Analysis
-
max time kernel
3869944s -
max time network
151s -
platform
android_x86 -
resource
android-x86-arm-20220310-en -
submitted
21-05-2022 11:44
Static task
static1
Behavioral task
behavioral1
Sample
c677f42c5fed9258874c189cf741ced929992c5ecbe7c21687f5d0a38475de3a.apk
Resource
android-x86-arm-20220310-en
General
-
Target
c677f42c5fed9258874c189cf741ced929992c5ecbe7c21687f5d0a38475de3a.apk
-
Size
2.6MB
-
MD5
90fcd66e00e667cd30517cd8a473275a
-
SHA1
80b4ba5db7b6248f0db3ed64289c7c5aab953cda
-
SHA256
c677f42c5fed9258874c189cf741ced929992c5ecbe7c21687f5d0a38475de3a
-
SHA512
d661c38cff401b289358b00303c5bddf194e9fddcf135776c4497a00ef8f3f1742b276e82bcc3eecf376aeb3274967696ca5af27e7dd9aa030c7b6a3deb9c519
Malware Config
Signatures
-
Agent smith
Agent smith is a modular adware that installs malicious ADs into legitimate applications.
-
Requests cell location 1 IoCs
Uses Android APIs to to get current cell location.
Processes:
com.wrysdop.fghsdydescription ioc process Framework service call com.android.internal.telephony.ITelephony.getCellLocation com.wrysdop.fghsdy -
Requests dangerous framework permissions 8 IoCs
Processes:
description ioc Allows an application to send SMS messages. android.permission.SEND_SMS Allows read only access to phone state, including the current cellular network information, the status of any ongoing calls, and a list of any PhoneAccounts registered on the device. android.permission.READ_PHONE_STATE Allows an application to write to external storage. android.permission.WRITE_EXTERNAL_STORAGE Allows an application to read SMS messages. android.permission.READ_SMS Allows an app to access approximate location. android.permission.ACCESS_COARSE_LOCATION Allows an app to access precise location. android.permission.ACCESS_FINE_LOCATION Allows an application to read from external storage. android.permission.READ_EXTERNAL_STORAGE Allows an application to receive SMS messages. android.permission.RECEIVE_SMS -
Reads information about phone network operator.
-
Uses Crypto APIs (Might try to encrypt user data). 1 IoCs
Processes:
com.wrysdop.fghsdydescription ioc process Framework API call javax.crypto.Cipher.doFinal com.wrysdop.fghsdy -
Listens for changes in the sensor environment (might be used to detect emulation). 1 IoCs
Processes:
com.wrysdop.fghsdydescription ioc process Framework API call android.hardware.SensorManager.registerListener com.wrysdop.fghsdy
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
/data/user/0/com.wrysdop.fghsdy/app_jar/lpdf.jarFilesize
35KB
MD5e1ab911d4b585a26aae02d8540575013
SHA1ac148f7bdf95edddc97d9224ff51a771f1070520
SHA2568a71fab57b4a03f0b37095daa2eaa086ec6ed6c1c6166ca67c0e0a9e14cc85ca
SHA512983ec12cde3cbfaffb414b8c8eb17c793bee558eb51b9d5e630f9bd5f312e0ce55622719aad6097a799286c25001212b26d7053e7e110a4918beace33d3bcbc4
-
/data/user/0/com.wrysdop.fghsdy/app_jar/lpdf.jar.x86.flockMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
/data/user/0/com.wrysdop.fghsdy/app_jar/oat/x86/lpdf.odexMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
/data/user/0/com.wrysdop.fghsdy/app_jar/oat/x86/lpdf.vdexMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
/data/user/0/com.wrysdop.fghsdy/app_webview/Web DataFilesize
104KB
MD5dc79f9ce5f3ab5270b33e61119dfc959
SHA11844bf222a5144b513dcf2fb50a18c011701c647
SHA25647e65f4de08deabfd52ecdb8b0a29c61c482188b92c36182e2112ca0a8f4ff65
SHA51218b8894a7f35df516f423bbdebf1e05ce09eaf4345b139e59e603cadb81f8d1fa20f793438c28e8fd9a64e64f0684223d90ce6f10d3f93cb0c781049a8cff03e
-
/data/user/0/com.wrysdop.fghsdy/app_webview/Web Data-journalFilesize
1KB
MD53aabbcbff93d1027a944e236a794ffd4
SHA1932ef6bbfbe9f8fb99bba0b615f6bada19ea7927
SHA2565c86689c821f0301f66f35bd07c48eec2a01bbe12dbcd872b718256e95849a42
SHA512119661477d75bbaf977d3e513e40f4394d7a593a243402c43aec172fa6537d79625548129a33f26431cd9ea2d5009b3818a6fd94963e00d9b7a827b0c3727b9c
-
/data/user/0/com.wrysdop.fghsdy/app_webview/metrics_guidMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
/data/user/0/com.wrysdop.fghsdy/app_webview/metrics_guidFilesize
36B
MD5029afe0592239d6ecc87999ab6bba7ca
SHA1a4146ef8401ec23c2d8b6742845adc92532d08d5
SHA2567bfeae56c2c4da006a618af40eea7e0c74bc8078ade0ff95bd2d09fcb5fafd38
SHA512184a88fa39c056b36bd307874a41be70efd9f17f2468659fbb50d26068d45d926f2abf11ec6ff778d4367f380b1ef50c3dbe29b4f2ef180bd1f91955140f102b
-
/data/user/0/com.wrysdop.fghsdy/app_webview/variations_seed_newMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
/data/user/0/com.wrysdop.fghsdy/app_webview/variations_stampMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
/data/user/0/com.wrysdop.fghsdy/app_webview/webview_data.lockMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
/data/user/0/com.wrysdop.fghsdy/files/jiepayplugin.apkFilesize
45KB
MD5c83e81f064fbbff6870210fcc9abcf6c
SHA165f94be4a62160065ff192b9baac02da3a293031
SHA256fc37a898193dd0b37c226a5841936c88bc51a02bf99abe3f17ab84951a3aa1c9
SHA512100c617de8aadb73da780a8e16eccde545b9717bc0e77823efbc1d9831f13a2592a1a14d9e68ba49a364cf2a8029f6fee42d7268925da7f0112c18a5e9412164
-
/data/user/0/com.wrysdop.fghsdy/files/jiepayplugin.apk.x86.flockMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
/data/user/0/com.wrysdop.fghsdy/files/oat/x86/jiepayplugin.odexMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
/data/user/0/com.wrysdop.fghsdy/files/oat/x86/jiepayplugin.vdexMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
/data/user/0/com.wrysdop.fghsdy/files/yypyda.apkFilesize
38KB
MD5cc860a00cae01d4f2e88cfcbf05f06ff
SHA187778550a32109a679a2d28dec9ca4e6c0ca19fc
SHA256494a419030f286fb05789ded096c05326a44fe2ff6708a0ad2e2c862c5d8d347
SHA512dbe68454e053ff4d494ebf60daa52b856f64b393d37f89a8f91a0239c4ae799f51621b5bb791a497d93ff7b2e8194acfccd82994399f20166596275ccbb10057
-
/data/user/0/com.wrysdop.fghsdy/files/yypyda.apk.x86.flockMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
/data/user/0/com.wrysdop.fghsdy/shared_prefs/WebViewChromiumPrefs.xmlFilesize
127B
MD521223e9184445fe043476484cd8cb1f9
SHA12b4813f849121d60ba35eb0889080668bb62c778
SHA256bb61b7c087c2ae2de93a7740ff75707342940557146366e92b840284cd9446af
SHA512be21408de0cc643650e5d9ab9057a8f9de88e37fbdc6417cfeba160402ec4cd14fccbc82cbbfd941ecfc0bb3d4056ee61ac199efdc99d647d53e65818835fd48
-
/data/user/0/com.wrysdop.fghsdy/shared_prefs/XinZF_conf.xmlFilesize
122B
MD576a516ec620e2508e512a673a58347a3
SHA1386e9ee5d38602ebdca74bc24b24d75b1a765e8c
SHA256245368df69958cb3da7feaea45e63731daf36a8954e5982bc36ed91eb439c6b5
SHA512e4e96e50d4119fb2ba9d28b997b4991cf5e14ea7ea43c25304c3a40850a7744491f25e2ee0c7e500bc02e203669ff1cdee302f96534960bbcca3760ff8d192a8
-
/data/user/0/com.wrysdop.fghsdy/shared_prefs/XinZF_conf.xmlFilesize
169B
MD52c003843f31fe946438ec2e20491c4b8
SHA107766e5e6822a588152416f1baf829040651e3ea
SHA256297c6ec3713a44e596b540066ddad6545576807105927641f9cbfd1181cb1780
SHA512bbf1c0c226733cfce8e874ba5adc7a3a6ae817c009358cdf273676094c1e182cfecbcae93c97e41577b108404fa724ca8a8281e0c546cce727c0babcd8b461bb
-
/data/user/0/com.wrysdop.fghsdy/shared_prefs/umeng_common_config.xmlFilesize
111B
MD55acb60a50a1f0a5bc2d4fc5d7978b19b
SHA12c5cda2a4f47a907dd0232aceb1004e0b66157e8
SHA25641da56751a46f0705483702f2a9876b57423f8149a1b8c380687e4a4e6e7cf65
SHA512fe56620646904d128fbf9e73738fe0d0cd2e3d967ef05a898855d08784fa4c7aa58577b74989eb7bff7754a8c47ba023066ffee9efdd16624df1259ee293a0ff
-
/data/user/0/com.wrysdop.fghsdy/shared_prefs/umeng_common_config.xmlFilesize
171B
MD5d14aa94c2bd96667b652c97a3cc55e00
SHA10e1eb870bab045be2a5c88fec9133bffd72ad732
SHA256184053215b0364dee2b3b250ca11c7d0f1ce44bd15d29d8064ac9c86a41ae227
SHA51214ad7f703d9840017f945cbb4591c7b4fd16b80d9be5e0d87eb66dc0f476193c4cad5dddb061f7020bc11bf5487e465399c7d3d6e18afcac9d607f6d74fd675e
-
/data/user/0/com.wrysdop.fghsdy/shared_prefs/umeng_common_config.xmlFilesize
236B
MD5b7c9060a765cd30e9f0b23f059aa74d7
SHA136374c7793b214416adbc105162983993c71cc29
SHA256d0d25b9f2b2b1ec32b7124d321de8c6fc662c133d4ee5a79f80dade361f171ca
SHA5126693dbcb4de8ecc16fa661052292626c5692409837b49ecd7e237ef2e41d81e35dc80385612b98af71367517ea5043c231e54ab187bd36926ccb86921ddf78b2
-
/data/user/0/com.wrysdop.fghsdy/shared_prefs/umeng_common_location.xmlFilesize
390B
MD5324cdd9e86b8fb412defc558b036680e
SHA18f54afa42baf41d538f0f02bcc9c4e8e0106723c
SHA256234373510f164b28162a7b89b5ebe1d0955697d97cf2f991e269b10b1f80bfaa
SHA5122b08cd705f8d22da534285b6d47a88b35d37b4d2bdc7207cfd65ae0493629d6feccc3bcf55791a27f40448e784d66e129ca8bd92e1a3bcf532b21c3a293e5fdc