24:I[7638,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/136wug8odqdqr.js"],"SampleDetailWrapper"] 29:I[27201,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T456,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Sample 56ea0b084ec7… — Score 92/100 — Hybrid Analysis","description":"Malicious verdict for sample 56ea0b084ec7…. Threat score 92/100. 0/24 AV engines flagged this file. 2 malicious and 2 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/56ea0b084ec78cdd0f9d3e537b104f49ac531a941c1746bc14d0e9200459c133","keywords":["Malicious","malware analysis","sandbox report","threat intelligence","56ea0b084ec78cdd0f9d3e537b104f49ac531a941c1746bc14d0e9200459c133"],"about":{"@type":"SoftwareApplication","name":"The Guardian - News \u0026 Sport v6.122.19904 Premium Mod Apk {CracksHash}.apk","applicationCategory":["android"],"identifier":"56ea0b084ec78cdd0f9d3e537b104f49ac531a941c1746bc14d0e9200459c133","additionalType":"Malicious sample"},"threatScore":92,"antivirusDetections":{"malicious":0,"total":24},"behavioralIndicators":{"malicious":2,"suspicious":2},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:T5c3,Found string "assets/templates/youtubeAtomPositionPlaceholder.html5" (Indicator: "youtube"; File: "The Guardian - News & Sport v6.122.19904 Premium Mod Apk {CracksHash}.apk") Found string "assets/templates/youtubeAtomWithoutVideoPosterImage.htmle" (Indicator: "youtube"; File: "The Guardian - News & Sport v6.122.19904 Premium Mod Apk {CracksHash}.apk") Found string "assets/templates/youtubeAtomWithVideoPosterImage.html" (Indicator: "youtube"; File: "The Guardian - News & Sport v6.122.19904 Premium Mod Apk {CracksHash}.apk") Found string "Name: assets/templates/youtubeAtomPositionPlaceholder.html" (Indicator: "youtube"; File: "BALA.SF") Found string "Name: assets/templates/youtubeAtomWithVideoPosterImage.html" (Indicator: "youtube"; File: "BALA.SF") Found string "Name: assets/templates/youtubeAtomWithoutVideoPosterImage.html" (Indicator: "youtube"; File: "BALA.SF") Found string "Name: res/drawable-xxxhdpi/paypal_icon.png" (Indicator: "paypal"; File: "BALA.SF") Found string "Name: res/drawable-xxxhdpi/paypal_logo.png" (Indicator: "paypal"; File: "BALA.SF") Found string "Name: res/layout/view_youtube_video_placeholder.xml" (Indicator: "youtube"; File: "BALA.SF") Found string "// youtube : 2014-05-01 Charleston Road Registry Inc." (Indicator: "youtube"; File: "public-suffix-list.txt") Found string "youtube" (Indicator: "youtube"; File: "public-suffix-list.txt") Found string "withyoutube.com" (Indicator: "youtube"; File: "public-suffix-list.txt")26:Tf64,"libsodium.so_1706988939938" has type "ELF 32-bit LSB shared object ARM EABI5 version 1 (SYSV) dynamically linked with debug_info not stripped"- [targetUID: N/A] "libsodium.so_1706988939936" has type "ELF 32-bit LSB shared object Intel 80386 version 1 (SYSV) dynamically linked stripped"- [targetUID: N/A] "libsodium.so_1706988939934" has type "ELF 64-bit LSB shared object x86-64 version 1 (SYSV) dynamically linked stripped"- [targetUID: N/A] "BALA.SF" has type "ASCII text with CRLF line terminators"- [targetUID: N/A] "MANIFEST.MF" has type "ASCII text with CRLF line terminators"- [targetUID: N/A] "libsodium.so_1706988939937" has type "ELF 32-bit LSB shared object ARM EABI5 version 1 (SYSV) dynamically linked stripped"- [targetUID: N/A] "public-suffix-list.txt" has type "Public Suffix List data UTF-8 Unicode text"- [targetUID: N/A] "libsodium.so" has type "ELF 64-bit LSB shared object ARM aarch64 version 1 (SYSV) dynamically linked stripped"- [targetUID: N/A] "libjnidispatch.so_1706988939938" has type "ELF 32-bit LSB shared object MIPS MIPS32 version 1 (SYSV) dynamically linked not stripped"- [targetUID: N/A] "libjnidispatch.so_1706988939936" has type "ELF 64-bit LSB shared object MIPS MIPS64 rel6 version 1 (SYSV) dynamically linked not stripped"- [targetUID: N/A] "libjnidispatch.so" has type "ELF 64-bit LSB shared object ARM aarch64 version 1 (SYSV) dynamically linked not stripped"- [targetUID: N/A] "AndroidManifest.xml" has type "Android binary XML"- [targetUID: N/A] "LICENSE-junit.txt" has type "ASCII text"- [targetUID: N/A] "libnhook.so" has type "ELF 64-bit LSB shared object ARM aarch64 version 1 (SYSV) dynamically linked BuildID[xxHash]=069b87667ca0237e stripped"- [targetUID: N/A] "libnhook.so_1706988939936" has type "ELF 32-bit LSB shared object Intel 80386 version 1 (SYSV) dynamically linked BuildID[xxHash]=6975c0fc90c80324 stripped"- [targetUID: N/A] "field_mask.proto" has type "ASCII text"- [targetUID: N/A] "api.proto" has type "Java source ASCII text"- [targetUID: N/A] "libnhook.so_1706988939937" has type "ELF 32-bit LSB shared object ARM EABI5 version 1 (SYSV) dynamically linked BuildID[xxHash]=924bada3e98ce1d3 stripped"- [targetUID: N/A] "timestamp.proto" has type "ASCII text"- [targetUID: N/A] "type.proto" has type "Java source ASCII text"- [targetUID: N/A] "any.proto" has type "ASCII text"- [targetUID: N/A] "duration.proto" has type "ASCII text"- [targetUID: N/A] "wrappers.proto" has type "ASCII text"- [targetUID: N/A] "struct.proto" has type "ASCII text"- [targetUID: N/A] "empty.proto" has type "ASCII text"- [targetUID: N/A] "source_context.proto" has type "ASCII text"- [targetUID: N/A] "BALA.RSA" has type "data"- [targetUID: N/A] "logo.gif" has type "GIF image data version 89a 38 x 26"- [targetUID: N/A] "LocalStrings.properties" has type "ASCII text"- [targetUID: N/A] "LocalStrings_ja.properties" has type "ASCII text"- [targetUID: N/A] "smalllogo.gif" has type "GIF image data version 89a 22 x 17"- [targetUID: N/A] "LocalStrings_fr.properties" has type "ISO-8859 text"- [targetUID: N/A] "membership.proto" has type "ASCII text"- [targetUID: N/A] "kotlin.reflect.jvm.internal.impl.resolve.ExternalOverridabilityCondition" has type "ASCII text"- [targetUID: N/A] "voucher.proto" has type "ASCII text"- [targetUID: N/A] "com.google.protobuf.GeneratedExtensionRegistryLoader" has type "ASCII text"- [targetUID: N/A] "kotlinx.coroutines.CoroutineExceptionHandler" has type "ASCII text"- [targetUID: N/A] "kotlinx.coroutines.internal.MainDispatcherFactory" has type "ASCII text"- [targetUID: N/A] "kotlin.reflect.jvm.internal.impl.builtins.BuiltInsLoader" has type "ASCII text"- [targetUID: N/A] "com.fasterxml.jackson.databind.Module" has type "ASCII text"- [targetUID: N/A] "com.fasterxml.jackson.core.ObjectCodec" has type "ASCII text"- [targetUID: N/A] "com.fasterxml.jackson.core.JsonFactory" has type "ASCII text"- [targetUID: N/A]27:T563,Found reference to API "// Submitted by Marko Ivanovic " (Indicator: "@hotmail."; File: "public-suffix-list.txt") Found reference to API "// Submitted by Daniil Burdakov " (Indicator: "@gmail."; File: "public-suffix-list.txt") Found reference to API "// bitbridge.net : Submitted by Craig Welch, abeliidev@gmail.com" (Indicator: "@gmail."; File: "public-suffix-list.txt") Found reference to API "// Submitted by Vasiliy Sheredeko " (Indicator: "@gmail."; File: "public-suffix-list.txt") Found reference to API "// Submitted by Xavier De Cock " (Indicator: "@gmail."; File: "public-suffix-list.txt") Found reference to API "// Submitted by Seth Vincent " (Indicator: "@gmail."; File: "public-suffix-list.txt") Found reference to API "// Submitted by Reza Akhavan " (Indicator: "@gmail."; File: "public-suffix-list.txt") Found reference to API "// Submitted by Lenny Bakkalian " (Indicator: "@gmail."; File: "public-suffix-list.txt") Found reference to API "// Submitted by Apostolos Tsakpinis " (Indicator: "@gmail."; File: "public-suffix-list.txt") Found reference to API "// Submitted by XnBay Developer " (Indicator: "@gmail."; File: "public-suffix-list.txt")28:Tdd2,Found string ".bdmknbaem.d.kFdnmenliuuru:gaac2(aMiiI)meFbkanttoa.hcdkeMecy9ryeadaeSGGaaud.fre ydgcthripa" (Indicator: "aes"; File: "MyGuardianFeedbackKt.smali") Found string "\'. Assuming AES-CTR crypto mode." (Indicator: "aes"; File: "TrackEncryptionBox.smali") Found string "AESSettingsCipherMode" (Indicator: "aes"; File: "MatroskaExtractor.smali") Found string ";base64" (Indicator: "base64"; File: "DataSchemeDataSource.smali") Found string "Error while parsing Base64 encoded string:" (Indicator: "base64"; File: "DataSchemeDataSource.smali") Found string "base64" (Indicator: "base64"; File: "WebViewSubtitleOutput.smali") file/memory contains long string with (Indicator: "aes"; File: "libsodium.so_1706988939936") file/memory contains long string with (Indicator: "aes256"; File: "libsodium.so_1706988939936") file/memory contains long string with (Indicator: "base64"; File: "libsodium.so_1706988939936") file/memory contains long string with (Indicator: "chacha"; File: "libsodium.so_1706988939936") file/memory contains long string with (Indicator: "aes"; File: "libsodium.so_1706988939934") file/memory contains long string with (Indicator: "aes256"; File: "libsodium.so_1706988939934") file/memory contains long string with (Indicator: "base64"; File: "libsodium.so_1706988939934") file/memory contains long string with (Indicator: "chacha"; File: "libsodium.so_1706988939934") file/memory contains long string with (Indicator: "aes"; File: "libsodium.so_1706988939937") file/memory contains long string with (Indicator: "aes256"; File: "libsodium.so_1706988939937") file/memory contains long string with (Indicator: "base64"; File: "libsodium.so_1706988939937") file/memory contains long string with (Indicator: "chacha"; File: "libsodium.so_1706988939937") file/memory contains long string with (Indicator: "aes"; File: "libsodium.so") file/memory contains long string with (Indicator: "aes256"; File: "libsodium.so") file/memory contains long string with (Indicator: "base64"; File: "libsodium.so") file/memory contains long string with (Indicator: "chacha"; File: "libsodium.so") Found string "SHA-256-Digest: dCVAESHDguKiTsfuB+vG/JpzNMX7qztNl62ubTzKkLc=" (Indicator: "aes"; File: "BALA.SF") Found string "SHA-256-Digest: UTAEsuG1AomgjbU4QdE9M3M5ZE6nmR9orde1h0K2wdQ=" (Indicator: "aes"; File: "BALA.SF") Found string "SHA-256-Digest: +OLVvuLa9rty9YAvYBwrA7AEssFV+X4ugwIwjztGsvQ=" (Indicator: "aes"; File: "BALA.SF") Found string "SHA-256-Digest: CFKszwU80siqtjHtRzo0TXh8RRJcj40yaesvGehT370=" (Indicator: "aes"; File: "MANIFEST.MF") Found string "SHA-256-Digest: DAgUUnPf5B6cOLcpUApYOVmJmPKZ8RqDAEspHOot7GU=" (Indicator: "aes"; File: "MANIFEST.MF") Found string "SHA-256-Digest: SAN9OOaesJ6lL5nmGkFQQ8cOeJmrZEw50OJRQ8dGipA=" (Indicator: "aes"; File: "MANIFEST.MF") file/memory contains long string with (Indicator: "aes"; File: "public-suffix-list.txt") Found string "yaese.okinawa.jp" (Indicator: "aes"; File: "public-suffix-list.txt") Found string "comunicaes.museum" (Indicator: "aes"; File: "public-suffix-list.txt") Found string "correios-e-telecomunicaes.museum" (Indicator: "aes"; File: "public-suffix-list.txt") Found string "// globo : 2013-12-19 Globo Comunicao e Participaes S.A" (Indicator: "aes"; File: "public-suffix-list.txt") Found string "// Submitted by Jan Jaeschke " (Indicator: "aes"; File: "public-suffix-list.txt") Found string "// Submitted by SinaAppEngine " (Indicator: "aes"; File: "public-suffix-list.txt")1b:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$23"}}],["$","$L24",null,{"initialData":{"schema_version":"1.0.15","sha256":"56ea0b084ec78cdd0f9d3e537b104f49ac531a941c1746bc14d0e9200459c133","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":92,"unified_at_epoch_ms":1791152232385,"unified_at":"2026-10-04T22:17:12.385Z","metadata":{"hashes":{"sha256":"56ea0b084ec78cdd0f9d3e537b104f49ac531a941c1746bc14d0e9200459c133","sha1":"cadacc04d721510672a8f621fb7fc0d0c7550123","md5":"eaef522eedc98ca2c469ed3a15ff133d","sha512":"0b3b5c76c8ca4ebc3c175bec9dc65f42ac2882cff187614720840930af22cf833f3dbd3d23454847703485395a16e79323a35a595e46abf481f0859bd2a8bbe1","ssdeep":"786432:vfLXLREjnWyBLVjBc4WTVoYJ61n3AQp+DcA:3LbREzWMJVc05Nc","ssdeep_chunks":["786432:vfLXLRE","786432:fLXLREj","786432:LXLREjn","786432:XLREjnW","786432:LREjnWy","786432:REjnWyB","786432:EjnWyBL","786432:jnWyBLV","786432:nWyBLVj","786432:WyBLVjB","786432:yBLVjBc","786432:BLVjBc4","786432:LVjBc4W","786432:VjBc4WT","786432:jBc4WTV","786432:Bc4WTVo","786432:c4WTVoY","786432:4WTVoYJ","786432:WTVoYJ6","786432:TVoYJ61","786432:VoYJ61n","786432:oYJ61n3","786432:YJ61n3A","786432:J61n3AQ","786432:61n3AQp","786432:1n3AQp+","786432:n3AQp+D","786432:3AQp+Dc","786432:AQp+DcA","1572864:vfLXLRE","1572864:fLXLREj","1572864:LXLREjn","1572864:XLREjnW","1572864:LREjnWy","1572864:REjnWyB","1572864:EjnWyBL","1572864:jnWyBLV","1572864:nWyBLVj","1572864:WyBLVjB","1572864:yBLVjBc","1572864:BLVjBc4","1572864:LVjBc4W","1572864:VjBc4WT","1572864:jBc4WTV","1572864:Bc4WTVo","1572864:c4WTVoY","1572864:4WTVoYJ","1572864:WTVoYJ6","1572864:TVoYJ61","1572864:VoYJ61n","1572864:oYJ61n3","1572864:YJ61n3A","1572864:J61n3AQ","1572864:61n3AQp","1572864:1n3AQp+","1572864:n3AQp+D","1572864:3AQp+Dc","1572864:AQp+DcA","786432:3LbREzW","786432:LbREzWM","786432:bREzWMJ","786432:REzWMJV","786432:EzWMJVc","786432:zWMJVc0","786432:WMJVc05","786432:MJVc05N","786432:JVc05Nc"],"imphash":"Unknown"},"file_info":{"file_name":"The Guardian - News & Sport v6.122.19904 Premium Mod Apk {CracksHash}.apk","file_type":["android"],"file_type_id":"apk","file_size":34804830,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1706988890000,"last_seen":1706988890000,"last_multi_scan":1706988890000}},"detections":{"summary":{"verdict":"malicious","score":92,"tags":null},"stats":{"av":{"malicious_count":0,"suspicious_count":0,"total_engines":24},"attributions":{"malware_families_count":0,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":8},"sandbox_signatures":{"informative_count":11,"suspicious_count":2,"malicious_count":2,"total":15},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"ahnlab":{"name":"AhnLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"comodo":{"name":"Comodo","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"cylance":{"name":"Cylance","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"kaspersky":{"name":"Kaspersky","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"lionic":{"name":"Lionic","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"mcafee":{"name":"McAfee","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"webrootsmd":{"name":"Webroot SMD","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{},"mitre_attacks":[{"tactic":"Resource Development","technique":"Email Accounts","attack_id":"T1585.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1585/002","identifiers":[{"type":"informative","value":"Found email domains (string)"}],"sources":[{"report_type":"sandbox","report_id":"65be9556bf61f5981606bb93"}]},{"tactic":"Execution","technique":"Broadcast Receivers","attack_id":"T1402","attack_id_wiki":"https://attack.mitre.org/techniques/T1402","identifiers":[{"type":"malicious","value":"Has the ability to execute code after reboot"}],"sources":[{"report_type":"sandbox","report_id":"65be9556bf61f5981606bb93"}]},{"tactic":"Defense Evasion","technique":"Obfuscated Files or Information","attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"informative","value":"Contains CRYPTO related strings"},{"type":"informative","value":"Sample file has high entropy (likely encrypted/compressed content)"},{"type":"informative","value":"Shows ability to obfuscate file or information"}],"sources":[{"report_type":"sandbox","report_id":"65be9556bf61f5981606bb93"}]},{"tactic":"Discovery","technique":"Security Software Discovery","attack_id":"T1518.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1518/001","identifiers":[{"type":"informative","value":"Possibly checks for the presence of an Antivirus engine"}],"sources":[{"report_type":"sandbox","report_id":"65be9556bf61f5981606bb93"}]},{"tactic":"Collection","technique":"Email Collection","attack_id":"T1114","attack_id_wiki":"https://attack.mitre.org/techniques/T1114","identifiers":[{"type":"suspicious","value":"Found a potential E-Mail address in binary/memory"}],"sources":[{"report_type":"sandbox","report_id":"65be9556bf61f5981606bb93"}]},{"tactic":"Command and Control","technique":"Application Layer Protocol","attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"informative","value":"Found potential URL in binary/memory"}],"sources":[{"report_type":"sandbox","report_id":"65be9556bf61f5981606bb93"}]},{"tactic":"Command and Control","technique":"Encrypted Channel","attack_id":"T1573","attack_id_wiki":"https://attack.mitre.org/techniques/T1573","identifiers":[{"type":"informative","value":"Possibly tries to communicate over SSL connection (HTTPS)"}],"sources":[{"report_type":"sandbox","report_id":"65be9556bf61f5981606bb93"}]},{"tactic":"Command and Control","technique":"Ingress Tool Transfer","attack_id":"T1105","attack_id_wiki":"https://attack.mitre.org/techniques/T1105","identifiers":[{"type":"informative","value":"Dropped files"},{"type":"informative","value":"Drops XML files"},{"type":"informative","value":"Drops files with image extension"}],"sources":[{"report_type":"sandbox","report_id":"65be9556bf61f5981606bb93"}]}],"sandbox_signatures":[{"level":"informative","category":"Cryptographic Related","name":"Sample file has high entropy (likely encrypted/compressed content)","description":"Sample file \"sample.bin\" has high entropy 7.825612964532065","origin":"Binary File","mitre_attack_id":"T1027","relevance":1,"id":"binary-71","sources":[{"report_type":"sandbox","report_id":"65be9556bf61f5981606bb93"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to obfuscate file or information","description":"The analysis contains indicators for cyrpto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Contains CRYPTO related strings\n Matched sigs: Sample file has high entropy (likely encrypted/compressed content)","origin":"Indicator Combinations","mitre_attack_id":"T1027","relevance":1,"id":"summary-28","sources":[{"report_type":"sandbox","report_id":"65be9556bf61f5981606bb93"}]},{"level":"informative","category":"General","name":"Found a reference to a known community page","description":"$25","origin":"File/Memory","relevance":2,"id":"string-10","sources":[{"report_type":"sandbox","report_id":"65be9556bf61f5981606bb93"}]},{"level":"informative","category":"General","name":"Possibly checks for the presence of an Antivirus engine","description":"\"baidu\" (Indicator: \"baidu\") in Source: public-suffix-list.txt\n \"norton\" (Indicator: \"norton\") in Source: public-suffix-list.txt","origin":"File/Memory","mitre_attack_id":"T1518.001","relevance":2,"id":"string-8","sources":[{"report_type":"sandbox","report_id":"65be9556bf61f5981606bb93"}]},{"level":"informative","category":"Installation/Persistence","name":"Dropped files","description":"$26","origin":"Binary File","mitre_attack_id":"T1105","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"65be9556bf61f5981606bb93"}]},{"level":"informative","category":"Installation/Persistence","name":"Drops XML files","description":"\"AndroidManifest.xml\" has type \"Android binary XML\"","origin":"Binary File","mitre_attack_id":"T1105","relevance":1,"id":"binary-39","sources":[{"report_type":"sandbox","report_id":"65be9556bf61f5981606bb93"}]},{"level":"informative","category":"Network Related","name":"Found email domains (string)","description":"$27","origin":"File/Memory","mitre_attack_id":"T1585.002","relevance":1,"id":"string-235","sources":[{"report_type":"sandbox","report_id":"65be9556bf61f5981606bb93"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"details too long to display","origin":"File/Memory","mitre_attack_id":"T1071","relevance":3,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"65be9556bf61f5981606bb93"}]},{"level":"informative","category":"Network Related","name":"Possibly tries to communicate over SSL connection (HTTPS)","description":"Found HTTPS url \"https://developer.apple.com\"\n Found HTTPS url \"https://aomedia.org\"\n Found HTTPS url \"https://developer.android.com\"\n Found HTTPS url \"https://x\"\n Found HTTPS url \"https://default.url\"","origin":"File/Memory","mitre_attack_id":"T1573","relevance":1,"id":"string-98","sources":[{"report_type":"sandbox","report_id":"65be9556bf61f5981606bb93"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains CRYPTO related strings","description":"$28","origin":"File/Memory","mitre_attack_id":"T1027","relevance":3,"id":"string-57","sources":[{"report_type":"sandbox","report_id":"65be9556bf61f5981606bb93"}]},{"level":"informative","category":"Unusual Characteristics","name":"Drops files with image extension","description":"\"logo.gif\" has type \"GIF image data version 89a 38 x 26\" and extension \"gif\"\n \"smalllogo.gif\" has type \"GIF image data version 89a 22 x 17\" and extension \"gif\"","origin":"Binary File","mitre_attack_id":"T1105","id":"binary-56","sources":[{"report_type":"sandbox","report_id":"65be9556bf61f5981606bb93"}]},{"level":"suspicious","category":"General","name":"Found a potential E-Mail address in binary/memory","description":"Pattern match: \"iana-questions@icann.org\"\n Pattern match: \"it@nic.at\"\n Pattern match: \"shae.donelan@services.nsw.gov.au\"\n Pattern match: \"greg.connors@nt.gov.au\"\n Pattern match: \"tech@dns.be\"\n Pattern match: \"fneves@registro.br\"\n Pattern match: \"jarle@uninett.no\"\n Pattern match: \"hsalgado@nic.cl\"\n Pattern match: \"tanyaling@cnnic.cn\"\n Pattern match: \"tecnico@uniandes.edu.co\"\n Pattern match: \"registry@una.net\"\n Pattern match: \"cydns@ucy.ac.cy\"\n Pattern match: \"ops@denic.de\"\n Pattern match: \"robert@dk-hostmaster.dk\"\n Pattern match: \"vabboud@nic.ec\"\n Pattern match: \"garth.miller@cocca.org.nz\"\n Pattern match: \"damien.shaw@ja.net\"\n Pattern match: \"nigel@channelisles.net\"\n Pattern match: \"randy@psg.com\"\n Pattern match: \"segred@ics.forth.gr\"\n Pattern match: \"uognoc@triton.uog.edu\"\n Pattern match: \"hk.tech@hkirc.hk\"\n Pattern match: \"pasztor@iszt.hu\"\n Pattern match: \"info@nic.im\"\n Pattern match: \"tech-team@nic.ir\"","origin":"File/Memory","mitre_attack_id":"T1114","relevance":3,"id":"string-63","sources":[{"report_type":"sandbox","report_id":"65be9556bf61f5981606bb93"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Found an indicator for phone dialing capabilities","description":"\"// tel: https://en.wikipedia.org/wiki/.tel\" (Indicator: \"tel:\"; File: \"public-suffix-list.txt\")","origin":"File/Memory","relevance":10,"id":"string-37","sources":[{"report_type":"sandbox","report_id":"65be9556bf61f5981606bb93"}]},{"level":"malicious","category":"Installation/Persistence","name":"Has the ability to execute code after reboot","description":"Permission request for \"android.permission.RECEIVE_BOOT_COMPLETED\"","origin":"Static Parser","mitre_attack_id":"T1402","relevance":10,"id":"static-28","sources":[{"report_type":"sandbox","report_id":"65be9556bf61f5981606bb93"}]},{"level":"malicious","category":"Pattern Matching","name":"YARA signature match","description":"YARA signature \"Bolonyokte\" matched file \"sample.bin\" as \"UnknownDotNet RAT - Bolonyokte\" (Author: Jean-Philippe Teissier / @Jipe_)","origin":"YARA Signature","relevance":10,"id":"yara-0","sources":[{"report_type":"sandbox","report_id":"65be9556bf61f5981606bb93"}]}],"incidents":[{"name":"Evasive","details_count":1,"details":[{"detail":"Has the ability to execute code after reboot"}],"sources":[{"report_type":"sandbox","report_id":"65be9556bf61f5981606bb93"}]}]},"activity":{"stats":{"process_count":0,"spawned_processes_count":0,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":0,"imported_dlls_count":0,"dropped_files_count":0,"extracted_files_count":20,"files_written_count":0,"files_deleted_count":0,"registry_keys_created_count":0,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":0,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":0,"dns_resolutions_count":0,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":null,"sample_flags":["Extracted Files"],"sandbox_reports":[{"id":"65be9556bf61f5981606bb93","environment_id":200,"environment_description":"Android Static Analysis","state":"SUCCESS","verdict":"malicious","threat_score":92,"submit_name":"The Guardian - News & Sport v6.122.19904 Premium Mod Apk {CracksHash}.apk","analysis_start_time":"2024-02-03T19:34:52+00:00","indicators_count":{"informative":11,"suspicious":3,"malicious":2},"tags":["Extracted Files"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":null,"dns_resolutions":null,"http_requests":null},"process_activity":{"sources":null,"processes":null,"all_imported_dlls":null},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"libsodium.so_1706988939938","sha256":"e096c82a4bf2797f76ed048e42d0f4749969dcba79098ab375e203028e042b47","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"65be9556bf61f5981606bb93"}]},{"name":"libsodium.so_1706988939936","sha256":"82e732de44e9491abac74be02b9e35db96bfed975e795f50ff9d6cff939a0f23","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"65be9556bf61f5981606bb93"}]},{"name":"libsodium.so_1706988939934","sha256":"d6a0a35c3c96c26fa8daf1551329e0e4fb14a8f414c99ce6bd1da53d3a368665","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"65be9556bf61f5981606bb93"}]},{"name":"BALA.SF","sha256":"2b873c77c20d4ed67ef3de5801825e790667add1f7600de6386dbc75034886e6","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"65be9556bf61f5981606bb93"}]},{"name":"MANIFEST.MF","sha256":"2297778707c8ad47afbc578184ff844fd33012b4b3be6a7cea86a29a49105411","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"65be9556bf61f5981606bb93"}]},{"name":"libsodium.so_1706988939937","sha256":"f9653e3631a018d1348e7081b020924c9e7b4dcab4addbea701c3ff9bea660d1","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"65be9556bf61f5981606bb93"}]},{"name":"public-suffix-list.txt","sha256":"ff2293eff88881f6742f388d6b9ab7d1ba89a6183a6d576d3753506bf79ef67c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"65be9556bf61f5981606bb93"}]},{"name":"libsodium.so","sha256":"8bd6064f5d3bafb07017046555cb031a0cbe3ba56538e7775b23ef1d2d5f050f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"65be9556bf61f5981606bb93"}]},{"name":"libjnidispatch.so_1706988939938","sha256":"3d5f4f6fc02025c23a0b78057f8cf7b8249cc8befd69c3edea3a335fe2f55162","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"65be9556bf61f5981606bb93"}]},{"name":"libjnidispatch.so_1706988939936","sha256":"54abded6341558075b1b376c9620241526b8acec19d67e166244f321a548eedd","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"65be9556bf61f5981606bb93"}]},{"name":"libjnidispatch.so","sha256":"e70a960bf0304ce6ba0b83371ff1902ef270bb74c5bd4610019aeaee6c6e45b2","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"65be9556bf61f5981606bb93"}]},{"name":"AndroidManifest.xml","sha256":"f433ec8486581012c2458cfca8bb74bd62c2975263e04ad79a371490f5e39557","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"65be9556bf61f5981606bb93"}]},{"name":"LICENSE-junit.txt","sha256":"9648bb2891b9813970bddb68d4be8a5e6ec8280d0180a53dfb29236b579c55bb","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"65be9556bf61f5981606bb93"}]},{"name":"libnhook.so","sha256":"341cf94823eb8261bec6183b362d147666eca773a3c07d63d7715738a8106605","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"65be9556bf61f5981606bb93"}]},{"name":"libnhook.so_1706988939936","sha256":"4dccd01721ece5c089eb7ea57c82ebd07b92fb5ddb117f6d2e596d2e2e00e821","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"65be9556bf61f5981606bb93"}]},{"name":"field_mask.proto","sha256":"17b0f342cc3a262e317d56884f3f575afbfac512ad0579349cc7450e41f26891","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"65be9556bf61f5981606bb93"}]},{"name":"api.proto","sha256":"e1745f7d6e9953f624b027b37da29ffc6521c45bce9aa96f39666748879fc915","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"65be9556bf61f5981606bb93"}]},{"name":"libnhook.so_1706988939937","sha256":"d774b7642611759833344bc00a5861a8530e07c09a358d61e2f7e841e6b01591","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"65be9556bf61f5981606bb93"}]},{"name":"timestamp.proto","sha256":"14052c6042c1dd2d0b50245f2812eaab6eaf82db0b6e8ce483eae527f73b6ee8","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"65be9556bf61f5981606bb93"}]},{"name":"type.proto","sha256":"e230e0e4aeb87c95e9f1c6acbfc0c713db3f88094f149b154717a51d020f750b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"65be9556bf61f5981606bb93"}]}],"files_written":null,"files_deleted":null},"registry_activity":{"keys_created":null,"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":null}},"report_ids":{"sandbox_job_ids":["65be9556bf61f5981606bb93"]}}}]]}] 1e:null 22:[["$","title","0",{"children":"Malicious Sample 56ea0b084ec7… — Score 92/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample 56ea0b084ec7…. Threat score 92/100. 0/24 AV engines flagged this file. 2 malicious and 2 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/56ea0b084ec78cdd0f9d3e537b104f49ac531a941c1746bc14d0e9200459c133"}],["$","meta","4",{"property":"og:title","content":"Malicious Sample 56ea0b084ec7… — Score 92/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample 56ea0b084ec7…. Threat score 92/100. 0/24 AV engines flagged this file. 2 malicious and 2 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/56ea0b084ec78cdd0f9d3e537b104f49ac531a941c1746bc14d0e9200459c133"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Sample 56ea0b084ec7… — Score 92/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample 56ea0b084ec7…. Threat score 92/100. 0/24 AV engines flagged this file. 2 malicious and 2 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L29","11",{}]]