2de0f59fd03512e5527c8b8b19595483564ae54cd4904457c4f5bf127949019d

General

Target

2de0f59fd03512e5527c8b8b19595483564ae54cd4904457c4f5bf127949019d.apk
Size

3.5MB
MD5

678317ea1af55da1cddab31417a3c173
SHA1

07f0fb32e675ae022c96a54ac4ed7aa0c21c052d
SHA256

2de0f59fd03512e5527c8b8b19595483564ae54cd4904457c4f5bf127949019d
SHA512

b135fbedddfb0c1942a59ac016159273ad0f50b717412520a22b48bc2c953134033930dcd751fc7018abcf765908f954f27b5b0f1ba323a914e090cd232a6df7

Score

7^/10

obfuscation ransomware

Malware Config

Signatures

Loads dropped Dex/Jar 1 IoCs
Runs executable file dropped to the device during analysis.

Processes:

com.hxfumpfgokky.bufvpk

ioc pid process

/data/user/0/com.hxfumpfgokky.bufvpk/code_cache/secondary-dexes/base.apk.classes1.zip 3647 com.hxfumpfgokky.bufvpk
Uses Crypto APIs (Might try to encrypt user data). 1 IoCs
ransomware

Processes:

com.hxfumpfgokky.bufvpk

description ioc process

Framework API call javax.crypto.Cipher.doFinal com.hxfumpfgokky.bufvpk

ioc	pid	process
/data/user/0/com.hxfumpfgokky.bufvpk/code_cache/secondary-dexes/base.apk.classes1.zip	3647	com.hxfumpfgokky.bufvpk

description	ioc	process
Framework API call	javax.crypto.Cipher.doFinal	com.hxfumpfgokky.bufvpk

Uses reflection 58 IoCs

obfuscation

Processes:

com.hxfumpfgokky.bufvpk

description	pid	process
Invokes method com.hxfumpfgokky.bufvpk.luhawehaho$a.m23178070	3647	com.hxfumpfgokky.bufvpk
Invokes method com.hxfumpfgokky.bufvpk.luhawehaho$a.m23178070	3647	com.hxfumpfgokky.bufvpk
Invokes method com.hxfumpfgokky.bufvpk.luhawehaho$a.m23178070	3647	com.hxfumpfgokky.bufvpk
Invokes method com.hxfumpfgokky.bufvpk.luhawehaho$a.m23178070	3647	com.hxfumpfgokky.bufvpk
Invokes method com.hxfumpfgokky.bufvpk.luhawehaho$a.m23178070	3647	com.hxfumpfgokky.bufvpk
Invokes method com.hxfumpfgokky.bufvpk.luhawehaho$a.m23178070	3647	com.hxfumpfgokky.bufvpk
Invokes method com.hxfumpfgokky.bufvpk.luhawehaho$a.m23178070	3647	com.hxfumpfgokky.bufvpk
Invokes method com.hxfumpfgokky.bufvpk.luhawehaho$a.m23178070	3647	com.hxfumpfgokky.bufvpk
Invokes method com.hxfumpfgokky.bufvpk.luhawehaho$a.m23178070	3647	com.hxfumpfgokky.bufvpk
Invokes method com.hxfumpfgokky.bufvpk.luhawehaho$a.m23178070	3647	com.hxfumpfgokky.bufvpk
Invokes method com.hxfumpfgokky.bufvpk.luhawehaho$a.m23178070	3647	com.hxfumpfgokky.bufvpk
Invokes method com.hxfumpfgokky.bufvpk.luhawehaho$a.m23178070	3647	com.hxfumpfgokky.bufvpk
Invokes method com.hxfumpfgokky.bufvpk.luhawehaho$a.m23178070	3647	com.hxfumpfgokky.bufvpk
Invokes method com.hxfumpfgokky.bufvpk.luhawehaho$a.m23178070	3647	com.hxfumpfgokky.bufvpk
Invokes method com.hxfumpfgokky.bufvpk.luhawehaho$a.m23178070	3647	com.hxfumpfgokky.bufvpk
Invokes method com.hxfumpfgokky.bufvpk.luhawehaho$a.m23178070	3647	com.hxfumpfgokky.bufvpk
Invokes method com.hxfumpfgokky.bufvpk.luhawehaho$a.m23178070	3647	com.hxfumpfgokky.bufvpk
Invokes method com.hxfumpfgokky.bufvpk.luhawehaho$a.m23178070	3647	com.hxfumpfgokky.bufvpk
Invokes method com.hxfumpfgokky.bufvpk.luhawehaho$a.m23178070	3647	com.hxfumpfgokky.bufvpk
Invokes method com.hxfumpfgokky.bufvpk.luhawehaho$a.m23178070	3647	com.hxfumpfgokky.bufvpk
Invokes method com.hxfumpfgokky.bufvpk.luhawehaho$a.m23178070	3647	com.hxfumpfgokky.bufvpk
Invokes method com.hxfumpfgokky.bufvpk.luhawehaho$a.m23178070	3647	com.hxfumpfgokky.bufvpk
Invokes method com.hxfumpfgokky.bufvpk.luhawehaho$a.m23178070	3647	com.hxfumpfgokky.bufvpk
Invokes method com.hxfumpfgokky.bufvpk.luhawehaho$a.m23178070	3647	com.hxfumpfgokky.bufvpk
Invokes method com.hxfumpfgokky.bufvpk.luhawehaho$a.m23178070	3647	com.hxfumpfgokky.bufvpk
Invokes method com.hxfumpfgokky.bufvpk.luhawehaho$a.m23178070	3647	com.hxfumpfgokky.bufvpk
Invokes method com.hxfumpfgokky.bufvpk.luhawehaho$a.m23178070	3647	com.hxfumpfgokky.bufvpk
Invokes method com.hxfumpfgokky.bufvpk.luhawehaho$a.m23178070	3647	com.hxfumpfgokky.bufvpk
Invokes method com.hxfumpfgokky.bufvpk.luhawehaho$a.m23178070	3647	com.hxfumpfgokky.bufvpk
Invokes method com.hxfumpfgokky.bufvpk.luhawehaho$a.m23178070	3647	com.hxfumpfgokky.bufvpk
Invokes method com.hxfumpfgokky.bufvpk.luhawehaho$a.m23178070	3647	com.hxfumpfgokky.bufvpk
Invokes method com.hxfumpfgokky.bufvpk.luhawehaho$a.m23178070	3647	com.hxfumpfgokky.bufvpk
Invokes method com.hxfumpfgokky.bufvpk.luhawehaho$a.m23178070	3647	com.hxfumpfgokky.bufvpk
Invokes method com.hxfumpfgokky.bufvpk.luhawehaho$a.m23178070	3647	com.hxfumpfgokky.bufvpk
Invokes method com.hxfumpfgokky.bufvpk.luhawehaho$a.m23178070	3647	com.hxfumpfgokky.bufvpk
Invokes method com.hxfumpfgokky.bufvpk.luhawehaho$a.m23178070	3647	com.hxfumpfgokky.bufvpk
Invokes method com.hxfumpfgokky.bufvpk.luhawehaho$a.m23178070	3647	com.hxfumpfgokky.bufvpk
Invokes method com.hxfumpfgokky.bufvpk.luhawehaho$a.m23178070	3647	com.hxfumpfgokky.bufvpk
Invokes method com.hxfumpfgokky.bufvpk.luhawehaho$a.m23178070	3647	com.hxfumpfgokky.bufvpk
Invokes method com.hxfumpfgokky.bufvpk.luhawehaho$a.m23178070	3647	com.hxfumpfgokky.bufvpk
Invokes method com.hxfumpfgokky.bufvpk.luhawehaho$a.m23178070	3647	com.hxfumpfgokky.bufvpk
Invokes method com.hxfumpfgokky.bufvpk.luhawehaho$a.m23178070	3647	com.hxfumpfgokky.bufvpk
Invokes method com.hxfumpfgokky.bufvpk.luhawehaho$a.m23178070	3647	com.hxfumpfgokky.bufvpk
Invokes method com.hxfumpfgokky.bufvpk.luhawehaho$a.m23178070	3647	com.hxfumpfgokky.bufvpk
Invokes method com.hxfumpfgokky.bufvpk.luhawehaho$a.m23178070	3647	com.hxfumpfgokky.bufvpk
Invokes method com.hxfumpfgokky.bufvpk.luhawehaho$a.m23178070	3647	com.hxfumpfgokky.bufvpk
Invokes method com.hxfumpfgokky.bufvpk.luhawehaho$a.m23178070	3647	com.hxfumpfgokky.bufvpk
Invokes method n0.c.m7fc56270	3647	com.hxfumpfgokky.bufvpk
Invokes method com.hxfumpfgokky.bufvpk.jabupezosani.m877db9c7	3647	com.hxfumpfgokky.bufvpk
Invokes method com.hxfumpfgokky.bufvpk.jabupezosani.m3ca6da2b	3647	com.hxfumpfgokky.bufvpk
Invokes method q.c.f	3647	com.hxfumpfgokky.bufvpk
Invokes method com.hxfumpfgokky.bufvpk.jabupezosani.m5b8ec5ff	3647	com.hxfumpfgokky.bufvpk
Invokes method n0.c.m8fa14cdd	3647	com.hxfumpfgokky.bufvpk
Invokes method com.hxfumpfgokky.bufvpk.jabupezosani.m6dcac249	3647	com.hxfumpfgokky.bufvpk
Invokes method j1.j.m9dd4e461	3647	com.hxfumpfgokky.bufvpk
Invokes method com.hxfumpfgokky.bufvpk.jabupezosani.mc69e25a1	3647	com.hxfumpfgokky.bufvpk
Invokes method q.c.j	3647	com.hxfumpfgokky.bufvpk
Invokes method com.hxfumpfgokky.bufvpk.jabupezosani.mf59a087c	3647	com.hxfumpfgokky.bufvpk

com.hxfumpfgokky.bufvpk
1⤵
- Loads dropped Dex/Jar
- Uses Crypto APIs (Might try to encrypt user data).
- Uses reflection
PID:3647

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

/data/user/0/com.hxfumpfgokky.bufvpk/code_cache/secondary-dexes/MultiDex.lock

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/com.hxfumpfgokky.bufvpk/code_cache/secondary-dexes/base.apk.classes1.zip

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/com.hxfumpfgokky.bufvpk/code_cache/secondary-dexes/tmp-base.apk.classes8350985264175312236.zip

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/com.hxfumpfgokky.bufvpk/shared_prefs/multidex.version.xml

MD5
5f6b8f2857fa2985815f61c7303abde8

SHA1
f04a8340bb70a2b6914f67988d917eb4055feddd

SHA256
99b4caada7256369915e1059425d84b26d781e9f9819466c4895f16483fcf259

SHA512
69eb4d667a97963745edf67c5f4956280fc7e89f3b178650a6547d5a47e80c2ecec908b14295f82be3dc2296202e7d8274aa709ad824e63c7c6a44851a1f80cf

Download Submit

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads