgirderdev.com/steelgirderdev/gvsettings.html	0%	URL Reputation	safe
http://www.tacit.dk/foldersync	0%	URL Reputation	safe
http://securesettings.intangibleobject.com/	0%	URL Reputation	safe
http://&http://code.google.com/p/a2dp-connect/	0%	Avira URL Cloud	safe
http://securesettings.intangibleobject.com/8http://steelgirderdev.com/steelgirderdev/gvsettings.html	0%	Avira URL Cloud	safe

Name	Source	Malicious	Antivirus Detection	Reputation
https://tasker.joaoapps.com/userguide/en/variables.html#html	classes2.dex.2.dr	false		high
https://youtu.be/gGa4OfxmlzU	classes2.dex.2.dr	false		high
https://youtu.be/pyUxrWArztc?tasker=true	classes2.dex.2.dr	false		high
https://play.google.com/store/apps/details?id=com.devuni.flashlight.tasklight	classes2.dex.2.dr	false		high
https://api.telegram.org	data.xml.2.dr	false		high
https://play.google.com/store/apps/details?id=com.joaomgcd.autocast	classes2.dex.2.dr	false		high
https://youtu.be/OTLfQfeZRNQ	classes2.dex.2.dr	false		high
http://www.afterhoursdevelopers.com/applications/android/synker-android-sync-widget	classes2.dex.2.dr	false	URL Reputation: safe	unknown
http://&http://code.google.com/p/a2dp-connect/	classes2.dex.2.dr	false	Avira URL Cloud: safe	low
http://zoom.dinglisch.net/Zoom.apk	classes2.dex.2.dr	false	URL Reputation: safe	unknown
http://zoom.dinglisch.net/	classes2.dex.2.dr	false	URL Reputation: safe	unknown
https://play.google.com/store/apps/details?id=com.joaomgcd.autonotification	classes2.dex.2.dr	false		high
https://youtu.be/Oufvnh_9RD0	classes2.dex.2.dr	false		high
https://play.google.com/store/apps/details?id=com.codecarpet.apndroid.pro	classes2.dex.2.dr	false		high
https://play.google.com/store/apps/details?id=org.kman.AquaMail	classes2.dex.2.dr	false		high
https://play.google.com/store/apps/details?id=com.terdelle.twilight	classes2.dex.2.dr	false		high
https://play.google.com/store/apps/details?id=com.joaomgcd.autoinput	classes2.dex.2.dr	false		high
http://developer.android.com/reference/	classes2.dex.2.dr	false		high
http://code.google.com/p/a2dp-connect/	classes2.dex.2.dr	false		high
http://securesettings.intangibleobject.com/8http://steelgirderdev.com/steelgirderdev/gvsettings.html	classes2.dex.2.dr	false	Avira URL Cloud: safe	unknown
https://taskernet.com/shares/	classes2.dex.2.dr	false	URL Reputation: safe	unknown
http://tasker.joaoapps.com/download.html	classes2.dex.2.dr	false		high
https://schema.org/Text	actions.xml.2.dr	false		high
https://youtu.be/s6EAbLW5WSk	classes2.dex.2.dr	false		high
http://schemas.android.com/aapt	zzz_tasker122.xml.2.dr, zzz_tasker___adaptive___foreground.xml.2.dr, zzz_tasker220.xml.2.dr, zzz_tasker210.xml.2.dr, zzz_tasker112.xml.2.dr, zzz_adaptive___background_1.xml.2.dr, cust_notification.xml.2.dr, zzz_tasker121.xml.2.dr, zzz_tasker111.xml.2.dr, zzz_tasker021.xml.2.dr, zzz_tasker011.xml.2.dr, zzz_tasker110.xml.2.dr, zzz_tasker___adaptive___monochrome.xml.2.dr, zzz_tasker212.xml.2.dr, zzz_tasker010.xml.2.dr, zzz_adaptive___background.xml.2.dr	false		high
https://play.google.com/store/apps/details?id=pt.joaormf.mtkcontrol	classes2.dex.2.dr	false		high
http://wiki.devmil.de/tiki-index.php	classes2.dex.2.dr	false	URL Reputation: safe	unknown
https://tasker.joaoapps.com/userguide/	classes2.dex.2.dr	false		high
http://steelgirderdev.com/steelgirderdev/gvsettings.html	classes2.dex.2.dr	false	URL Reputation: safe URL Reputation: safe	unknown
https://play.google.com/store/apps/details?id=se.badaccess.locale.nfc	classes2.dex.2.dr	false		high
https://youtu.be/bCJ3A-PZf5k	classes2.dex.2.dr	false		high
https://play.google.com/store/apps/details?id=com.icecoldapps.screenshoteasy	classes2.dex.2.dr	false		high
https://tasker.joaoapps.com/privacy.html	classes2.dex.2.dr	false		high
https://play.google.com/store/apps/details?id=com.benfinnigan.wol	classes2.dex.2.dr	false		high
http://schemas.android.com/tools	AndroidManifest.xml.2.dr	false		high
https://play.google.com/store/apps/details?id=com.joaomgcd.autoremote	classes2.dex.2.dr	false		high
https://tasker.joaoapps.com/profiles	classes2.dex.2.dr	false		high
https://tasker.joaoapps.com/userguide/en/faqs/faq-problem.html#00	classes2.dex.2.dr	false		high
https://tasker.joaoapps.com/cgi-bin/nph-validate.cgi:	classes2.dex.2.dr	false		high
https://tasker.joaoapps.com/userguide/en/matching.html	classes2.dex.2.dr	false		high
https://tasker.joaoapps.com/userguide/en/variables.html#json	classes2.dex.2.dr	false		high
https://play.google.com/store/apps/details?id=com.hastarin.android.udpsender	classes2.dex.2.dr	false		high
https://tasker.joaoapps.com/guides.html(https://tasker.joaoapps.com/privacy.html$https://tasker.joao	classes2.dex.2.dr	false		high
http://www.tacit.dk/foldersync	classes2.dex.2.dr	false	URL Reputation: safe	unknown
https://play.google.com/store/apps/details?id=com.icecoldapps.serversultimate	classes2.dex.2.dr	false		high
https://play.google.com/store/apps/details?id=net.nurik.roman.dashclock	classes2.dex.2.dr	false		high
https://youtu.be/Uy4owfsBQKs	classes2.dex.2.dr	false		high
https://play.google.com/store/apps/details?id=com.balda.touchtask	classes2.dex.2.dr	false		high
https://youtu.be/gGa4OfxmlzU(https://youtu.be/pyUxrWArztc?tasker=true	classes2.dex.2.dr	false		high
https://tasker.joaoapps.com/changes.html	classes2.dex.2.dr	false		high
https://tasker.joaoapps.com/cgi-bin/nph-validate.cgi	classes2.dex.2.dr	false		high
https://youtu.be/rkQRH17H-DY	classes2.dex.2.dr	false		high
http://schemas.android.com/apk/res/android	codeselect_item.xml.2.dr	false		high
https://play.google.com/store/apps/details?id=com.joaomgcd.autoshortcut	classes2.dex.2.dr	false		high
https://issuetracker.google.com/issues/141889136	classes2.dex.2.dr	false		high
https://tasker.joaoapps.com/guides.html	classes2.dex.2.dr	false		high
https://code.google.com/p/android-scripting/downloads/list	classes2.dex.2.dr	false		high
https://play.google.com/store/apps/details?id=com.icecoldapps.synchronizeultimate	classes2.dex.2.dr	false		high
https://issuetracker.google.com/issues/225186417	classes2.dex.2.dr	false		high
http://securesettings.intangibleobject.com/	classes2.dex.2.dr	false	URL Reputation: safe	unknown
https://tasker.joaoapps.com/userguide	classes2.dex.2.dr	false		high
https://play.google.com/store/apps/details?id=com.joaomgcd.autoshare	classes2.dex.2.dr	false		high

Joe Sandbox Version:	38.0.0 Ammolite
Analysis ID:	1352009
Start date and time:	2023-12-02 11:27:22 +01:00
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 4m 30s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	11
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample file name:	#U0424#U043e#U0442#U043a#U0438_#U0410#U043b#U0438_16.zip (renamed file extension from apk to zip, renamed because original name is a hash value)
Original Sample Name:	__16.apk
Detection:	MAL
Classification:	mal48.winZIP@4/514@0/0
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 100% Number of executed functions: 46 Number of non-executed functions: 0

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	Android binary XML
Category:	dropped
Size (bytes):	12112
Entropy (8bit):	4.478837713001592
Encrypted:	false
SSDEEP:	192:wpwNmG+lie9FdxCe2RBf2YuIQH2zZeRdwI:wpeL+lZJxC23H2MRdwI
MD5:	922C88C6413E89984F21A5D98DE4460B
SHA1:	CA5855B5AAE291BE76ED92E85265E38CAF759EC4
SHA-256:	E2594F76C41919DA3B849E1A96B2D439C1CC6D78C20E4EC7C07004C644B16E5D
SHA-512:	48960B46537E79A749B32E137D7BC8805FCE0792928DF330B82D528CBE9FD09EF65ECD729D76674A62D42A8E728FEDF82E6FE02AC8D6FE4B1C763E7D734A0C8D
Malicious:	false
Reputation:	low
Preview:	....P/......................<.......................;...J...Z...i...v...........................................0...;...C...K...`...t...........................................5...B...M...V...d...z...................;...N...Y...k...................!...B...n...................)...L...o...................5...T...q.......................+...:...S..._...t...............................8...f...................0...g...................,...T...{................... ...L.......................:...C...U...............-...h...................)...N...m...........................0...:.....versionCode...versionName...installLocation...anyDensity...smallScreens...normalScreens...largeScreens...resizeable...xlargeScreens...minSdkVersion...targetSdkVersion...name...label...icon...debuggable...hardwareAccelerated...usesCleartextTraffic...networkSecurityConfig...requestLegacyExternalStorage...required...value...theme...finishOnTaskLaunch...clearTaskOnLaunch...stateNotNeeded...excludeFromRecents...launchMo

Process:	C:\Windows\SysWOW64\unarchiver.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	61530
Entropy (8bit):	5.2026311492796475
Encrypted:	false
SSDEEP:	192:QeZVdFJPw8HAUslQKNiF+spqb7g+NpOaCobQfYAM70sjatOheLW+TalZj1OIRh0N:KBNlcfhq4hMiCEYq
MD5:	613338BB1EDCEB5AF9682D29B9751378
SHA1:	914A9050DED94D0983AE2F61FCC236313165C829
SHA-256:	BC1E4B8F91281379618972870F09B2499983A28DB625D83D684AC9727429EA51
SHA-512:	B0DB2599C9D92C5AD1649726B6EE0B811F214D7ABE74702342374466DD805B620C20B98FD12868182ED0C1F75F0A3B41509BE022F245EE5E1894FE603EE576DB
Malicious:	false
Preview:	12/02/2023 11:28 AM: Unpack: C:\Users\user\Desktop\#U0424#U043e#U0442#U043a#U0438_#U0410#U043b#U0438_16.zip..12/02/2023 11:28 AM: Tmp dir: C:\Users\user\AppData\Local\Temp\4z0mgimv.2wq..12/02/2023 11:28 AM: Received from standard error: ..12/02/2023 11:28 AM: Received from standard error: ERRORS:..12/02/2023 11:28 AM: Received from standard error: Unexpected end of archive..12/02/2023 11:28 AM: Received from standard error: ..12/02/2023 11:28 AM: Received from standard out: 7-Zip 18.05 (x86) : Copyright (c) 1999-2018 Igor Pavlov : 2018-04-30..12/02/2023 11:28 AM: Received from standard out: ..12/02/2023 11:28 AM: Received from standard out: Scanning the drive for archives:..12/02/2023 11:28 AM: Received from standard out: 1 file, 786432 bytes (768 KiB)..12/02/2023 11:28 AM: Received from standard out: ..12/02/2023 11:28 AM: Received from standard out: Extracting archive: C:\Users\user\Desktop\#U0424#U043e#U0442#U043a#U0438_#U0410#U043b#U0438_16.zip..12/02/2023 11:28 AM:

File type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Entropy (8bit):	7.884173692941391
TrID:	ZIP compressed archive (8000/1) 100.00%
File name:	#U0424#U043e#U0442#U043a#U0438_#U0410#U043b#U0438_16.zip
File size:	786'432 bytes
MD5:	ae20248c420c92dfca679c5098071df5
SHA1:	598fae3c2c7a40b137e2208bf064a181636e55f1
SHA256:	91f82850f2a80e724edd7268980f941fcb35b9952463717cd072e1fe0818e35f
SHA512:	8a2423c4de742efbe00c377040b7bd9c8120cd2bfa7756d41e3bfabd9c4e89e549f655364cc267c1a03250251c0d6bbcc7c5f0ee6897ce2661735270bc7e407d
SSDEEP:	12288:nJqVC0njguB7Vqr6B4/ortwULKrRi4ZVX6ROErkio9IrLN9PHAW8bsEbOIFqnP:ncVwr6B4/oJCr7w6I1958BbD+P
TLSH:	1DF4CFB9735CB402E072CD314371814F74E08AF91972E712A70BB84C6DBFE84A2EAD56
File Content Preview:	PK........).rW.z..~...........classes3.dex.Xkh#..>3......]g..J[..&....q..._.J.W...7$.I#...H.F.-.....Ph.!4tiiZJ..!......HKJC)!?.R.-..BiK.#$%..wF^o.B.F...9s....{.k...'<6A.t$...[....G"......=......?..5..BD..qp...]D12.}...Q/.?@%..D.;@;. ..6.\|;...D.....I.).Y.:

Target ID:	0
Start time:	11:28:25
Start date:	02/12/2023
Path:	C:\Windows\SysWOW64\unarchiver.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\unarchiver.exe" "C:\Users\user\Desktop\#U0424#U043e#U0442#U043a#U0438_#U0410#U043b#U0438_16.zip
Imagebase:	0x4b0000
File size:	12'800 bytes
MD5 hash:	16FF3CC6CC330A08EED70CBC1D35F5D2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Reputation:	moderate
Has exited:	true

Target ID:	2
Start time:	11:28:26
Start date:	02/12/2023
Path:	C:\Windows\SysWOW64\7za.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\System32\7za.exe" x -pinfected -y -o"C:\Users\user\AppData\Local\Temp\4z0mgimv.2wq" "C:\Users\user\Desktop\#U0424#U043e#U0442#U043a#U0438_#U0410#U043b#U0438_16.zip
Imagebase:	0x10000
File size:	289'792 bytes
MD5 hash:	77E556CDFDC5C592F5C46DB4127C6F4C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	Unicode text, UTF-8 text, with very long lines (21990)
Category:	dropped
Size (bytes):	495971
Entropy (8bit):	5.536641211681035
Encrypted:	false
SSDEEP:	6144:GS6Cz++yWOoyeHdtAZHIl1XYIuj4jIjFPMf5xAyOwUqkYUYh:Odudi4cYh
MD5:	A67C48BBFBFC3CDAD85701BF9823E465
SHA1:	CF9865675EDC1B5DD77C1F50855B6A1A1264B70D
SHA-256:	517829010BF3614EB9DAFB96C6A91CEF0F662ABC72B72CCDB1E4A149C610B04B
SHA-512:	3F56F6EEDE383D492AC6086CDA237CE30A55F9ADE92E7444CBE04F1E1A2E02CE166388D33E23EA032411AD6BF5D6020A1E44B95C4C33776737EF7E8E78DAA40B
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	<TaskerData sr=""dvi="1"tv="6.1.32"><Task sr="task100"><stayawake>true</stayawake><id>100</id><Img sr="icn"ve="2"><nme>mw_action_find_in_page</nme></Img><nme>........ ..... ......</nme><Action sr="act0"ve="7"><ConditionList sr="if"><Condition sr="c0"ve="3"><op>1</op><lhs>%CAMERACHATID</lhs><rhs>false</rhs></Condition></ConditionList><code>37</code></Action><Action sr="act1"ve="7"><Str sr="arg0"ve="3">%chatid</Str><Str sr="arg1"ve="3">%CAMERACHATID</Str><Int sr="arg2"val="0"/><Int sr="arg3"val="0"/><Int sr="arg4"val="0"/><Int sr="arg5"val="3"/><Int sr="arg6"val="0"/><code>547</code></Action><Action sr="act2"ve="7"><se>false</se><Str sr="arg0"ve="3">DCIM/Camera</Str><Str sr="arg1"ve="3"/><Int sr="arg2"val="1"/><Int sr="arg3"val="0"/><Int sr="arg4"val="9"/><Str sr="arg5"ve="3">%files</Str><Int sr="arg6"val="1"/><code>412</code></Action><Action sr="act3"ve="7"><Str sr="arg0"ve="3">........ ..... ......</Str><Int sr="arg1"><var>%priority+1</var></Int><S

Execution Coverage:	21.7%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	5%
Total number of Nodes:	80
Total number of Limit Nodes:	5

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report #U0424#U043e#U0442#U043a#U0438_#U0410#U043b#U0438_16.zip

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Networking

System Summary

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Temp\4z0mgimv.2wq\AndroidManifest.xml

C:\Users\user\AppData\Local\Temp\4z0mgimv.2wq\DebugProbesKt.bin

C:\Users\user\AppData\Local\Temp\4z0mgimv.2wq\assets\kid\data.xml

C:\Users\user\AppData\Local\Temp\4z0mgimv.2wq\classes2.dex

C:\Users\user\AppData\Local\Temp\4z0mgimv.2wq\classes3.dex

C:\Users\user\AppData\Local\Temp\4z0mgimv.2wq\firebase-appindexing.properties

C:\Users\user\AppData\Local\Temp\4z0mgimv.2wq\firebase-common.properties

C:\Users\user\AppData\Local\Temp\4z0mgimv.2wq\kotlin\Comparator.kotlin_metadata

C:\Users\user\AppData\Local\Temp\4z0mgimv.2wq\kotlin\ExperimentalStdlibApi.kotlin_metadata

C:\Users\user\AppData\Local\Temp\4z0mgimv.2wq\kotlin\IllegalArgumentException.kotlin_metadata

C:\Users\user\AppData\Local\Temp\4z0mgimv.2wq\kotlin\LateinitKt.kotlin_metadata

C:\Users\user\AppData\Local\Temp\4z0mgimv.2wq\kotlin\LazyKt.kotlin_metadata

C:\Users\user\AppData\Local\Temp\4z0mgimv.2wq\kotlin\LazyThreadSafetyMode.kotlin_metadata

C:\Users\user\AppData\Local\Temp\4z0mgimv.2wq\kotlin\NoSuchElementException.kotlin_metadata

C:\Users\user\AppData\Local\Temp\4z0mgimv.2wq\kotlin\NoWhenBranchMatchedException.kotlin_metadata

C:\Users\user\AppData\Local\Temp\4z0mgimv.2wq\kotlin\NotImplementedError.kotlin_metadata

C:\Users\user\AppData\Local\Temp\4z0mgimv.2wq\kotlin\NullPointerException.kotlin_metadata

C:\Users\user\AppData\Local\Temp\4z0mgimv.2wq\kotlin\OptIn.kotlin_metadata

C:\Users\user\AppData\Local\Temp\4z0mgimv.2wq\kotlin\OptionalExpectation.kotlin_metadata

C:\Users\user\AppData\Local\Temp\4z0mgimv.2wq\kotlin\Pair.kotlin_metadata

C:\Users\user\AppData\Local\Temp\4z0mgimv.2wq\kotlin\PreconditionsKt.kotlin_metadata

C:\Users\user\AppData\Local\Temp\4z0mgimv.2wq\kotlin\RequiresOptIn.kotlin_metadata

C:\Users\user\AppData\Local\Temp\4z0mgimv.2wq\kotlin\ResultKt.kotlin_metadata

C:\Users\user\AppData\Local\Temp\4z0mgimv.2wq\kotlin\RuntimeException.kotlin_metadata

C:\Users\user\AppData\Local\Temp\4z0mgimv.2wq\kotlin\Triple.kotlin_metadata

C:\Users\user\AppData\Local\Temp\4z0mgimv.2wq\kotlin\UByteArray.kotlin_metadata

C:\Users\user\AppData\Local\Temp\4z0mgimv.2wq\kotlin\UInt.kotlin_metadata

Windows Analysis Report
#U0424#U043e#U0442#U043a#U0438_#U0410#U043b#U0438_16.zip