c39bfff240c601301bbe829565d0800367d0ace885b3dd57a8dce0939dc56925

Analysis

max time kernel
3827162s
max time network
22s
platform
android_x86
resource
android-x86-arm-20220310-en
submitted
21-05-2022 00:38

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c39bfff240c601301bbe829565d0800367d0ace885b3dd57a8dce0939dc56925.apk
Size

1.4MB
MD5

7533f5ca89aa82464b9d997e9fe8e1e5
SHA1

413c5868ef3b92c6fa44423404c1ea6b9d4d110f
SHA256

c39bfff240c601301bbe829565d0800367d0ace885b3dd57a8dce0939dc56925
SHA512

5ac86bdce43d7de3e18e6e4e68097a9217ed20e520bf4a9670026297544a1055f642829b1a05b1b48498e58919f524fd3d108cea0fd0cd2ed3e7ab6eaccf6ec9

Score

7^/10

evasion ransomware

Malware Config

Signatures

Loads dropped Dex/Jar 2 IoCs

Runs executable file dropped to the device during analysis.

Processes:

/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.holidayzuowen.daquan/app_dlythclasses.jar --output-vdex-fd=45 --oat-fd=46 --oat-location=/data/user/0/com.holidayzuowen.daquan/oat/x86/app_dlythclasses.odex --compiler-filter=quicken --class-loader-context=&com.holidayzuowen.daquan

ioc	pid	process
/data/user/0/com.holidayzuowen.daquan/app_dlythclasses.jar	5394	/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.holidayzuowen.daquan/app_dlythclasses.jar --output-vdex-fd=45 --oat-fd=46 --oat-location=/data/user/0/com.holidayzuowen.daquan/oat/x86/app_dlythclasses.odex --compiler-filter=quicken --class-loader-context=&
/data/user/0/com.holidayzuowen.daquan/app_dlythclasses.jar	5320	com.holidayzuowen.daquan

Reads information about phone network operator.
Removes a system notification. 1 IoCs
evasion

Processes:

com.holidayzuowen.daquan

description ioc process

Framework service call android.app.INotificationManager.cancelNotificationWithTag com.holidayzuowen.daquan
Uses Crypto APIs (Might try to encrypt user data). 1 IoCs
ransomware

Processes:

com.holidayzuowen.daquan

description ioc process

Framework API call javax.crypto.Cipher.doFinal com.holidayzuowen.daquan

description	ioc	process
Framework service call	android.app.INotificationManager.cancelNotificationWithTag	com.holidayzuowen.daquan

description	ioc	process
Framework API call	javax.crypto.Cipher.doFinal	com.holidayzuowen.daquan

com.holidayzuowen.daquan
1⤵
- Loads dropped Dex/Jar
- Removes a system notification.
- Uses Crypto APIs (Might try to encrypt user data).
PID:5320

/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.holidayzuowen.daquan/app_dlythclasses.jar --output-vdex-fd=45 --oat-fd=46 --oat-location=/data/user/0/com.holidayzuowen.daquan/oat/x86/app_dlythclasses.odex --compiler-filter=quicken --class-loader-context=&
2⤵
- Loads dropped Dex/Jar
PID:5394

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

/data/user/0/com.holidayzuowen.daquan/app_dlythclasses.jar
Filesize
74KB

MD5
cdf0e23ad21f57d01dd604a785b61ce9

SHA1
04bd3243ae3a9b25f4b640ea1a26c8cd33d4a3dd

SHA256
a70803de9a3570b95a098227f30f88080deb67154018aabe11ece5cfcb734e90

SHA512
b19b8ad5d21a9de8017b0c51f36f70383bbbb6403d6efab0a886a18c9c2b76dc7596b3ca6b9763854cc0262e930dbb21005811c3eb27aea07151f072a2e0fc4a

Download Submit
/data/user/0/com.holidayzuowen.daquan/app_dlythclasses.jar
Filesize
174KB

MD5
64e7e8755d3dbc9e42690b0ef8541980

SHA1
d2c736f98f94b9acc43819ff400b41ea5597af44

SHA256
aedb223c1d1048e554c19d009463f50d1db0bda5bc6f648751f024ff384d6b8e

SHA512
aee929c78d862cbc3d8f3be3b5924ea00321fbdfab90b04b867278a7c62a0bcdba06a285750594f76443a4b28adbd03eed57a44bf52f69f7321a99968818623c

Download Submit
/data/user/0/com.holidayzuowen.daquan/app_dlythclasses.jar
Filesize
174KB

MD5
1e175297eb85729c246e5b5bf2a49fae

SHA1
7376c397e596b46cc5d92cc478655cb29f8f68f2

SHA256
9480fafb84f2d27613bfde2ac31b8237c3e3e9fb1412f401df5cad6cf2ad62f1

SHA512
a04680d2c080f19a285d132308e69b589819d4c624ba67091000b01711176afd002fb5cef3f586b9d7d9bedf87dc50fdc0d58f0d14df2690c51b5b96d9f2a506

Download Submit
/data/user/0/com.holidayzuowen.daquan/app_dlythclasses.jar.x86.flock
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/com.holidayzuowen.daquan/app_webview/Web Data
Filesize
104KB

MD5
dc79f9ce5f3ab5270b33e61119dfc959

SHA1
1844bf222a5144b513dcf2fb50a18c011701c647

SHA256
47e65f4de08deabfd52ecdb8b0a29c61c482188b92c36182e2112ca0a8f4ff65

SHA512
18b8894a7f35df516f423bbdebf1e05ce09eaf4345b139e59e603cadb81f8d1fa20f793438c28e8fd9a64e64f0684223d90ce6f10d3f93cb0c781049a8cff03e

Download Submit
/data/user/0/com.holidayzuowen.daquan/app_webview/Web Data-journal
Filesize
1KB

MD5
8678f0c507f70631c1e98f5ba28cec1b

SHA1
8eb171179e318124ca3b4f3e3bd1688c3700e190

SHA256
83b27f010edd85bfbca18f0da7414ac54d94db7899f98277b11692dc22280cac

SHA512
22deff379b5d891c0be6a69d3c64ed29b7066c73148f9a923105df51cbf5ed67aeca56b0e8e66f9ad387b44ac81334cfc37c5d06bc8083506ff14ea13429610a

Download Submit
/data/user/0/com.holidayzuowen.daquan/app_webview/metrics_guid
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/com.holidayzuowen.daquan/app_webview/metrics_guid
Filesize
36B

MD5
265926cb56d1092c1dc5c95289564acc

SHA1
897b4e2b0546b6b8ed2268318d08d8a9669d0db4

SHA256
9bbf2bbe10c98a33cbf3b6bc7aa99a9a3bea72f1d3431c60dc92290c3a14a852

SHA512
984e526ab127b836de7ef39ec96dada033bae40f17ffd06814e14248dc4c8377b063f3f1b65c317ed73e5471123e1def8811867eddad350209915c2d20cdde8a

Download Submit
/data/user/0/com.holidayzuowen.daquan/app_webview/variations_seed_new
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/com.holidayzuowen.daquan/app_webview/variations_stamp
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/com.holidayzuowen.daquan/app_webview/webview_data.lock
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/com.holidayzuowen.daquan/databases/dbzjilg
Filesize
4KB

MD5
f2b4b0190b9f384ca885f0c8c9b14700

SHA1
934ff2646757b5b6e7f20f6a0aa76c7f995d9361

SHA256
0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514

SHA512
ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1

Download Submit
/data/user/0/com.holidayzuowen.daquan/databases/dbzjilg-journal
Filesize
524B

MD5
323315f442525f3f2a8b00c7cf8706a8

SHA1
dfea4d3e4e2a4efc3065945353613d240f83e03a

SHA256
15ff5ce3cadb4dadbdc936cbedb5c7633988ff5628e909d64724ea097daacac1

SHA512
606365640a807dc25382a282f9ef21fa371c5712cf4556a83f1bda280d9f7ac06474c0462dc38323f116ed4ef712c48f5f9bf61bc16c3960592e186b00d65be5

Download Submit
/data/user/0/com.holidayzuowen.daquan/databases/dbzjilg-shm
Filesize
8B

MD5
7dea362b3fac8e00956a4952a3d4f474

SHA1
05fe405753166f125559e7c9ac558654f107c7e9

SHA256
af5570f5a1810b7af78caf4bc70a660f0df51e42baf91d4de5b2328de0e83dfc

SHA512
1b7409ccf0d5a34d3a77eaabfa9fe27427655be9297127ee9522aa1bf4046d4f945983678169cb1a7348edcac47ef0d9e2c924130e5bcc5f0d94937852c42f1b

Download Submit
/data/user/0/com.holidayzuowen.daquan/databases/dbzjilg-wal
Filesize
173KB

MD5
8359bdde8dca3d9c8ff8ef0a96923963

SHA1
fbc17ec929d78a3f87c6972fd61fa4f52e2b9de3

SHA256
d4c257808b9e9933d76d1509c0aa768cbea30f773662772b7a68fdccf1405657

SHA512
727b20926cdb25eaf44ef335a1228c8b90574361ae8b85e858201d89159ad3a6afcd5dd552457ff8ad5224c86a16111d6b92c46ac6b8679e04e32f28ad4c7429

Download Submit
/data/user/0/com.holidayzuowen.daquan/files/akla
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/com.holidayzuowen.daquan/files/umeng_it.cache
Filesize
310B

MD5
b0b62e0905f6ac1681c9e17494e93cb0

SHA1
ab7f43928203508e505579cf6889fff2b9f66c4f

SHA256
17783b1cb64fd9e7eaa3a697519d78b3108cae6b0a4a06e3d18380e1189c3848

SHA512
1339743357b2811d819339864e8a5d536d3b3929b427176541c7a73f7828d4cf880e64f9958ce2906c69a7464daf3e2c01b586afb2ec59dd84f06f66e9b53cc0

Download Submit
/data/user/0/com.holidayzuowen.daquan/oat/app_dlythclasses.jar.cur.prof
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/com.holidayzuowen.daquan/oat/x86/app_dlythclasses.odex
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/com.holidayzuowen.daquan/oat/x86/app_dlythclasses.vdex
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/com.holidayzuowen.daquan/shared_prefs/WebViewChromiumPrefs.xml
Filesize
127B

MD5
21223e9184445fe043476484cd8cb1f9

SHA1
2b4813f849121d60ba35eb0889080668bb62c778

SHA256
bb61b7c087c2ae2de93a7740ff75707342940557146366e92b840284cd9446af

SHA512
be21408de0cc643650e5d9ab9057a8f9de88e37fbdc6417cfeba160402ec4cd14fccbc82cbbfd941ecfc0bb3d4056ee61ac199efdc99d647d53e65818835fd48

Download Submit
/data/user/0/com.holidayzuowen.daquan/shared_prefs/a.xml
Filesize
65B

MD5
9781ca003f10f8d0c9c1945b63fdca7f

SHA1
4156cf5dc8d71dbab734d25e5e1598b37a5456f4

SHA256
3325d2a819fdd8062c2cdc48a09b995c9b012915bcdf88b1cf9742a7f057c793

SHA512
25a9877e274e0e9df29811825bd4f680fa0bf0ae6219527e4f1dcd17d0995d28b2926192d961a06ee5bef2eed73b3f38ec4ffdd0a1cda7ff2a10dc5711ffdf03

Download Submit