9543678858d6c81c26f35506807ecf4d1e8071ed5bc0fcd5bfc1639f82593503

Analysis

max time kernel
3821679s
max time network
156s
platform
android_x86
resource
android-x86-arm-20220310-en
submitted
20-05-2022 23:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

9543678858d6c81c26f35506807ecf4d1e8071ed5bc0fcd5bfc1639f82593503.apk
Size

699KB
MD5

e3ca3c6236e962975f24f7e18b515df2
SHA1

8c3dabbc9c75958c1df94d1720129e177bc21c18
SHA256

9543678858d6c81c26f35506807ecf4d1e8071ed5bc0fcd5bfc1639f82593503
SHA512

d0e9e7102c0e5f81ad6cf22b42923ad523665642c9bac3d694b362f0597dfe352e4398137b499661c0160d114da6c658b2fe0755fc07b5d18bb982205ab872fa

Score

7^/10

ransomware

Malware Config

Signatures

Loads dropped Dex/Jar 4 IoCs

Runs executable file dropped to the device during analysis.

Processes:

/system/bin/dex2oat --debuggable --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --debuggable --generate-mini-debug-info --dex-file=/data/user/0/com.android.NPlayer/files/1653089112523.apk --output-vdex-fd=44 --oat-fd=45 --oat-location=/data/user/0/com.android.NPlayer/files/oat/x86/1653089112523.odex --compiler-filter=quicken --class-loader-context=&com.android.NPlayer/system/bin/dex2oat --debuggable --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --debuggable --generate-mini-debug-info --dex-file=/data/user/0/com.android.NPlayer/apps_/com.plugin.main/apk/base-1.apk --output-vdex-fd=54 --oat-fd=55 --oat-location=/data/user/0/com.android.NPlayer/apps_/com.plugin.main/apk/oat/x86/base-1.odex --compiler-filter=quicken --class-loader-context=&

ioc	pid	process
/data/user/0/com.android.NPlayer/files/1653089112523.apk	5133	/system/bin/dex2oat --debuggable --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --debuggable --generate-mini-debug-info --dex-file=/data/user/0/com.android.NPlayer/files/1653089112523.apk --output-vdex-fd=44 --oat-fd=45 --oat-location=/data/user/0/com.android.NPlayer/files/oat/x86/1653089112523.odex --compiler-filter=quicken --class-loader-context=&
/data/user/0/com.android.NPlayer/files/1653089112523.apk	5093	com.android.NPlayer
/data/user/0/com.android.NPlayer/apps_/com.plugin.main/apk/base-1.apk	5291	/system/bin/dex2oat --debuggable --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --debuggable --generate-mini-debug-info --dex-file=/data/user/0/com.android.NPlayer/apps_/com.plugin.main/apk/base-1.apk --output-vdex-fd=54 --oat-fd=55 --oat-location=/data/user/0/com.android.NPlayer/apps_/com.plugin.main/apk/oat/x86/base-1.odex --compiler-filter=quicken --class-loader-context=&
/data/user/0/com.android.NPlayer/apps_/com.plugin.main/apk/base-1.apk	5093	com.android.NPlayer

Requests dangerous framework permissions 16 IoCs

Processes:

description	ioc
Allows read only access to phone state, including the current cellular network information, the status of any ongoing calls, and a list of any PhoneAccounts registered on the device.	android.permission.READ_PHONE_STATE
Allows an application to write to external storage.	android.permission.WRITE_EXTERNAL_STORAGE
Allows an app to access approximate location.	android.permission.ACCESS_COARSE_LOCATION
Allows read only access to phone state, including the current cellular network information, the status of any ongoing calls, and a list of any PhoneAccounts registered on the device.	android.permission.READ_PHONE_STATE
Allows an application to see the number being dialed during an outgoing call with the option to redirect the call to a different number or abort the call altogether.	android.permission.PROCESS_OUTGOING_CALLS
Allows an application to read from external storage.	android.permission.READ_EXTERNAL_STORAGE
Allows an application to write to external storage.	android.permission.WRITE_EXTERNAL_STORAGE
Allows an app to access approximate location.	android.permission.ACCESS_COARSE_LOCATION
Allows an application to record audio.	android.permission.RECORD_AUDIO
Allows read only access to phone state, including the current cellular network information, the status of any ongoing calls, and a list of any PhoneAccounts registered on the device.	android.permission.READ_PHONE_STATE
Allows an application to write to external storage.	android.permission.WRITE_EXTERNAL_STORAGE
Allows an application to read from external storage.	android.permission.READ_EXTERNAL_STORAGE
Allows an app to access approximate location.	android.permission.ACCESS_COARSE_LOCATION
Allows an app to access precise location.	android.permission.ACCESS_FINE_LOCATION
Allows an application to read the user's contacts data.	android.permission.READ_CONTACTS
Required to be able to access the camera device.	android.permission.CAMERA

Uses Crypto APIs (Might try to encrypt user data). 1 IoCs
ransomware

Processes:

com.android.NPlayer

description ioc process

Framework API call javax.crypto.Cipher.doFinal com.android.NPlayer

description	ioc	process
Framework API call	javax.crypto.Cipher.doFinal	com.android.NPlayer

com.android.NPlayer
1⤵
- Loads dropped Dex/Jar
- Uses Crypto APIs (Might try to encrypt user data).
PID:5093

/system/bin/dex2oat --debuggable --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --debuggable --generate-mini-debug-info --dex-file=/data/user/0/com.android.NPlayer/files/1653089112523.apk --output-vdex-fd=44 --oat-fd=45 --oat-location=/data/user/0/com.android.NPlayer/files/oat/x86/1653089112523.odex --compiler-filter=quicken --class-loader-context=&
2⤵
- Loads dropped Dex/Jar
PID:5133

/system/bin/dex2oat --debuggable --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --debuggable --generate-mini-debug-info --dex-file=/data/user/0/com.android.NPlayer/apps_/com.plugin.main/apk/base-1.apk --output-vdex-fd=54 --oat-fd=55 --oat-location=/data/user/0/com.android.NPlayer/apps_/com.plugin.main/apk/oat/x86/base-1.odex --compiler-filter=quicken --class-loader-context=&
2⤵
- Loads dropped Dex/Jar
PID:5291

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

/data/user/0/com.android.NPlayer/apps_/com.plugin.main/apk/base-1.apk

Filesize
98KB

MD5
ccc23feb8284b430d5a2bbcdf49dd281

SHA1
68cea176a1e3af12ec0dffeca319fcc0d72c6a70

SHA256
c39b9e388e978a516dbfcee8d9a072b76874e3363b3c55e684c598a42119374d

SHA512
d825b3175c920ef5aede79fcabbba2fc1e016e85d1f5f0e053215f950853e4861afdd837319df34b7cab7388c89e5b40d1aeaeaaf1ab14d0e7c0033bb25255ab

Download Submit
/data/user/0/com.android.NPlayer/apps_/com.plugin.main/apk/base-1.apk

Filesize
171KB

MD5
6e23f06730e8a617ffd1f39e6f4a3a86

SHA1
dbf3cab199c0753de287702501be963d8bf6af5e

SHA256
17f0e215d2361ca40dace2a14cbab2e1d8511a568c2b21f0c81c96102997a141

SHA512
fa19b83705592d6b1574192bcea05b4c7babae49de38ed5945687b15c191b8a569d87ad72387ba2625df2e9e11b725264d850be2a865eb05a7193b910e54a4c1

Download Submit
/data/user/0/com.android.NPlayer/apps_/com.plugin.main/apk/base-1.apk

Filesize
171KB

MD5
6e23f06730e8a617ffd1f39e6f4a3a86

SHA1
dbf3cab199c0753de287702501be963d8bf6af5e

SHA256
17f0e215d2361ca40dace2a14cbab2e1d8511a568c2b21f0c81c96102997a141

SHA512
fa19b83705592d6b1574192bcea05b4c7babae49de38ed5945687b15c191b8a569d87ad72387ba2625df2e9e11b725264d850be2a865eb05a7193b910e54a4c1

Download Submit
/data/user/0/com.android.NPlayer/apps_/com.plugin.main/apk/base-1.apk.x86.flock

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/com.android.NPlayer/apps_/com.plugin.main/apk/oat/base-1.apk.cur.prof

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/com.android.NPlayer/apps_/com.plugin.main/apk/oat/x86/base-1.odex

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/com.android.NPlayer/apps_/com.plugin.main/apk/oat/x86/base-1.vdex

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/com.android.NPlayer/cache/.android/icon001.png

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/com.android.NPlayer/cache/.android/icon001.png

Filesize
98KB

MD5
ccc23feb8284b430d5a2bbcdf49dd281

SHA1
68cea176a1e3af12ec0dffeca319fcc0d72c6a70

SHA256
c39b9e388e978a516dbfcee8d9a072b76874e3363b3c55e684c598a42119374d

SHA512
d825b3175c920ef5aede79fcabbba2fc1e016e85d1f5f0e053215f950853e4861afdd837319df34b7cab7388c89e5b40d1aeaeaaf1ab14d0e7c0033bb25255ab

Download Submit
/data/user/0/com.android.NPlayer/databases/su.sqlite

Filesize
24KB

MD5
7f48665da79d884504ea37ffaa16d5fc

SHA1
3c7987e1737134b2c23c7f1a07ab3342fc2c6706

SHA256
1b25513ad426715e6631ac4813b17cac2aeba934ab68411c31b63af6ac084172

SHA512
abf46b737e1601e158567ba21b6b278da587157037fcbc35d94bce7ce100d33690f40d89ccb01ac3e0565e847745e096dde83696a9f06aa493a38bdc4bc658e3

Download Submit
/data/user/0/com.android.NPlayer/databases/su.sqlite-journal

Filesize
524B

MD5
4419d81df84618225a6752b55f7cf281

SHA1
b0be8264e41be726f03974ab858d4291223b5a8d

SHA256
98f2015d35b47dbbd287a294fcfa5462f13e7e7e1c9b87b41210cf0b244a8df9

SHA512
78638eae84bd9d26615fcfed7bb2b3708db129901e22f38a95b98fa8fd00bd96fcfc627465efcedcde318061210fcdb85b6fb1d26544e4c0bd2a6a9d2cae5fd9

Download Submit
/data/user/0/com.android.NPlayer/databases/su.sqlite-shm

Filesize
8B

MD5
7dea362b3fac8e00956a4952a3d4f474

SHA1
05fe405753166f125559e7c9ac558654f107c7e9

SHA256
af5570f5a1810b7af78caf4bc70a660f0df51e42baf91d4de5b2328de0e83dfc

SHA512
1b7409ccf0d5a34d3a77eaabfa9fe27427655be9297127ee9522aa1bf4046d4f945983678169cb1a7348edcac47ef0d9e2c924130e5bcc5f0d94937852c42f1b

Download Submit
/data/user/0/com.android.NPlayer/databases/su.sqlite-wal

Filesize
40KB

MD5
ff156c2202da6d20c523747aa186b075

SHA1
c77563897dc4e685bbff18bf4fad62f350c1051e

SHA256
00f9ecfafa7931c22d291f81925b5c3deadab14d27a1783671683d2cdef2191c

SHA512
4879f113b9613e9f04c14ce983680ab06fb59b1bdeff5b42178bc94cf15221ec89638f2e21be7f565a80f8742cfd7371ed4e1f3f2107480259f35d0f35c4c213

Download Submit
/data/user/0/com.android.NPlayer/files/1653089112523.apk

Filesize
119KB

MD5
e07916184016b476476a0247832e835a

SHA1
1e64a8cc37aa29bf71e121c7deb914b8c0de23e9

SHA256
067616b3f81198c3a1f62b942af75c3d049339e3d1bc2ca8c86ba81fe4e22a60

SHA512
8d06932c74960263fae71cda519a56873941af18ab969e8f6b7459db41fd9822fe858a4e4a6c246f159fbe1d88248ab37edd48eac4dc1002109ec3624e39e934

Download Submit
/data/user/0/com.android.NPlayer/files/1653089112523.apk

Filesize
326KB

MD5
934d3df4650fdedf44400e77cc17c746

SHA1
2ba1237395f5c08e4810daa0ae90f9bac2f0e24c

SHA256
269eebe9b16155670d3b39df97fe1ed87465ae533f47a611dd3a56de3f6c5c54

SHA512
b2f30f32d80c33dbc4cd8b4a0a90aa63d0e11bd8937f1504f82f124095daa68664b2d8633bdbabb774b14f14c8e8d84cec1e5e6bb0c24e0fb6ec03ede6e5e228

Download Submit
/data/user/0/com.android.NPlayer/files/1653089112523.apk

Filesize
326KB

MD5
934d3df4650fdedf44400e77cc17c746

SHA1
2ba1237395f5c08e4810daa0ae90f9bac2f0e24c

SHA256
269eebe9b16155670d3b39df97fe1ed87465ae533f47a611dd3a56de3f6c5c54

SHA512
b2f30f32d80c33dbc4cd8b4a0a90aa63d0e11bd8937f1504f82f124095daa68664b2d8633bdbabb774b14f14c8e8d84cec1e5e6bb0c24e0fb6ec03ede6e5e228

Download Submit
/data/user/0/com.android.NPlayer/files/1653089112523.apk.x86.flock

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/com.android.NPlayer/files/core_service

Filesize
37B

MD5
97754d003206873595a32b10524d0a8e

SHA1
024a65e52a513f00db30641fa2ccf46252960d2d

SHA256
d806171bb9bb29702523fe9bf03dd556885bd2ecf56c0be6b55904fcb9260301

SHA512
3b497303b392e13ec6e33a7c103dedf794fb0298b2a808a354a5a213e0a53531ca8328ce0db03f66c25dfc593a0b3debc890a188efa9ee325364448d30d250ef

Download Submit
/data/user/0/com.android.NPlayer/files/libicons.so

Filesize
119KB

MD5
b2d65f6efb1cfd0baf59c68a676f64a3

SHA1
4ab43f1e553d73d9a2e9d7f77b3273078a9feb2a

SHA256
1e9914bd881eaeb75eead074490cb46fe5bacba8ffe2bdd74430b8a52dbf6371

SHA512
ae5916cabf15354941d5a98e58181a83059dc59662e91a9946944eb13bda7d8b400e8905b81131bac9e518d774e98c7e79942f54296e166aa69915d813219947

Download Submit
/data/user/0/com.android.NPlayer/files/libs_data

Filesize
19B

MD5
198b9638f44d83a6831c053cefd157db

SHA1
68be3e14c63b0b0802c2c7831c2d53b07f6b342a

SHA256
e1b0bc0b9f9b7c617428aecfeeda705950b2bd1abf4c7f9f8c351594fc49de04

SHA512
2cb87ca1fca3334499ee2d6054190715da8424cbaef97683e732ae8fe55805bb8ecffbfb1b4507eba0c27be194012faf20c2c2a608c959249906ef72adfa1f71

Download Submit
/data/user/0/com.android.NPlayer/files/oat/1653089112523.apk.cur.prof

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/com.android.NPlayer/files/oat/x86/1653089112523.odex

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/com.android.NPlayer/files/oat/x86/1653089112523.vdex

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit