e2fd8d6f7e8343ddc1908b5a14294bb0dff35f3ee0faa2c14d1507ba003fe961

Analysis

max time kernel
3828584s
max time network
15s
platform
android_x86
resource
android-x86-arm-20220310-en
submitted
21-05-2022 00:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e2fd8d6f7e8343ddc1908b5a14294bb0dff35f3ee0faa2c14d1507ba003fe961.apk
Size

620KB
MD5

f4bfaa1cfa4b5b2a46849c6ad6d777c8
SHA1

81b995e0b820456db399bf8a27289e320b806027
SHA256

e2fd8d6f7e8343ddc1908b5a14294bb0dff35f3ee0faa2c14d1507ba003fe961
SHA512

e3aee9972eda6adbb72028bd91a7327981b28658064b8c5e1aacabb3f85433b6dec1c587d4292a5099a5f2e0c7019f2d96c50c7c4af78fa018c2848358616686

Score

7^/10

evasion ransomware

Malware Config

Signatures

Loads dropped Dex/Jar 2 IoCs

Runs executable file dropped to the device during analysis.

Processes:

/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/org.maf5a.g47f617/app_rartoclasses.jar --output-vdex-fd=45 --oat-fd=46 --oat-location=/data/user/0/org.maf5a.g47f617/oat/x86/app_rartoclasses.odex --compiler-filter=quicken --class-loader-context=&org.maf5a.g47f617

ioc	pid	process
/data/user/0/org.maf5a.g47f617/app_rartoclasses.jar	5105	/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/org.maf5a.g47f617/app_rartoclasses.jar --output-vdex-fd=45 --oat-fd=46 --oat-location=/data/user/0/org.maf5a.g47f617/oat/x86/app_rartoclasses.odex --compiler-filter=quicken --class-loader-context=&
/data/user/0/org.maf5a.g47f617/app_rartoclasses.jar	5074	org.maf5a.g47f617

Removes a system notification. 1 IoCs
evasion

Processes:

org.maf5a.g47f617

description ioc process

Framework service call android.app.INotificationManager.cancelNotificationWithTag org.maf5a.g47f617
Uses Crypto APIs (Might try to encrypt user data). 1 IoCs
ransomware

Processes:

org.maf5a.g47f617

description ioc process

Framework API call javax.crypto.Cipher.doFinal org.maf5a.g47f617

description	ioc	process
Framework service call	android.app.INotificationManager.cancelNotificationWithTag	org.maf5a.g47f617

description	ioc	process
Framework API call	javax.crypto.Cipher.doFinal	org.maf5a.g47f617

org.maf5a.g47f617
1⤵
- Loads dropped Dex/Jar
- Removes a system notification.
- Uses Crypto APIs (Might try to encrypt user data).
PID:5074

/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/org.maf5a.g47f617/app_rartoclasses.jar --output-vdex-fd=45 --oat-fd=46 --oat-location=/data/user/0/org.maf5a.g47f617/oat/x86/app_rartoclasses.odex --compiler-filter=quicken --class-loader-context=&
2⤵
- Loads dropped Dex/Jar
PID:5105

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

/data/user/0/org.maf5a.g47f617/app_rartoclasses.jar
Filesize
74KB

MD5
0711345e53aeda943fad62d2379a5261

SHA1
9f1662d61114c512923ee2154f93567f7e69c6c7

SHA256
a36d713d00d8e49e05c5f66e46fc0100b4247fe35379dc6f4e8f5708b0307383

SHA512
8414e14e09991a078bf40461e70f5941b24948f5867933beefece275d8789eaff70fb2db4f13244b4b7cf5a091d9eb07d14f8daeb43de95a7e2eb4b2b83cd6ff

Download Submit
/data/user/0/org.maf5a.g47f617/app_rartoclasses.jar
Filesize
174KB

MD5
64c9ba5940c73f019a543d28c6f950a4

SHA1
dd367c3e434fc68fc6d1171f00abae7544008133

SHA256
58209934b4fbcb7a8e2921f150d520ef2bd5adfd0ec1e6f17964a686af364f27

SHA512
71ab32e41183c967ad1859cb49d1939bff95753a56c0a03c050fd72218affe0f1e99f4e9f4ea94b3b8a0835cbf229c417820aa5b1646e2f173387b375d788a26

Download Submit
/data/user/0/org.maf5a.g47f617/app_rartoclasses.jar
Filesize
174KB

MD5
5f409f290ec5bc9c765d910f5d22c1a4

SHA1
021a2e50b0fc2dadd3fa67ce6de094d8580a3b1d

SHA256
43d0baed6d50391ea62a4df5e03770d66b79f5a584269f89c588da0de54b94ca

SHA512
d3d55c6c0077145369b06766a07f1415c6320bb73d8dde5c9999aa3931730dc993e87c523adb3d578d198819e95181c046fe3033cd6d7e27cb1df086df5257d2

Download Submit
/data/user/0/org.maf5a.g47f617/app_rartoclasses.jar.x86.flock
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/org.maf5a.g47f617/app_webview/Cookies
Filesize
64KB

MD5
cb7543c4df600f2af58097cce0e334ba

SHA1
83cc92f38c27fdb4fa519b1ce2f37912f24af1f0

SHA256
64c022ae708f94ffde986e105d88f708884de325720bfb9925c4160a6d417233

SHA512
ad51cad0472327bd68aa2d791341cfafed58971752352537bb603ed18b15a3f9185e9150983a28ecd09606e8dcaef6d1c9d93213dd246ef7720f39842eb3d980

Download Submit
/data/user/0/org.maf5a.g47f617/app_webview/Cookies-journal
Filesize
1KB

MD5
37cc8ec990aa6fd85a60ac4e862af913

SHA1
ff29ba1be8167d42142e79c667d8eee0e08f16df

SHA256
a1cf253cce9696c9e13b3f6a8b9185a5ceccbe1f16ce0416545f1ab768233757

SHA512
98c1051095edac8afad69c77120a060e1b1516ac4c35fb8dfc04e5b9250d7a5eed6ebf07732d8313e852b23f5ccbdf4351fdab4313caf7945270a3f8a3ae535b

Download Submit
/data/user/0/org.maf5a.g47f617/app_webview/GPUCache/index
Filesize
20B

MD5
93027d42b314432c4216e6cfca48b384

SHA1
43448dd8102979c3926828182579691945eedd4e

SHA256
3cda72e67c62e52a342309c44f2cb3b6c1019c7b11822e2f628e48e254e2b41c

SHA512
a52d13cf7f5be196d1e2f135b8a010f80558c5d35e90e7792441d1c976517d55cf1c9587949db69ebef294cc6ef79529a65e7d779964793016efecacd152f70e

Download Submit
/data/user/0/org.maf5a.g47f617/app_webview/GPUCache/index-dir/temp-index
Filesize
48B

MD5
5e2fe71047dd0a0138e58a50ab2469b1

SHA1
69ada69e67b483e8ac244bf18685ba78d1cb6f3a

SHA256
74eab0f11f591e0c41f57b511abfe0f8958673829d397c97403ff64cb0c64a48

SHA512
4ca9638027d9b897dc06781225d93389b2834d9cbf43c90493fc76f70675176d52c1f571d6c3f3d500aafcd74aced658b3eb846710b40babab76dbe94c43495d

Download Submit
/data/user/0/org.maf5a.g47f617/app_webview/Web Data
Filesize
104KB

MD5
dc79f9ce5f3ab5270b33e61119dfc959

SHA1
1844bf222a5144b513dcf2fb50a18c011701c647

SHA256
47e65f4de08deabfd52ecdb8b0a29c61c482188b92c36182e2112ca0a8f4ff65

SHA512
18b8894a7f35df516f423bbdebf1e05ce09eaf4345b139e59e603cadb81f8d1fa20f793438c28e8fd9a64e64f0684223d90ce6f10d3f93cb0c781049a8cff03e

Download Submit
/data/user/0/org.maf5a.g47f617/app_webview/Web Data-journal
Filesize
1KB

MD5
568d0966ac961018e90526facc808edf

SHA1
f4cd6bda143d3204c7850c24f81766788ade9ed3

SHA256
a62144e66866a916626f817bdf0c9385422747cfdb8da86f6af48c51e4e4a03c

SHA512
d87ae6f149cf05bc9e8898a993017c8328a4b3c1323e09a5d68a17f474a9132059c3043fc0d08991bbfaf08b9264f2300facf8c40c38a0a574fec29cdb2f0976

Download Submit
/data/user/0/org.maf5a.g47f617/app_webview/metrics_guid
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/org.maf5a.g47f617/app_webview/metrics_guid
Filesize
36B

MD5
efaaa89ebee659275f7aa9b43dc4225d

SHA1
cfb8a264a73935feaed5807fd9d14efb4eaeedea

SHA256
9f7597221fa56236b9fbb24172928f5664a36a72afe89121b9062980bd36624f

SHA512
8e6973fac78e9473b2f3e48993446b3b8fd1ce6097e92db16862dc205ce61e9a98af2d3a833fc725b05006717e9168ee6554c3781b1874821dac365232f11c7d

Download Submit
/data/user/0/org.maf5a.g47f617/app_webview/variations_seed_new
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/org.maf5a.g47f617/app_webview/variations_stamp
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/org.maf5a.g47f617/app_webview/webview_data.lock
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/org.maf5a.g47f617/cache/org.chromium.android_webview/cd6ce661a600ffc9_0
Filesize
62B

MD5
995892cde0751b65aa31456a2c760ec8

SHA1
2698b8c709e8d41877132eb15cff63776a7915bd

SHA256
8331fd2e6e6aad80eb330a06c1e5a7869bd40582644822349b62d864af5f94b4

SHA512
a5563926ca6a3c339cb71e248c8bb973a21d7b4b24d4519c36b306bc64627c25d590fe73030b9b8327a83e0b5fe6159c175c1af8b51a56e902b001d1b8e83e07

Download Submit
/data/user/0/org.maf5a.g47f617/cache/org.chromium.android_webview/index
Filesize
20B

MD5
93027d42b314432c4216e6cfca48b384

SHA1
43448dd8102979c3926828182579691945eedd4e

SHA256
3cda72e67c62e52a342309c44f2cb3b6c1019c7b11822e2f628e48e254e2b41c

SHA512
a52d13cf7f5be196d1e2f135b8a010f80558c5d35e90e7792441d1c976517d55cf1c9587949db69ebef294cc6ef79529a65e7d779964793016efecacd152f70e

Download Submit
/data/user/0/org.maf5a.g47f617/cache/org.chromium.android_webview/index-dir/temp-index
Filesize
72B

MD5
28a0590ab9b0a797a0cf00d46ea98237

SHA1
2e9b30b50c89225eebe1a20f63457691fb943123

SHA256
f0dd2a18b54abecaee3c2113146261f544d39fd69ceb2d4dfc6fad57a3c81e1f

SHA512
50f37d30cddf0c5b62d3ec739e52037c044cb396462a0f47ce083beed95d21720ddad705f3ff1cb10d7494c2d844edd22130f47fd8a4da073e46ed16143e79cd

Download Submit
/data/user/0/org.maf5a.g47f617/databases/dbiawjl
Filesize
4KB

MD5
f2b4b0190b9f384ca885f0c8c9b14700

SHA1
934ff2646757b5b6e7f20f6a0aa76c7f995d9361

SHA256
0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514

SHA512
ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1

Download Submit
/data/user/0/org.maf5a.g47f617/databases/dbiawjl-journal
Filesize
524B

MD5
5466c9124b0c7f4e7b50b83bf229f770

SHA1
f825692da014bdf4763f88f4a3c0ae4f672f829a

SHA256
120ec7d2f71488bfcf3a53abac9a08929d27eda8154c5571a3b0df5d8661181b

SHA512
55a09b0b59a111aa8c9532737ebb63d85edf45e03f40cf3bf9839f417f756b643deafdbb908f2f450950e2745c525d8bfea8965b01b4524100edd9c875065794

Download Submit
/data/user/0/org.maf5a.g47f617/databases/dbiawjl-shm
Filesize
8B

MD5
7dea362b3fac8e00956a4952a3d4f474

SHA1
05fe405753166f125559e7c9ac558654f107c7e9

SHA256
af5570f5a1810b7af78caf4bc70a660f0df51e42baf91d4de5b2328de0e83dfc

SHA512
1b7409ccf0d5a34d3a77eaabfa9fe27427655be9297127ee9522aa1bf4046d4f945983678169cb1a7348edcac47ef0d9e2c924130e5bcc5f0d94937852c42f1b

Download Submit
/data/user/0/org.maf5a.g47f617/databases/dbiawjl-wal
Filesize
173KB

MD5
fc55c15f8e46d7d47a4761093c744b75

SHA1
10da72d50d0d824c08dd34dce9d9d33c7bd275e8

SHA256
17a33f9eb8796a31d0449d2e6f85f4e05b4682432afc60ca59ab558e36b43f20

SHA512
545c35868174cff9b76d8af14fd1d1e3f47a0b3d13972240858bce3ed8df75da43fdfe0146c2f37fc6a9dca5bcd9c858c3a305d8be6f910bf99249fe1b19579d

Download Submit
/data/user/0/org.maf5a.g47f617/files/czh
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/org.maf5a.g47f617/oat/app_rartoclasses.jar.cur.prof
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/org.maf5a.g47f617/oat/x86/app_rartoclasses.odex
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/org.maf5a.g47f617/oat/x86/app_rartoclasses.vdex
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/org.maf5a.g47f617/shared_prefs/WebViewChromiumPrefs.xml
Filesize
127B

MD5
21223e9184445fe043476484cd8cb1f9

SHA1
2b4813f849121d60ba35eb0889080668bb62c778

SHA256
bb61b7c087c2ae2de93a7740ff75707342940557146366e92b840284cd9446af

SHA512
be21408de0cc643650e5d9ab9057a8f9de88e37fbdc6417cfeba160402ec4cd14fccbc82cbbfd941ecfc0bb3d4056ee61ac199efdc99d647d53e65818835fd48

Download Submit