Analysis

  • max time kernel
    3874568s
  • max time network
    118s
  • platform
    android_x86
  • resource
    android-x86-arm-20220310-en
  • submitted
    21-05-2022 12:19

General

  • Target

    e808a80b2af346552137154f4de5e6c95c947d8d20662e4c58b61de08184d52b.apk

  • Size

    8.9MB

  • MD5

    73e089277895a2529a235cf6d036221c

  • SHA1

    2a553b9147a1b317479b344d3fc3140e211ff961

  • SHA256

    e808a80b2af346552137154f4de5e6c95c947d8d20662e4c58b61de08184d52b

  • SHA512

    20ac1bece446e8bebbfcdbe5134ca8a2ea5b04e1680567c4aee4d58127ade31e6408877766c64d78859e6dbcbfab80baed8ae8d92860ea0633bc005ba471e786

Score
7/10

Malware Config

Signatures

  • Loads dropped Dex/Jar 4 IoCs

    Runs executable file dropped to the device during analysis.

  • Removes a system notification. 1 IoCs
  • Uses Crypto APIs (Might try to encrypt user data). 1 IoCs

Processes

  • com.appbasic.scaryphotoframesmwcfzpcrkaoaea
    1⤵
    • Loads dropped Dex/Jar
    • Removes a system notification.
    • Uses Crypto APIs (Might try to encrypt user data).
    PID:5272
    • /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.appbasic.scaryphotoframesmwcfzpcrkaoaea/app_db49bcd2-9923-438b-95d0-6d64c5e7c12a/eh.jar --output-vdex-fd=45 --oat-fd=46 --oat-location=/data/user/0/com.appbasic.scaryphotoframesmwcfzpcrkaoaea/app_db49bcd2-9923-438b-95d0-6d64c5e7c12a/oat/x86/eh.odex --compiler-filter=quicken --class-loader-context=&
      2⤵
      • Loads dropped Dex/Jar
      PID:5392
    • /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.appbasic.scaryphotoframesmwcfzpcrkaoaea/cache/1582435991586.jar --output-vdex-fd=64 --oat-fd=66 --oat-location=/data/user/0/com.appbasic.scaryphotoframesmwcfzpcrkaoaea/cache/oat/x86/1582435991586.odex --compiler-filter=quicken --class-loader-context=&
      2⤵
      • Loads dropped Dex/Jar
      PID:5526

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/user/0/com.appbasic.scaryphotoframesmwcfzpcrkaoaea/app_anonymous_files/anonymous_core.so
    Filesize

    37KB

    MD5

    b88c19b9b32947c589f8b76b13079ca5

    SHA1

    f66ec8de8ad22eca6558ca4093aef15979f0ed00

    SHA256

    678247d97e938d9f55b99882407587402643b53706cdab0d259ee5e92cd2e22e

    SHA512

    a213a56d7285b0a084b1e81b91e0e4cc33faab3cccf36639317902f50071f062b911bc04c3fd34d0ef5f0abd806ed1a47d1d0c184dbf99cbf8eb56e7cb50915f

  • /data/user/0/com.appbasic.scaryphotoframesmwcfzpcrkaoaea/app_db49bcd2-9923-438b-95d0-6d64c5e7c12a/eh.jar
    Filesize

    31KB

    MD5

    097b8098786ce8a5455b09e10a91d832

    SHA1

    02845fddd39ad68fd00cd11038cacc24d85b9797

    SHA256

    ad80e3e6e45c9223962e43ce7ad69fe3cc842b1f3841c71b33567b417becd030

    SHA512

    23fd4ff8afd0e4a84fc8a95a1acccc90a47f6ed95ce54ae3ecfbb5bbc9bb1916ae0683fb05abb260e68198848b012fe04cd95b5fdeb51f64a3ee12ec94a3b99f

  • /data/user/0/com.appbasic.scaryphotoframesmwcfzpcrkaoaea/app_db49bcd2-9923-438b-95d0-6d64c5e7c12a/eh.jar
    Filesize

    74KB

    MD5

    d370db14ad0c4c3ad3196b2b4d47084e

    SHA1

    5ecf34b7c99b8b0ae2b2dd0befe8ccfc74afd4b0

    SHA256

    ed1c03dd83c466974e4620ce657d4c3bff94b7be1e7691961f6304bd818ab8b8

    SHA512

    9736368efc98f665670935513b9fa59cd371f2a17d580535b9bbd66de64988ce53d8c2e5743eb53ac7f733b4d8915b878b16cdcb356b74fcfbc1323e16aae140

  • /data/user/0/com.appbasic.scaryphotoframesmwcfzpcrkaoaea/app_db49bcd2-9923-438b-95d0-6d64c5e7c12a/eh.jar
    Filesize

    74KB

    MD5

    b4037da282b296a561cff2b6ea4c78a2

    SHA1

    ef87d574400ce856795f24a345fdc9c614f3018f

    SHA256

    1f871dbaf326b3c831044ba079ac6367ffdb69c337b597fef34fd9a012dbf59b

    SHA512

    416b84566f85297d43aa7648f5d762d4e2720c61245bf91e122184a5bb7f237932db9617834734784f8d01e9ebaa77baaddc12fbfb4da92c6e21ba4c97606308

  • /data/user/0/com.appbasic.scaryphotoframesmwcfzpcrkaoaea/app_db49bcd2-9923-438b-95d0-6d64c5e7c12a/eh.jar.x86.flock
    MD5

    d41d8cd98f00b204e9800998ecf8427e

    SHA1

    da39a3ee5e6b4b0d3255bfef95601890afd80709

    SHA256

    e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

    SHA512

    cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

  • /data/user/0/com.appbasic.scaryphotoframesmwcfzpcrkaoaea/app_db49bcd2-9923-438b-95d0-6d64c5e7c12a/oat/eh.jar.cur.prof
    MD5

    d41d8cd98f00b204e9800998ecf8427e

    SHA1

    da39a3ee5e6b4b0d3255bfef95601890afd80709

    SHA256

    e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

    SHA512

    cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

  • /data/user/0/com.appbasic.scaryphotoframesmwcfzpcrkaoaea/app_db49bcd2-9923-438b-95d0-6d64c5e7c12a/oat/x86/eh.odex
    MD5

    d41d8cd98f00b204e9800998ecf8427e

    SHA1

    da39a3ee5e6b4b0d3255bfef95601890afd80709

    SHA256

    e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

    SHA512

    cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

  • /data/user/0/com.appbasic.scaryphotoframesmwcfzpcrkaoaea/app_db49bcd2-9923-438b-95d0-6d64c5e7c12a/oat/x86/eh.vdex
    MD5

    d41d8cd98f00b204e9800998ecf8427e

    SHA1

    da39a3ee5e6b4b0d3255bfef95601890afd80709

    SHA256

    e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

    SHA512

    cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

  • /data/user/0/com.appbasic.scaryphotoframesmwcfzpcrkaoaea/app_webview/Cookies
    Filesize

    64KB

    MD5

    cb7543c4df600f2af58097cce0e334ba

    SHA1

    83cc92f38c27fdb4fa519b1ce2f37912f24af1f0

    SHA256

    64c022ae708f94ffde986e105d88f708884de325720bfb9925c4160a6d417233

    SHA512

    ad51cad0472327bd68aa2d791341cfafed58971752352537bb603ed18b15a3f9185e9150983a28ecd09606e8dcaef6d1c9d93213dd246ef7720f39842eb3d980

  • /data/user/0/com.appbasic.scaryphotoframesmwcfzpcrkaoaea/app_webview/Cookies-journal
    Filesize

    1KB

    MD5

    2030b5b8735bb7e96f4900ca29f13fe5

    SHA1

    2d41e1f2dda903926d2a1b6c32c40019412d8044

    SHA256

    dbffbc7dfa16f7cece588a5fb9352f6afad3f4d5c912173dc6e33289f3f5e79d

    SHA512

    d858b9afecd9b9d4b9f24fffcf85a089e6ffa23e73a1afc297056232accaeb1cd728af077cca766bc0e24ba5548242dbb895fb6981833f2fd2ddbdf5d069da36

  • /data/user/0/com.appbasic.scaryphotoframesmwcfzpcrkaoaea/app_webview/GPUCache/index
    Filesize

    20B

    MD5

    93027d42b314432c4216e6cfca48b384

    SHA1

    43448dd8102979c3926828182579691945eedd4e

    SHA256

    3cda72e67c62e52a342309c44f2cb3b6c1019c7b11822e2f628e48e254e2b41c

    SHA512

    a52d13cf7f5be196d1e2f135b8a010f80558c5d35e90e7792441d1c976517d55cf1c9587949db69ebef294cc6ef79529a65e7d779964793016efecacd152f70e

  • /data/user/0/com.appbasic.scaryphotoframesmwcfzpcrkaoaea/app_webview/GPUCache/index-dir/temp-index
    Filesize

    48B

    MD5

    1ade52095fa85cd5d52b71efb30e441a

    SHA1

    7351bbb2b679a2cf2a68a13b8c72be969dab4935

    SHA256

    63630a7bcfb6c0a5b77111768c3cbd24475d45d006718537fe2433c243ac3882

    SHA512

    57aac2eacca72c7dacb13ef73862aa2b1dabe0ec50e487026f31c9029f44518875a37b73c489b8a4ce3a8374ba57d6470be9c1f2fa394b574e4ede4c7e7ac0eb

  • /data/user/0/com.appbasic.scaryphotoframesmwcfzpcrkaoaea/app_webview/Web Data
    Filesize

    104KB

    MD5

    dc79f9ce5f3ab5270b33e61119dfc959

    SHA1

    1844bf222a5144b513dcf2fb50a18c011701c647

    SHA256

    47e65f4de08deabfd52ecdb8b0a29c61c482188b92c36182e2112ca0a8f4ff65

    SHA512

    18b8894a7f35df516f423bbdebf1e05ce09eaf4345b139e59e603cadb81f8d1fa20f793438c28e8fd9a64e64f0684223d90ce6f10d3f93cb0c781049a8cff03e

  • /data/user/0/com.appbasic.scaryphotoframesmwcfzpcrkaoaea/app_webview/Web Data-journal
    Filesize

    1KB

    MD5

    98dc390482456506784db727d2cd8dfa

    SHA1

    970c256fc15a7d7727643c425105f0611824329b

    SHA256

    f4764d4395892306e07cb5f21066e5ca932e25d9b20d183729bee3eb5cbaf7cd

    SHA512

    329248a42836afb793f714fd486445bf22fd0b58134e7fc4f4470fb44fad7fea66c3f1a056518eb79f868faad21954e1e318ddd837ba6e292b1d8ad374a9b7c1

  • /data/user/0/com.appbasic.scaryphotoframesmwcfzpcrkaoaea/app_webview/metrics_guid
    MD5

    d41d8cd98f00b204e9800998ecf8427e

    SHA1

    da39a3ee5e6b4b0d3255bfef95601890afd80709

    SHA256

    e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

    SHA512

    cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

  • /data/user/0/com.appbasic.scaryphotoframesmwcfzpcrkaoaea/app_webview/metrics_guid
    Filesize

    36B

    MD5

    96ab233026507df888dd8efbe8d69eb3

    SHA1

    82a6cd763f04e23798e8f0f6bff553ac1d1eb654

    SHA256

    723bbd97bde65dfa62fa28ba34223952c3c30a51b3fe450f1f99578c3396af6d

    SHA512

    c265fae6d105d40167f4a9736457260aacef314bd2b888b30bbe4f7ddec280cb2332035790835db4d4db3ced55f22ea76ce9f82ba9088b42c3db70ce9100dee2

  • /data/user/0/com.appbasic.scaryphotoframesmwcfzpcrkaoaea/app_webview/variations_seed_new
    MD5

    d41d8cd98f00b204e9800998ecf8427e

    SHA1

    da39a3ee5e6b4b0d3255bfef95601890afd80709

    SHA256

    e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

    SHA512

    cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

  • /data/user/0/com.appbasic.scaryphotoframesmwcfzpcrkaoaea/app_webview/variations_stamp
    MD5

    d41d8cd98f00b204e9800998ecf8427e

    SHA1

    da39a3ee5e6b4b0d3255bfef95601890afd80709

    SHA256

    e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

    SHA512

    cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

  • /data/user/0/com.appbasic.scaryphotoframesmwcfzpcrkaoaea/app_webview/webview_data.lock
    MD5

    d41d8cd98f00b204e9800998ecf8427e

    SHA1

    da39a3ee5e6b4b0d3255bfef95601890afd80709

    SHA256

    e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

    SHA512

    cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

  • /data/user/0/com.appbasic.scaryphotoframesmwcfzpcrkaoaea/cache/1582435991586.jar
    MD5

    d41d8cd98f00b204e9800998ecf8427e

    SHA1

    da39a3ee5e6b4b0d3255bfef95601890afd80709

    SHA256

    e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

    SHA512

    cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

  • /data/user/0/com.appbasic.scaryphotoframesmwcfzpcrkaoaea/cache/1582435991586.jar
    Filesize

    20KB

    MD5

    2048eb6124a452540ee51dae4145aadf

    SHA1

    d05005b2cd7fe4cd652b0d7fd1bdac2c19d51451

    SHA256

    105c54b6fe3f25350e92187467761598e4c21d62b1091b77d091f65f3bd98864

    SHA512

    bb6cb3853dd2a5d0701e20607d4e153ae201268dd2e5e2d06cc2df208b3b4dc50132a4ab428251b1644d2399fcc717662438d082ff14203387bab8794109d44d

  • /data/user/0/com.appbasic.scaryphotoframesmwcfzpcrkaoaea/cache/1582435991586.jar
    Filesize

    20KB

    MD5

    fde2ee00cbd121cfab5290b078aa3ceb

    SHA1

    e2b77d5320e155e413d040a8c20020962065b2f8

    SHA256

    2897b0812077c654a9b3fbb0b6303d5cde681eeba7ad9981de65716c7810d685

    SHA512

    a9326aff8e454a2b4ac09984ef2a65fddd4dc146b4c44d839035549bff8c9fdaae490326d0b018f76c1ca2e4fb25426d74f550ca0950982fba632a023af99a56

  • /data/user/0/com.appbasic.scaryphotoframesmwcfzpcrkaoaea/cache/1582435991586.jar.x86.flock
    MD5

    d41d8cd98f00b204e9800998ecf8427e

    SHA1

    da39a3ee5e6b4b0d3255bfef95601890afd80709

    SHA256

    e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

    SHA512

    cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

  • /data/user/0/com.appbasic.scaryphotoframesmwcfzpcrkaoaea/cache/oat/1582435991586.jar.cur.prof
    MD5

    d41d8cd98f00b204e9800998ecf8427e

    SHA1

    da39a3ee5e6b4b0d3255bfef95601890afd80709

    SHA256

    e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

    SHA512

    cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

  • /data/user/0/com.appbasic.scaryphotoframesmwcfzpcrkaoaea/cache/oat/x86/1582435991586.odex
    MD5

    d41d8cd98f00b204e9800998ecf8427e

    SHA1

    da39a3ee5e6b4b0d3255bfef95601890afd80709

    SHA256

    e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

    SHA512

    cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

  • /data/user/0/com.appbasic.scaryphotoframesmwcfzpcrkaoaea/cache/oat/x86/1582435991586.vdex
    MD5

    d41d8cd98f00b204e9800998ecf8427e

    SHA1

    da39a3ee5e6b4b0d3255bfef95601890afd80709

    SHA256

    e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

    SHA512

    cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

  • /data/user/0/com.appbasic.scaryphotoframesmwcfzpcrkaoaea/cache/org.chromium.android_webview/f038e94cb33282ab_0
    Filesize

    121KB

    MD5

    ce10dc00ef7387e80aa51bb23c8bda0d

    SHA1

    131c3adf9200fad19646f895b1535a4654915971

    SHA256

    ab8d479283a224c75f982b4b4a25abb2aa69cc32266d701cd068039fb174bfc1

    SHA512

    f4cfd3c8b5ecd8dc9076e95515d48572f424dd434042bac4544641512fde38f54102f7e9dabe8b50ae753e570312ebbba332837678e44588de765420a635e0ea

  • /data/user/0/com.appbasic.scaryphotoframesmwcfzpcrkaoaea/cache/org.chromium.android_webview/index
    Filesize

    20B

    MD5

    93027d42b314432c4216e6cfca48b384

    SHA1

    43448dd8102979c3926828182579691945eedd4e

    SHA256

    3cda72e67c62e52a342309c44f2cb3b6c1019c7b11822e2f628e48e254e2b41c

    SHA512

    a52d13cf7f5be196d1e2f135b8a010f80558c5d35e90e7792441d1c976517d55cf1c9587949db69ebef294cc6ef79529a65e7d779964793016efecacd152f70e

  • /data/user/0/com.appbasic.scaryphotoframesmwcfzpcrkaoaea/cache/org.chromium.android_webview/index-dir/temp-index
    Filesize

    72B

    MD5

    7f75ce863c5d1703f7914489a0f49697

    SHA1

    f91223d14eea6d37d36954b583897b206c779b33

    SHA256

    3834302017372d2a1fe0b131e3b3da8f46844a64f3cc753418a2dc53b1c47d25

    SHA512

    3f143f6f01c501f633fcc946997137f2855e94f790bf9e61b04323321e584363b75554cbf23b3f36d54f1b8716b411e8f20d5d4bcb3ae579930cba40164b7e5c

  • /data/user/0/com.appbasic.scaryphotoframesmwcfzpcrkaoaea/cache/org.chromium.android_webview/index-dir/temp-index
    Filesize

    72B

    MD5

    249cc4a4a33b75efa99aacfef0fd1b81

    SHA1

    38624dbb85cbd76aac3b0848ab46f8ffd72d9141

    SHA256

    af62c8d71ab5059516792f35043cc1246574787839aaa67bb0c42877fb73abf3

    SHA512

    b163f86e975ec2c85d30e60c3de33c69028e1474c3137a70ce7fc9566b914d718e7b557441dd1ace86efab0305caf66b04e4d2e97f8d2ffe9a61332e3229a1c4

  • /data/user/0/com.appbasic.scaryphotoframesmwcfzpcrkaoaea/files/gaClientId
    Filesize

    36B

    MD5

    62c3392b8f13e5b053e36690cbbbddd6

    SHA1

    6fa01d54f4ce8befef8900de5fb069501965dfea

    SHA256

    768ac8986990b0436613b92ce122d98ee7a49ea24dd8e42516cf0fe1fb19d5ae

    SHA512

    e71f3ed6db4fbc9a61be4775c0fc0b3f4e8a8ec4bef7032f10bf217fb6a1b6ec0a85d65ab62cb897fd4a6bea26f5ab7f181ada9328de007d11e4bf672b5c9bb8

  • /data/user/0/com.appbasic.scaryphotoframesmwcfzpcrkaoaea/shared_prefs/WebViewChromiumPrefs.xml
    Filesize

    127B

    MD5

    21223e9184445fe043476484cd8cb1f9

    SHA1

    2b4813f849121d60ba35eb0889080668bb62c778

    SHA256

    bb61b7c087c2ae2de93a7740ff75707342940557146366e92b840284cd9446af

    SHA512

    be21408de0cc643650e5d9ab9057a8f9de88e37fbdc6417cfeba160402ec4cd14fccbc82cbbfd941ecfc0bb3d4056ee61ac199efdc99d647d53e65818835fd48

  • /data/user/0/com.appbasic.scaryphotoframesmwcfzpcrkaoaea/shared_prefs/admob.xml
    Filesize

    133B

    MD5

    fcb7f4b215a0ff02cf89c7bc01c9d271

    SHA1

    9157d50bd8bb5ae06790c4f3ec0c3e19c4581054

    SHA256

    408588493bcf956645d45d4cbbbe59b9ee365f6395df62251c23760479316add

    SHA512

    08700a8e984ff31f730e79c78f94af565f749f26ca4a24a17811de0d09277d766e712bef630fe11b57e75b00dd025104e4bef784f2f294c7833aee0262316f96