9543678858d6c81c26f35506807ecf4d1e8071ed5bc0fcd5bfc1639f82593503

Analysis

max time kernel
3821680s
max time network
166s
platform
android_x64
resource
android-x64-20220310-en
submitted
20-05-2022 23:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

9543678858d6c81c26f35506807ecf4d1e8071ed5bc0fcd5bfc1639f82593503.apk
Size

699KB
MD5

e3ca3c6236e962975f24f7e18b515df2
SHA1

8c3dabbc9c75958c1df94d1720129e177bc21c18
SHA256

9543678858d6c81c26f35506807ecf4d1e8071ed5bc0fcd5bfc1639f82593503
SHA512

d0e9e7102c0e5f81ad6cf22b42923ad523665642c9bac3d694b362f0597dfe352e4398137b499661c0160d114da6c658b2fe0755fc07b5d18bb982205ab872fa

Score

7^/10

ransomware

Malware Config

Signatures

Loads dropped Dex/Jar 1 IoCs
Runs executable file dropped to the device during analysis.

Processes:

com.android.NPlayer

ioc pid process

/data/user/0/com.android.NPlayer/files/1653089118077.apk 6280 com.android.NPlayer

ioc	pid	process
/data/user/0/com.android.NPlayer/files/1653089118077.apk	6280	com.android.NPlayer

Requests dangerous framework permissions 16 IoCs

Processes:

description	ioc
Allows read only access to phone state, including the current cellular network information, the status of any ongoing calls, and a list of any PhoneAccounts registered on the device.	android.permission.READ_PHONE_STATE
Allows an application to write to external storage.	android.permission.WRITE_EXTERNAL_STORAGE
Allows an app to access approximate location.	android.permission.ACCESS_COARSE_LOCATION
Allows read only access to phone state, including the current cellular network information, the status of any ongoing calls, and a list of any PhoneAccounts registered on the device.	android.permission.READ_PHONE_STATE
Allows an application to see the number being dialed during an outgoing call with the option to redirect the call to a different number or abort the call altogether.	android.permission.PROCESS_OUTGOING_CALLS
Allows an application to read from external storage.	android.permission.READ_EXTERNAL_STORAGE
Allows an application to write to external storage.	android.permission.WRITE_EXTERNAL_STORAGE
Allows an app to access approximate location.	android.permission.ACCESS_COARSE_LOCATION
Allows an application to record audio.	android.permission.RECORD_AUDIO
Allows read only access to phone state, including the current cellular network information, the status of any ongoing calls, and a list of any PhoneAccounts registered on the device.	android.permission.READ_PHONE_STATE
Allows an application to write to external storage.	android.permission.WRITE_EXTERNAL_STORAGE
Allows an application to read from external storage.	android.permission.READ_EXTERNAL_STORAGE
Allows an app to access approximate location.	android.permission.ACCESS_COARSE_LOCATION
Allows an app to access precise location.	android.permission.ACCESS_FINE_LOCATION
Allows an application to read the user's contacts data.	android.permission.READ_CONTACTS
Required to be able to access the camera device.	android.permission.CAMERA

Uses Crypto APIs (Might try to encrypt user data). 1 IoCs
ransomware

Processes:

com.android.NPlayer

description ioc process

Framework API call javax.crypto.Cipher.doFinal com.android.NPlayer

description	ioc	process
Framework API call	javax.crypto.Cipher.doFinal	com.android.NPlayer

com.android.NPlayer
1⤵
- Loads dropped Dex/Jar
- Uses Crypto APIs (Might try to encrypt user data).
PID:6280

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

/data/user/0/com.android.NPlayer/apps_/com.plugin.main/apk/base-1.apk
Filesize
98KB

MD5
ccc23feb8284b430d5a2bbcdf49dd281

SHA1
68cea176a1e3af12ec0dffeca319fcc0d72c6a70

SHA256
c39b9e388e978a516dbfcee8d9a072b76874e3363b3c55e684c598a42119374d

SHA512
d825b3175c920ef5aede79fcabbba2fc1e016e85d1f5f0e053215f950853e4861afdd837319df34b7cab7388c89e5b40d1aeaeaaf1ab14d0e7c0033bb25255ab

Download Submit
/data/user/0/com.android.NPlayer/cache/.android/icon001.png
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/com.android.NPlayer/cache/.android/icon001.png
Filesize
98KB

MD5
ccc23feb8284b430d5a2bbcdf49dd281

SHA1
68cea176a1e3af12ec0dffeca319fcc0d72c6a70

SHA256
c39b9e388e978a516dbfcee8d9a072b76874e3363b3c55e684c598a42119374d

SHA512
d825b3175c920ef5aede79fcabbba2fc1e016e85d1f5f0e053215f950853e4861afdd837319df34b7cab7388c89e5b40d1aeaeaaf1ab14d0e7c0033bb25255ab

Download Submit
/data/user/0/com.android.NPlayer/databases/su.sqlite
Filesize
96KB

MD5
cfffb0adef8f301eb5fd66713ed5e905

SHA1
3808a6abe8013a94f744b5bd28c8076d965d77be

SHA256
4fdce836c7071c037ba3fda6245e40d1362b30f37adbc1115efc30905a97c283

SHA512
cbb6a0cceccab9395c44215358f028beb6bd2cea2dd6623780093dc8b9e5e44955766abdb0734b908ba8549139c03429584aa243227c26a5a93c3a726fa577da

Download Submit
/data/user/0/com.android.NPlayer/databases/su.sqlite-journal
Filesize
1KB

MD5
b906716012a4ce630852b5d7bce075a5

SHA1
b2074ee2d3100c9a4c8a2ec959bd3852615c26b6

SHA256
50dc6cf5899de891c1c3e3c8f2e2de27993035e890c10ee02eb99c8948d1a563

SHA512
82d10ef57e2e069e00293ea0cfb5532c2afd4fadcaf7d4917158b817a316bc674093da33b6ce265fab705194b44258247e134128e5fc1797ad05d5658c400a3c

Download Submit
/data/user/0/com.android.NPlayer/files/1653089118077.apk
Filesize
119KB

MD5
e07916184016b476476a0247832e835a

SHA1
1e64a8cc37aa29bf71e121c7deb914b8c0de23e9

SHA256
067616b3f81198c3a1f62b942af75c3d049339e3d1bc2ca8c86ba81fe4e22a60

SHA512
8d06932c74960263fae71cda519a56873941af18ab969e8f6b7459db41fd9822fe858a4e4a6c246f159fbe1d88248ab37edd48eac4dc1002109ec3624e39e934

Download Submit
/data/user/0/com.android.NPlayer/files/1653089118077.apk
Filesize
326KB

MD5
934d3df4650fdedf44400e77cc17c746

SHA1
2ba1237395f5c08e4810daa0ae90f9bac2f0e24c

SHA256
269eebe9b16155670d3b39df97fe1ed87465ae533f47a611dd3a56de3f6c5c54

SHA512
b2f30f32d80c33dbc4cd8b4a0a90aa63d0e11bd8937f1504f82f124095daa68664b2d8633bdbabb774b14f14c8e8d84cec1e5e6bb0c24e0fb6ec03ede6e5e228

Download Submit
/data/user/0/com.android.NPlayer/files/core_service
Filesize
37B

MD5
97754d003206873595a32b10524d0a8e

SHA1
024a65e52a513f00db30641fa2ccf46252960d2d

SHA256
d806171bb9bb29702523fe9bf03dd556885bd2ecf56c0be6b55904fcb9260301

SHA512
3b497303b392e13ec6e33a7c103dedf794fb0298b2a808a354a5a213e0a53531ca8328ce0db03f66c25dfc593a0b3debc890a188efa9ee325364448d30d250ef

Download Submit
/data/user/0/com.android.NPlayer/files/libicons.so
Filesize
119KB

MD5
b2d65f6efb1cfd0baf59c68a676f64a3

SHA1
4ab43f1e553d73d9a2e9d7f77b3273078a9feb2a

SHA256
1e9914bd881eaeb75eead074490cb46fe5bacba8ffe2bdd74430b8a52dbf6371

SHA512
ae5916cabf15354941d5a98e58181a83059dc59662e91a9946944eb13bda7d8b400e8905b81131bac9e518d774e98c7e79942f54296e166aa69915d813219947

Download Submit
/data/user/0/com.android.NPlayer/files/libs_data
Filesize
19B

MD5
198b9638f44d83a6831c053cefd157db

SHA1
68be3e14c63b0b0802c2c7831c2d53b07f6b342a

SHA256
e1b0bc0b9f9b7c617428aecfeeda705950b2bd1abf4c7f9f8c351594fc49de04

SHA512
2cb87ca1fca3334499ee2d6054190715da8424cbaef97683e732ae8fe55805bb8ecffbfb1b4507eba0c27be194012faf20c2c2a608c959249906ef72adfa1f71

Download Submit
/data/user/0/com.android.NPlayer/files/oat/1653089118077.apk.cur.prof
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit