Analysis

  • max time kernel
    1481535s
  • max time network
    138s
  • platform
    android_x86
  • resource
    android-x86-arm-20220310-en
  • submitted
    12-06-2022 08:55

General

  • Target

    37e4761fe0955199cf990ed14ecf686b623b0be6115dcca4ed6eeed69acb490c.apk

  • Size

    5.2MB

  • MD5

    2155bdd6c6a96cb4a60f6ea349880bc8

  • SHA1

    45bc8e5985add67ba8a0f6bbdac191b82d04f72e

  • SHA256

    37e4761fe0955199cf990ed14ecf686b623b0be6115dcca4ed6eeed69acb490c

  • SHA512

    5782a67ab961af107b80e9c5956c1f2664a50abb0e9df66aaf1b499ec94f3d0229041ac79b3d57461cc84c1186e9975dc96714a99caf1c55e9adf89b1d706ff7

Malware Config

Signatures

  • Agent smith

    Agent smith is a modular adware that installs malicious ADs into legitimate applications.

  • Requests cell location 1 IoCs

    Uses Android APIs to to get current cell location.

  • Reads information about phone network operator.
  • Listens for changes in the sensor environment (might be used to detect emulation). 1 IoCs

Processes

  • com.lbwifi.anpok
    1⤵
    • Requests cell location
    • Listens for changes in the sensor environment (might be used to detect emulation).
    PID:5008
    • getprop ro.build.version.emui
      2⤵
        PID:5261
      • ls /sys/class/thermal
        2⤵
          PID:5311

      Network

      MITRE ATT&CK Matrix

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • /data/user/0/com.lbwifi.anpok/databases/downloader.db
        Filesize

        4KB

        MD5

        f2b4b0190b9f384ca885f0c8c9b14700

        SHA1

        934ff2646757b5b6e7f20f6a0aa76c7f995d9361

        SHA256

        0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514

        SHA512

        ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1

      • /data/user/0/com.lbwifi.anpok/databases/downloader.db-journal
        Filesize

        524B

        MD5

        01aeb14a670c343be0056d95e9fc2ada

        SHA1

        43ceea07a458cf2d94ff997031c9ecd7dd7c3f3f

        SHA256

        edfde294e8eb4c3995a1a38d125b8547781e95337c1d9bbd5429e1da874161ea

        SHA512

        1198775886de8ae290e43634140af31d5f1d6e91f4a9d6680e940987b85169de00bcb7706e300f99af47f2c8d6e0ac052bdbb1620e0bc148357d73b376269bb6

      • /data/user/0/com.lbwifi.anpok/databases/downloader.db-shm
        Filesize

        8B

        MD5

        7dea362b3fac8e00956a4952a3d4f474

        SHA1

        05fe405753166f125559e7c9ac558654f107c7e9

        SHA256

        af5570f5a1810b7af78caf4bc70a660f0df51e42baf91d4de5b2328de0e83dfc

        SHA512

        1b7409ccf0d5a34d3a77eaabfa9fe27427655be9297127ee9522aa1bf4046d4f945983678169cb1a7348edcac47ef0d9e2c924130e5bcc5f0d94937852c42f1b

      • /data/user/0/com.lbwifi.anpok/databases/downloader.db-wal
        Filesize

        32KB

        MD5

        643feb1d6306dd792bcb01699d4fbb2e

        SHA1

        9bca6461ce0cea6e7a18063d295defa5edb3b390

        SHA256

        f996d771cef1568a2ddfc573ea448846ba91e375def32a5418fcba47e546ab06

        SHA512

        a8b8fad6c2ccbffd151195c70e20690d5621891e8a9f913e51bd884e6eac6a4023c0314e0faf6667a712b8a8665d3a749b98ebed44143d4b4812b31c6cb76b50

      • /data/user/0/com.lbwifi.anpok/databases/npth_log.db
        Filesize

        4KB

        MD5

        f2b4b0190b9f384ca885f0c8c9b14700

        SHA1

        934ff2646757b5b6e7f20f6a0aa76c7f995d9361

        SHA256

        0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514

        SHA512

        ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1

      • /data/user/0/com.lbwifi.anpok/databases/npth_log.db-journal
        Filesize

        524B

        MD5

        6c877e00a25709c0eebfcc681f59ad16

        SHA1

        31e96e989d7f6b0529198a5d186541fc36c07304

        SHA256

        3de2ab23b445bfc816f8d5ed9c857451e67bd31af7ae8188331ec38a00e40032

        SHA512

        bcdb43a43c6d2fedb6062085a051114b1bfccdf5245079bd787c3ddb7e46ee819f15919c95496c5b11abb0bf5a4c5330985df4525587de0b003d33ae8839cc65

      • /data/user/0/com.lbwifi.anpok/databases/npth_log.db-shm
        Filesize

        8B

        MD5

        7dea362b3fac8e00956a4952a3d4f474

        SHA1

        05fe405753166f125559e7c9ac558654f107c7e9

        SHA256

        af5570f5a1810b7af78caf4bc70a660f0df51e42baf91d4de5b2328de0e83dfc

        SHA512

        1b7409ccf0d5a34d3a77eaabfa9fe27427655be9297127ee9522aa1bf4046d4f945983678169cb1a7348edcac47ef0d9e2c924130e5bcc5f0d94937852c42f1b

      • /data/user/0/com.lbwifi.anpok/databases/npth_log.db-wal
        Filesize

        32KB

        MD5

        8b9c14e4f343a1e5c71a68ce48f59e6e

        SHA1

        7eaad37779ead4611bdddbb8e0ab248dc62047c1

        SHA256

        3f037c2e28940f326e76022bbf08027ff41988f3e3776a50af1fffdc37d4d91b

        SHA512

        6311b58cbae8d00e7be5e00c5d26362b0f0c6aa232cd2ddb1f01f4df31e141e5ec9c6d1c9bbebc1ab5f45a07f52c91b424e95b85137b396747d6ec0c3f77d8bd

      • /data/user/0/com.lbwifi.anpok/databases/ttopensdk.db
        Filesize

        4KB

        MD5

        f2b4b0190b9f384ca885f0c8c9b14700

        SHA1

        934ff2646757b5b6e7f20f6a0aa76c7f995d9361

        SHA256

        0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514

        SHA512

        ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1

      • /data/user/0/com.lbwifi.anpok/databases/ttopensdk.db-journal
        Filesize

        524B

        MD5

        5ae0ff839e26ca1d07d5a35778e3d3ab

        SHA1

        622fd163630164dddc793cacf381dbd12fabc2c1

        SHA256

        3c8b2b9bc92071607c4f7b486ac28c156321fd3609920aea8c72da68c06940d5

        SHA512

        1090834521621fb0807ba9a541e7629185fc42f6af3e56b4a01081964e9d009e55b5561c72337765b4109d511ae14b29ba92c554914cdadfb1078c02f5dffa09

      • /data/user/0/com.lbwifi.anpok/databases/ttopensdk.db-shm
        Filesize

        8B

        MD5

        7dea362b3fac8e00956a4952a3d4f474

        SHA1

        05fe405753166f125559e7c9ac558654f107c7e9

        SHA256

        af5570f5a1810b7af78caf4bc70a660f0df51e42baf91d4de5b2328de0e83dfc

        SHA512

        1b7409ccf0d5a34d3a77eaabfa9fe27427655be9297127ee9522aa1bf4046d4f945983678169cb1a7348edcac47ef0d9e2c924130e5bcc5f0d94937852c42f1b

      • /data/user/0/com.lbwifi.anpok/databases/ttopensdk.db-wal
        Filesize

        68KB

        MD5

        3588c401dc6136105332a6eb22260f1c

        SHA1

        213410665f8ebaf2abce31a2c9661c8628d5ea30

        SHA256

        4809a0595be04f2fc221630a3eaf11a89a26025a88c3e560bdbc50b4112d01d1

        SHA512

        387da69127d79b633f9ce2a96109a2d5104ed3d8e9390057f8c849f30b3b32c441e5e5432cf5c114176f32b1987546b9f7baf78d0e9606438d3d4ea719f3be64

      • /storage/emulated/0/Android/data/com.snssdk.api.embed/cache/clientudid.dat
        Filesize

        36B

        MD5

        1649bd014892a559c0441a3d7ecec666

        SHA1

        801342cd5965e4b94e5733378a5c28cdf0f3afcf

        SHA256

        b8f90d5fd4ea561f2fdeba8a45c7ef39d9c383228c697479de0e969bb8a09af0

        SHA512

        ed40fe0ac761101f6bb82a68590a5d273ee48aabdc98674c963033d16ad5434e909a2eb43f3769e17540a55155ec4d6f113e5948d9463d66f925e5b65b587f13