Analysis
-
max time kernel
518104s -
max time network
161s -
platform
android_x86_64 -
resource
android-x86_64_arm64 -
submitted
20-01-2021 08:18
Static task
static1
Behavioral task
behavioral1
Sample
cwutqjvwcx.apk
Resource
android-x86_64_arm64
0 signatures
0 seconds
General
-
Target
cwutqjvwcx.apk
-
Size
205KB
-
MD5
daaa6d12b45614c04ece14bca45578d6
-
SHA1
bd314cbb03a40a01e0d27a967d4238dafc6607d5
-
SHA256
9b42ce8daebc808e7f2805443c93f44647badf32f0378d6267a2e6a18bd5c46a
-
SHA512
dd25f8525cc097f1e116331cde41e6cd4cc931a01af2ec7caeb2fb775ee4ea4849212dc3821d47dbf415aa9c2a77f21aac15344c206930902e8f41856de3ae31
Score
10/10
Malware Config
Extracted
DES_key
Signatures
-
Processes:
mk.qrg.irpid process 4190 mk.qrg.ir -
Loads dropped Dex/Jar 2 IoCs
Runs executable file dropped to the device during analysis.
Processes:
mk.qrg.irioc pid process /data/user/0/mk.qrg.ir/files/dex 4190 mk.qrg.ir /data/user/0/mk.qrg.ir/files/dex 4190 mk.qrg.ir -
Reads name of network operator 1 IoCs
Uses Android APIs to discover system information.
Processes:
mk.qrg.irdescription ioc process Framework API call android.telephony.TelephonyManager.getNetworkOperatorName mk.qrg.ir -
Uses Crypto APIs (Might try to encrypt user data). 1 IoCs
Processes:
mk.qrg.irdescription ioc process Framework API call javax.crypto.Cipher.doFinal mk.qrg.ir -
Suspicious use of android.app.ApplicationPackageManager.getInstalledPackages 2 IoCs
Processes:
mk.qrg.irpid process 4190 mk.qrg.ir 4190 mk.qrg.ir -
Suspicious use of android.net.wifi.WifiInfo.getMacAddress 58 IoCs
Processes:
mk.qrg.irpid process 4190 mk.qrg.ir 4190 mk.qrg.ir 4190 mk.qrg.ir 4190 mk.qrg.ir 4190 mk.qrg.ir 4190 mk.qrg.ir 4190 mk.qrg.ir 4190 mk.qrg.ir 4190 mk.qrg.ir 4190 mk.qrg.ir 4190 mk.qrg.ir 4190 mk.qrg.ir 4190 mk.qrg.ir 4190 mk.qrg.ir 4190 mk.qrg.ir 4190 mk.qrg.ir 4190 mk.qrg.ir 4190 mk.qrg.ir 4190 mk.qrg.ir 4190 mk.qrg.ir 4190 mk.qrg.ir 4190 mk.qrg.ir 4190 mk.qrg.ir 4190 mk.qrg.ir 4190 mk.qrg.ir 4190 mk.qrg.ir 4190 mk.qrg.ir 4190 mk.qrg.ir 4190 mk.qrg.ir 4190 mk.qrg.ir 4190 mk.qrg.ir 4190 mk.qrg.ir 4190 mk.qrg.ir 4190 mk.qrg.ir 4190 mk.qrg.ir 4190 mk.qrg.ir 4190 mk.qrg.ir 4190 mk.qrg.ir 4190 mk.qrg.ir 4190 mk.qrg.ir 4190 mk.qrg.ir 4190 mk.qrg.ir 4190 mk.qrg.ir 4190 mk.qrg.ir 4190 mk.qrg.ir 4190 mk.qrg.ir 4190 mk.qrg.ir 4190 mk.qrg.ir 4190 mk.qrg.ir 4190 mk.qrg.ir 4190 mk.qrg.ir 4190 mk.qrg.ir 4190 mk.qrg.ir 4190 mk.qrg.ir 4190 mk.qrg.ir 4190 mk.qrg.ir 4190 mk.qrg.ir 4190 mk.qrg.ir -
Suspicious use of android.os.PowerManager$WakeLock.acquire 1 IoCs
Processes:
mk.qrg.irpid process 4190 mk.qrg.ir -
Suspicious use of android.telephony.TelephonyManager.getLine1Number 59 IoCs
Processes:
mk.qrg.irpid process 4190 mk.qrg.ir 4190 mk.qrg.ir 4190 mk.qrg.ir 4190 mk.qrg.ir 4190 mk.qrg.ir 4190 mk.qrg.ir 4190 mk.qrg.ir 4190 mk.qrg.ir 4190 mk.qrg.ir 4190 mk.qrg.ir 4190 mk.qrg.ir 4190 mk.qrg.ir 4190 mk.qrg.ir 4190 mk.qrg.ir 4190 mk.qrg.ir 4190 mk.qrg.ir 4190 mk.qrg.ir 4190 mk.qrg.ir 4190 mk.qrg.ir 4190 mk.qrg.ir 4190 mk.qrg.ir 4190 mk.qrg.ir 4190 mk.qrg.ir 4190 mk.qrg.ir 4190 mk.qrg.ir 4190 mk.qrg.ir 4190 mk.qrg.ir 4190 mk.qrg.ir 4190 mk.qrg.ir 4190 mk.qrg.ir 4190 mk.qrg.ir 4190 mk.qrg.ir 4190 mk.qrg.ir 4190 mk.qrg.ir 4190 mk.qrg.ir 4190 mk.qrg.ir 4190 mk.qrg.ir 4190 mk.qrg.ir 4190 mk.qrg.ir 4190 mk.qrg.ir 4190 mk.qrg.ir 4190 mk.qrg.ir 4190 mk.qrg.ir 4190 mk.qrg.ir 4190 mk.qrg.ir 4190 mk.qrg.ir 4190 mk.qrg.ir 4190 mk.qrg.ir 4190 mk.qrg.ir 4190 mk.qrg.ir 4190 mk.qrg.ir 4190 mk.qrg.ir 4190 mk.qrg.ir 4190 mk.qrg.ir 4190 mk.qrg.ir 4190 mk.qrg.ir 4190 mk.qrg.ir 4190 mk.qrg.ir 4190 mk.qrg.ir -
Uses reflection 63 IoCs
Processes:
mk.qrg.irdescription pid process Invokes method com.Loader.create 4190 mk.qrg.ir Invokes method android.app.ApplicationPackageManager.setComponentEnabledSetting 4190 mk.qrg.ir Acesses field com.android.okhttp.internal.tls.OkHostnameVerifier.INSTANCE 4190 mk.qrg.ir Invokes method com.Loader.start 4190 mk.qrg.ir Invokes method android.telephony.SignalStrength.getLevel 4190 mk.qrg.ir Invokes method android.os.PowerManager.isIgnoringBatteryOptimizations 4190 mk.qrg.ir Invokes method android.os.PowerManager.isIgnoringBatteryOptimizations 4190 mk.qrg.ir Invokes method android.os.PowerManager.isIgnoringBatteryOptimizations 4190 mk.qrg.ir Invokes method android.os.PowerManager.isIgnoringBatteryOptimizations 4190 mk.qrg.ir Invokes method android.os.PowerManager.isIgnoringBatteryOptimizations 4190 mk.qrg.ir Invokes method android.os.PowerManager.isIgnoringBatteryOptimizations 4190 mk.qrg.ir Invokes method android.os.PowerManager.isIgnoringBatteryOptimizations 4190 mk.qrg.ir Invokes method android.os.PowerManager.isIgnoringBatteryOptimizations 4190 mk.qrg.ir Invokes method android.os.PowerManager.isIgnoringBatteryOptimizations 4190 mk.qrg.ir Invokes method android.os.PowerManager.isIgnoringBatteryOptimizations 4190 mk.qrg.ir Invokes method android.os.PowerManager.isIgnoringBatteryOptimizations 4190 mk.qrg.ir Invokes method android.os.PowerManager.isIgnoringBatteryOptimizations 4190 mk.qrg.ir Invokes method android.os.PowerManager.isIgnoringBatteryOptimizations 4190 mk.qrg.ir Invokes method android.os.PowerManager.isIgnoringBatteryOptimizations 4190 mk.qrg.ir Invokes method android.os.PowerManager.isIgnoringBatteryOptimizations 4190 mk.qrg.ir Invokes method android.os.PowerManager.isIgnoringBatteryOptimizations 4190 mk.qrg.ir Invokes method android.os.PowerManager.isIgnoringBatteryOptimizations 4190 mk.qrg.ir Invokes method android.os.PowerManager.isIgnoringBatteryOptimizations 4190 mk.qrg.ir Invokes method android.os.PowerManager.isIgnoringBatteryOptimizations 4190 mk.qrg.ir Invokes method android.os.PowerManager.isIgnoringBatteryOptimizations 4190 mk.qrg.ir Invokes method android.os.PowerManager.isIgnoringBatteryOptimizations 4190 mk.qrg.ir Invokes method android.os.PowerManager.isIgnoringBatteryOptimizations 4190 mk.qrg.ir Invokes method android.os.PowerManager.isIgnoringBatteryOptimizations 4190 mk.qrg.ir Invokes method android.os.PowerManager.isIgnoringBatteryOptimizations 4190 mk.qrg.ir Invokes method android.os.PowerManager.isIgnoringBatteryOptimizations 4190 mk.qrg.ir Invokes method android.os.PowerManager.isIgnoringBatteryOptimizations 4190 mk.qrg.ir Invokes method android.os.PowerManager.isIgnoringBatteryOptimizations 4190 mk.qrg.ir Invokes method android.os.PowerManager.isIgnoringBatteryOptimizations 4190 mk.qrg.ir Invokes method android.os.PowerManager.isIgnoringBatteryOptimizations 4190 mk.qrg.ir Invokes method android.os.PowerManager.isIgnoringBatteryOptimizations 4190 mk.qrg.ir Invokes method android.os.PowerManager.isIgnoringBatteryOptimizations 4190 mk.qrg.ir Invokes method android.os.PowerManager.isIgnoringBatteryOptimizations 4190 mk.qrg.ir Invokes method android.os.PowerManager.isIgnoringBatteryOptimizations 4190 mk.qrg.ir Invokes method android.os.PowerManager.isIgnoringBatteryOptimizations 4190 mk.qrg.ir Invokes method android.os.PowerManager.isIgnoringBatteryOptimizations 4190 mk.qrg.ir Invokes method android.os.PowerManager.isIgnoringBatteryOptimizations 4190 mk.qrg.ir Invokes method android.os.PowerManager.isIgnoringBatteryOptimizations 4190 mk.qrg.ir Invokes method android.os.PowerManager.isIgnoringBatteryOptimizations 4190 mk.qrg.ir Invokes method android.os.PowerManager.isIgnoringBatteryOptimizations 4190 mk.qrg.ir Invokes method android.os.PowerManager.isIgnoringBatteryOptimizations 4190 mk.qrg.ir Invokes method android.os.PowerManager.isIgnoringBatteryOptimizations 4190 mk.qrg.ir Invokes method android.os.PowerManager.isIgnoringBatteryOptimizations 4190 mk.qrg.ir Invokes method android.os.PowerManager.isIgnoringBatteryOptimizations 4190 mk.qrg.ir Invokes method android.os.PowerManager.isIgnoringBatteryOptimizations 4190 mk.qrg.ir Invokes method android.os.PowerManager.isIgnoringBatteryOptimizations 4190 mk.qrg.ir Invokes method android.os.PowerManager.isIgnoringBatteryOptimizations 4190 mk.qrg.ir Invokes method android.os.PowerManager.isIgnoringBatteryOptimizations 4190 mk.qrg.ir Invokes method android.os.PowerManager.isIgnoringBatteryOptimizations 4190 mk.qrg.ir Invokes method android.os.PowerManager.isIgnoringBatteryOptimizations 4190 mk.qrg.ir Invokes method android.os.PowerManager.isIgnoringBatteryOptimizations 4190 mk.qrg.ir Invokes method android.os.PowerManager.isIgnoringBatteryOptimizations 4190 mk.qrg.ir Invokes method android.os.PowerManager.isIgnoringBatteryOptimizations 4190 mk.qrg.ir Invokes method android.os.PowerManager.isIgnoringBatteryOptimizations 4190 mk.qrg.ir Invokes method android.os.PowerManager.isIgnoringBatteryOptimizations 4190 mk.qrg.ir Invokes method android.os.PowerManager.isIgnoringBatteryOptimizations 4190 mk.qrg.ir Invokes method android.os.PowerManager.isIgnoringBatteryOptimizations 4190 mk.qrg.ir Invokes method android.os.PowerManager.isIgnoringBatteryOptimizations 4190 mk.qrg.ir Invokes method android.os.PowerManager.isIgnoringBatteryOptimizations 4190 mk.qrg.ir
Processes
-
mk.qrg.ir1⤵
- Removes its main activity from the application launcher
- Loads dropped Dex/Jar
- Reads name of network operator
- Uses Crypto APIs (Might try to encrypt user data).
- Suspicious use of android.app.ApplicationPackageManager.getInstalledPackages
- Suspicious use of android.net.wifi.WifiInfo.getMacAddress
- Suspicious use of android.os.PowerManager$WakeLock.acquire
- Suspicious use of android.telephony.TelephonyManager.getLine1Number
- Uses reflection