d2f6af1a739e94dca5d99220b5c5371bfcc0f038b465b739c8c13ee01b51d575

Analysis

max time kernel
3848096s
max time network
153s
platform
android_x86
resource
android-x86-arm-20220310-en
submitted
21-05-2022 03:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d2f6af1a739e94dca5d99220b5c5371bfcc0f038b465b739c8c13ee01b51d575.apk
Size

4.7MB
MD5

f9d9d95aa4ae4236243997f00a013440
SHA1

ab2cbbba5d20980717ccd0e30568084d8eff641c
SHA256

d2f6af1a739e94dca5d99220b5c5371bfcc0f038b465b739c8c13ee01b51d575
SHA512

3b890f1262f9b97683af995f0a5635c404c33e8134a3b4f292b646ffd99b8de1f3c3e48efdb2e47de1c88d1c7a0a6d5ad949c139eb6954413852236e593fbe77

Score

7^/10

evasion ransomware

Malware Config

Signatures

Loads dropped Dex/Jar 2 IoCs

Runs executable file dropped to the device during analysis.

Processes:

/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/io.cloud.H519C98B0/files/0.jar --output-vdex-fd=42 --oat-fd=43 --oat-location=/data/user/0/io.cloud.H519C98B0/files/oat/x86/0.odex --compiler-filter=quicken --class-loader-context=&io.cloud.H519C98B0

ioc	pid	process
/data/user/0/io.cloud.H519C98B0/files/0.jar	5178	/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/io.cloud.H519C98B0/files/0.jar --output-vdex-fd=42 --oat-fd=43 --oat-location=/data/user/0/io.cloud.H519C98B0/files/oat/x86/0.odex --compiler-filter=quicken --class-loader-context=&
/data/user/0/io.cloud.H519C98B0/files/0.jar	5142	io.cloud.H519C98B0

Reads information about phone network operator.
Removes a system notification. 1 IoCs
evasion

Processes:

io.cloud.H519C98B0

description ioc process

Framework service call android.app.INotificationManager.cancelNotificationWithTag io.cloud.H519C98B0
Uses Crypto APIs (Might try to encrypt user data). 1 IoCs
ransomware

Processes:

io.cloud.H519C98B0

description ioc process

Framework API call javax.crypto.Cipher.doFinal io.cloud.H519C98B0

description	ioc	process
Framework service call	android.app.INotificationManager.cancelNotificationWithTag	io.cloud.H519C98B0

description	ioc	process
Framework API call	javax.crypto.Cipher.doFinal	io.cloud.H519C98B0

io.cloud.H519C98B0
1⤵
- Loads dropped Dex/Jar
- Removes a system notification.
- Uses Crypto APIs (Might try to encrypt user data).
PID:5142
- /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/io.cloud.H519C98B0/files/0.jar --output-vdex-fd=42 --oat-fd=43 --oat-location=/data/user/0/io.cloud.H519C98B0/files/oat/x86/0.odex --compiler-filter=quicken --class-loader-context=&
  2⤵
  - Loads dropped Dex/Jar
  PID:5178

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

/data/user/0/io.cloud.H519C98B0/app_webview/Cookies

Filesize
64KB

MD5
cb7543c4df600f2af58097cce0e334ba

SHA1
83cc92f38c27fdb4fa519b1ce2f37912f24af1f0

SHA256
64c022ae708f94ffde986e105d88f708884de325720bfb9925c4160a6d417233

SHA512
ad51cad0472327bd68aa2d791341cfafed58971752352537bb603ed18b15a3f9185e9150983a28ecd09606e8dcaef6d1c9d93213dd246ef7720f39842eb3d980

Download Submit
/data/user/0/io.cloud.H519C98B0/app_webview/Cookies-journal

Filesize
1KB

MD5
c0bb19c9700ecdb43371f10810822dd1

SHA1
075f37dc11f54b45b3c61f668f56dbaea80cf409

SHA256
958a2ea98a89c9ab8d533c5259796acf8b8cc8f1c97c763396a77d1f9a831047

SHA512
99668fb5d8efaa63a20e1d25e22c736d25bcfb2b18fbd8527847f678b0762756b04731ba842bac050147fabaf08f70f1d1bc2b737786bc75dce374f4d5c48d34

Download Submit
/data/user/0/io.cloud.H519C98B0/app_webview/GPUCache/index

Filesize
20B

MD5
93027d42b314432c4216e6cfca48b384

SHA1
43448dd8102979c3926828182579691945eedd4e

SHA256
3cda72e67c62e52a342309c44f2cb3b6c1019c7b11822e2f628e48e254e2b41c

SHA512
a52d13cf7f5be196d1e2f135b8a010f80558c5d35e90e7792441d1c976517d55cf1c9587949db69ebef294cc6ef79529a65e7d779964793016efecacd152f70e

Download Submit
/data/user/0/io.cloud.H519C98B0/app_webview/GPUCache/index-dir/temp-index

Filesize
48B

MD5
0ec3d33c307765880dbb54fe6b479d8d

SHA1
3d3224d670a3cb186399feba78ebae53f99cfdef

SHA256
bf04541b4017cefb80a07b50d1a44d44ac922de29f9362d951e44ba0353a4fc2

SHA512
3175015d15f8594f662558198b4f5c4a5625a9fb9202a94ae2009eab8798893873acc149968c6e20cc51963ac3426244f5d99ed70accc054c7a421080813ae2f

Download Submit
/data/user/0/io.cloud.H519C98B0/app_webview/Web Data

Filesize
104KB

MD5
dc79f9ce5f3ab5270b33e61119dfc959

SHA1
1844bf222a5144b513dcf2fb50a18c011701c647

SHA256
47e65f4de08deabfd52ecdb8b0a29c61c482188b92c36182e2112ca0a8f4ff65

SHA512
18b8894a7f35df516f423bbdebf1e05ce09eaf4345b139e59e603cadb81f8d1fa20f793438c28e8fd9a64e64f0684223d90ce6f10d3f93cb0c781049a8cff03e

Download Submit
/data/user/0/io.cloud.H519C98B0/app_webview/Web Data-journal

Filesize
1KB

MD5
63c8cdec8233c88088a191af07fcdfb9

SHA1
8ce1fce2142028a644121747164e35f1a54eacfc

SHA256
5c4b3bf1fdf6e92cd22d0b4884eb073cdc1112d6188ee19919142f02c13d7ff2

SHA512
f3df6d45e4a68e8a8e079644f53581fae8853d37da038fcb9d0fa2b98964b5cc3f25c94abe98a709ea9c9d95d84ce9a563f29be8759214a584a2897d02197767

Download Submit
/data/user/0/io.cloud.H519C98B0/app_webview/metrics_guid

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/io.cloud.H519C98B0/app_webview/metrics_guid

Filesize
36B

MD5
4301b5429a50539d9c36cecf4278ca66

SHA1
844fd114414982cfd42d743487b33244ebd8e0b4

SHA256
90802da75d60d73e2b6012c9bd6997c3ceb4d0f312d98afd8f2320a6aeaec487

SHA512
b37b4abe03dff9d207ea2e004d92fd23dd98c021f54be2b22c5cc382e693a9fe52ac9fab2957d6da8bb46a84303d59b5ef4aee2076f7f08c43287a09607981bf

Download Submit
/data/user/0/io.cloud.H519C98B0/app_webview/variations_seed_new

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/io.cloud.H519C98B0/app_webview/variations_stamp

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/io.cloud.H519C98B0/app_webview/webview_data.lock

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/io.cloud.H519C98B0/databases/soi.db

Filesize
4KB

MD5
f2b4b0190b9f384ca885f0c8c9b14700

SHA1
934ff2646757b5b6e7f20f6a0aa76c7f995d9361

SHA256
0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514

SHA512
ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1

Download Submit
/data/user/0/io.cloud.H519C98B0/databases/soi.db-journal

Filesize
524B

MD5
94229054c45d34a6c3eb95d39f58790a

SHA1
39d0ba0d9afe9fd495fb1b89dab5dc2586c303b3

SHA256
657a13f1639a0ed99decb549e3d042d50ed87b92f5dfdfaa9a33ecba8946a7c0

SHA512
c38062adf64b5591da3787c005286aa0b9b05d0d677659e91c410ec27db738f28a5df09582f66190613749d3867414d94ac85095961c172434b66e35bd2cdb88

Download Submit
/data/user/0/io.cloud.H519C98B0/databases/soi.db-shm

Filesize
8B

MD5
7dea362b3fac8e00956a4952a3d4f474

SHA1
05fe405753166f125559e7c9ac558654f107c7e9

SHA256
af5570f5a1810b7af78caf4bc70a660f0df51e42baf91d4de5b2328de0e83dfc

SHA512
1b7409ccf0d5a34d3a77eaabfa9fe27427655be9297127ee9522aa1bf4046d4f945983678169cb1a7348edcac47ef0d9e2c924130e5bcc5f0d94937852c42f1b

Download Submit
/data/user/0/io.cloud.H519C98B0/databases/soi.db-wal

Filesize
32KB

MD5
5546e8906a6d9950e596463d1abf0c8b

SHA1
bfca62b7c1e48f6defa6ab481135094189cd7278

SHA256
a22bda1bc935d5177b28eb485cf616b4e23d689123e8d5906c9376c169625ebc

SHA512
97389a0dba28f7e5a735ac0492e784635972574f40497943c78d329349101b030d84a564ca8920ab2ee6d6ae07ef016a955ec72f74ea10670e758588dec32e22

Download Submit
/data/user/0/io.cloud.H519C98B0/files/.imei.txt

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/io.cloud.H519C98B0/files/0.jar

Filesize
107KB

MD5
5dfab3bb0b24c6627505d55e8060fa42

SHA1
e43afd94a7aa3a699231fca41d94503ce49a1ec5

SHA256
169e560bdd308bb03c53084a5618a3ebb8f5596548a9e83b9cb1387343ffaf64

SHA512
7b781063fa98e00b20a484361b0408482522bdd5fa635ff186b06b8f61b285038bf3591c47201059ab2be23c2b0098320b3f49be48c183f44d94abadde2d3b03

Download Submit
/data/user/0/io.cloud.H519C98B0/files/0.jar

Filesize
216KB

MD5
36c4828381056c960b06b428dd2b4a56

SHA1
c46cac49a5932093f3f558cfd2d22cfe725814cf

SHA256
75d54402b0fefe326a02f523166aef552c8ffe6c102505c6a50c35092cc829b9

SHA512
eb8271d23e02a9fbe1d2e4f02cb164b936b9ef0544fcdcb4c0686063462300e6bb96a9e4340c32156dded9163f8ac9c98272eae240f0f7133c41951ca5692b99

Download Submit
/data/user/0/io.cloud.H519C98B0/files/0.jar

Filesize
216KB

MD5
fe918199fa08de0327a29a32ef6806e7

SHA1
be950e76d9325d12ba4edc4637e8ba97e598fdd0

SHA256
092a5fe810fe06e3b9d530473ce9124623b69109a7e70b31a84f8676ea4b4a5d

SHA512
65cbec43174aa89e44b587802b51ae0ed5fe078d4afeb5510de25d810e8f18e9bbeceb689abf415900a04691a2a679aa3bd5f70dc683a3d8be5e444c1043d1c9

Download Submit
/data/user/0/io.cloud.H519C98B0/files/0.jar.x86.flock

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/io.cloud.H519C98B0/files/oat/0.jar.cur.prof

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/io.cloud.H519C98B0/files/oat/x86/0.odex

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/io.cloud.H519C98B0/files/oat/x86/0.vdex

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/io.cloud.H519C98B0/shared_prefs/WebViewChromiumPrefs.xml

Filesize
127B

MD5
21223e9184445fe043476484cd8cb1f9

SHA1
2b4813f849121d60ba35eb0889080668bb62c778

SHA256
bb61b7c087c2ae2de93a7740ff75707342940557146366e92b840284cd9446af

SHA512
be21408de0cc643650e5d9ab9057a8f9de88e37fbdc6417cfeba160402ec4cd14fccbc82cbbfd941ecfc0bb3d4056ee61ac199efdc99d647d53e65818835fd48

Download Submit
/storage/emulated/0/.imei.txt

Filesize
32B

MD5
7e84a169a8fa0ee68cf6dbbfa6fd0ec7

SHA1
dc13a025b867b8cb22cd4fc083e0b088b9cc830d

SHA256
bc93936947e4857cc9f2c7bd069650f906d33cf4be306ff8121eb71f1f8cbe68

SHA512
e2aadae627fc023d21e1ad9f8777a78d8981373fc2c6e573997cd1f4416298cf5ec8a2c4fd1bf5e8e430670e76319efbda17036023a6c6f679dd068c83c60246

Download Submit