Analysis
-
max time kernel
3055783s -
max time network
143s -
platform
android_x86 -
resource
android-x86-arm-20220621-en -
submitted
30-06-2022 19:10
Static task
static1
Behavioral task
behavioral1
Sample
f1bc8fbdf3f2a0d79e917d6329c68bc977082ae223dcb1e72e0a7f323c71e07f.apk
Resource
android-x86-arm-20220621-en
General
-
Target
f1bc8fbdf3f2a0d79e917d6329c68bc977082ae223dcb1e72e0a7f323c71e07f.apk
-
Size
2.5MB
-
MD5
72cee9daf9fca791d55e34ae7d2e9cc8
-
SHA1
6a049afd36c598b545e58ae1d3a900307197e676
-
SHA256
f1bc8fbdf3f2a0d79e917d6329c68bc977082ae223dcb1e72e0a7f323c71e07f
-
SHA512
2028b353832f4cfd7205061dd0ea017605e6ddaa193f315e98772839f62d103214a75e2fb03b7e3fc31395841e7fe025bc5cc77ef25c902fe17107f99d60147c
Malware Config
Signatures
-
Agent smith
Agent smith is a modular adware that installs malicious ADs into legitimate applications.
-
Requests cell location 1 IoCs
Uses Android APIs to to get current cell location.
Processes:
com.dfoiej8.ccsdyiadescription ioc process Framework service call com.android.internal.telephony.ITelephony.getCellLocation com.dfoiej8.ccsdyia -
Loads dropped Dex/Jar 2 IoCs
Runs executable file dropped to the device during analysis.
Processes:
com.dfoiej8.ccsdyia/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.dfoiej8.ccsdyia/app_jar/lpdf.jar --output-vdex-fd=122 --oat-fd=120 --oat-location=/data/user/0/com.dfoiej8.ccsdyia/app_jar/oat/x86/lpdf.odex --compiler-filter=quicken --class-loader-context=&ioc pid process /data/user/0/com.dfoiej8.ccsdyia/files/one.dex 4654 com.dfoiej8.ccsdyia /data/user/0/com.dfoiej8.ccsdyia/app_jar/lpdf.jar 4912 /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.dfoiej8.ccsdyia/app_jar/lpdf.jar --output-vdex-fd=122 --oat-fd=120 --oat-location=/data/user/0/com.dfoiej8.ccsdyia/app_jar/oat/x86/lpdf.odex --compiler-filter=quicken --class-loader-context=& -
Requests dangerous framework permissions 8 IoCs
Processes:
description ioc Allows an application to send SMS messages. android.permission.SEND_SMS Allows read only access to phone state, including the current cellular network information, the status of any ongoing calls, and a list of any PhoneAccounts registered on the device. android.permission.READ_PHONE_STATE Allows an application to write to external storage. android.permission.WRITE_EXTERNAL_STORAGE Allows an application to read SMS messages. android.permission.READ_SMS Allows an app to access approximate location. android.permission.ACCESS_COARSE_LOCATION Allows an app to access precise location. android.permission.ACCESS_FINE_LOCATION Allows an application to read from external storage. android.permission.READ_EXTERNAL_STORAGE Allows an application to receive SMS messages. android.permission.RECEIVE_SMS -
Reads information about phone network operator.
-
Uses Crypto APIs (Might try to encrypt user data). 1 IoCs
Processes:
com.dfoiej8.ccsdyiadescription ioc process Framework API call javax.crypto.Cipher.doFinal com.dfoiej8.ccsdyia -
Listens for changes in the sensor environment (might be used to detect emulation). 1 IoCs
Processes:
com.dfoiej8.ccsdyiadescription ioc process Framework API call android.hardware.SensorManager.registerListener com.dfoiej8.ccsdyia
Processes
-
com.dfoiej8.ccsdyia1⤵
- Requests cell location
- Loads dropped Dex/Jar
- Uses Crypto APIs (Might try to encrypt user data).
- Listens for changes in the sensor environment (might be used to detect emulation).
-
/system/bin/cat /sys/devices/system/cpu/cpu0/cpufreq/cpuinfo_max_freq2⤵
-
/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.dfoiej8.ccsdyia/app_jar/lpdf.jar --output-vdex-fd=122 --oat-fd=120 --oat-location=/data/user/0/com.dfoiej8.ccsdyia/app_jar/oat/x86/lpdf.odex --compiler-filter=quicken --class-loader-context=&2⤵
- Loads dropped Dex/Jar
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
/data/user/0/com.dfoiej8.ccsdyia/app_jar/lpdf.jarFilesize
35KB
MD5e1ab911d4b585a26aae02d8540575013
SHA1ac148f7bdf95edddc97d9224ff51a771f1070520
SHA2568a71fab57b4a03f0b37095daa2eaa086ec6ed6c1c6166ca67c0e0a9e14cc85ca
SHA512983ec12cde3cbfaffb414b8c8eb17c793bee558eb51b9d5e630f9bd5f312e0ce55622719aad6097a799286c25001212b26d7053e7e110a4918beace33d3bcbc4
-
/data/user/0/com.dfoiej8.ccsdyia/app_jar/lpdf.jarFilesize
69KB
MD561503c78bfaed115dc65f007a7461ed1
SHA1e989f0a0abe36a164feb51d6419eb1d10db3fcc0
SHA256f9eede33f737a4287b1412412c47a8eafbfb732f764fe18cce955c4a28d3d2e4
SHA5123c59c6deaf0c0d0aa559beec62fea04a8021d471ba92af656983f6ad72f1a07af25a3d886b1c2783cecd802bf865c6100c459eee83e963cee95d834e643d2014
-
/data/user/0/com.dfoiej8.ccsdyia/app_jar/lpdf.jar.x86.flockMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
/data/user/0/com.dfoiej8.ccsdyia/app_jar/oat/x86/lpdf.odexMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
/data/user/0/com.dfoiej8.ccsdyia/app_jar/oat/x86/lpdf.vdexMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
/data/user/0/com.dfoiej8.ccsdyia/app_webview/Web DataFilesize
104KB
MD5dc79f9ce5f3ab5270b33e61119dfc959
SHA11844bf222a5144b513dcf2fb50a18c011701c647
SHA25647e65f4de08deabfd52ecdb8b0a29c61c482188b92c36182e2112ca0a8f4ff65
SHA51218b8894a7f35df516f423bbdebf1e05ce09eaf4345b139e59e603cadb81f8d1fa20f793438c28e8fd9a64e64f0684223d90ce6f10d3f93cb0c781049a8cff03e
-
/data/user/0/com.dfoiej8.ccsdyia/app_webview/Web Data-journalFilesize
1KB
MD54ea84d4ac559ccbe4988a11bb07fa734
SHA1b19a46b4e70d4bf3abd125e3963efdd755b45843
SHA2568ef5d91d0b2e742ad84c2e7b0bac9c51607e79752779df11b89a5537da74601c
SHA512dfa1c19a9c8d9f3534ddbd79de6b6785515c768449bdcb34f488fddd7056c43588894b91d9b5da0281016717eecb02823f9c7fb66e73ff83778e2d21b7e6d82b
-
/data/user/0/com.dfoiej8.ccsdyia/app_webview/metrics_guidMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
/data/user/0/com.dfoiej8.ccsdyia/app_webview/metrics_guidFilesize
36B
MD5f958f6ef048a50e178f6530547514a60
SHA11e54f124cae0d2f45d11593f47e79eb5d948a7c6
SHA256b238acf9ec5d672954e94d1d91f81e94fd22364ea114a3059cd1ac61aa2013e5
SHA5125cd4e2a582884563642f4e5db753c3150fc77ecb417ed5cec6d5e69e7f37459e15b36812a127857778f09e7f7aea01eba1a83dcece317477fc55bc49abccd664
-
/data/user/0/com.dfoiej8.ccsdyia/app_webview/variations_seed_newMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
/data/user/0/com.dfoiej8.ccsdyia/app_webview/variations_stampMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
/data/user/0/com.dfoiej8.ccsdyia/app_webview/webview_data.lockMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
/data/user/0/com.dfoiej8.ccsdyia/files/jiepayplugin.apkFilesize
45KB
MD5c83e81f064fbbff6870210fcc9abcf6c
SHA165f94be4a62160065ff192b9baac02da3a293031
SHA256fc37a898193dd0b37c226a5841936c88bc51a02bf99abe3f17ab84951a3aa1c9
SHA512100c617de8aadb73da780a8e16eccde545b9717bc0e77823efbc1d9831f13a2592a1a14d9e68ba49a364cf2a8029f6fee42d7268925da7f0112c18a5e9412164
-
/data/user/0/com.dfoiej8.ccsdyia/files/oat/x86/one.odexMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
/data/user/0/com.dfoiej8.ccsdyia/files/oat/x86/one.vdexMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
/data/user/0/com.dfoiej8.ccsdyia/files/oat/x86/yypyda.odexMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
/data/user/0/com.dfoiej8.ccsdyia/files/oat/x86/yypyda.vdexMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
/data/user/0/com.dfoiej8.ccsdyia/files/one.dexFilesize
59KB
MD51b5c4ae7e385db4551ced8c19386abe0
SHA112d4bc9728c4f1deec1b9b8aacbfe71c3ceeb4d4
SHA2568211fa61bdd647dc627a182c4e2a763024252dfd94d14f1f12c9c9b4df045d70
SHA512f56d74aa9a3c150034866b12abf7ed233fcc2bd03d7f34bfdfd61cd054952189311669892e91dfcbf5000f509210d56d094abff99371e4897bf7943ef5a2764b
-
/data/user/0/com.dfoiej8.ccsdyia/files/one.dexFilesize
59KB
MD51b5c4ae7e385db4551ced8c19386abe0
SHA112d4bc9728c4f1deec1b9b8aacbfe71c3ceeb4d4
SHA2568211fa61bdd647dc627a182c4e2a763024252dfd94d14f1f12c9c9b4df045d70
SHA512f56d74aa9a3c150034866b12abf7ed233fcc2bd03d7f34bfdfd61cd054952189311669892e91dfcbf5000f509210d56d094abff99371e4897bf7943ef5a2764b
-
/data/user/0/com.dfoiej8.ccsdyia/files/one.dex.x86.flockMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
/data/user/0/com.dfoiej8.ccsdyia/files/yypyda.apkFilesize
38KB
MD5cc860a00cae01d4f2e88cfcbf05f06ff
SHA187778550a32109a679a2d28dec9ca4e6c0ca19fc
SHA256494a419030f286fb05789ded096c05326a44fe2ff6708a0ad2e2c862c5d8d347
SHA512dbe68454e053ff4d494ebf60daa52b856f64b393d37f89a8f91a0239c4ae799f51621b5bb791a497d93ff7b2e8194acfccd82994399f20166596275ccbb10057
-
/data/user/0/com.dfoiej8.ccsdyia/files/yypyda.apk.x86.flockMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
/data/user/0/com.dfoiej8.ccsdyia/shared_prefs/WebViewChromiumPrefs.xmlFilesize
127B
MD521223e9184445fe043476484cd8cb1f9
SHA12b4813f849121d60ba35eb0889080668bb62c778
SHA256bb61b7c087c2ae2de93a7740ff75707342940557146366e92b840284cd9446af
SHA512be21408de0cc643650e5d9ab9057a8f9de88e37fbdc6417cfeba160402ec4cd14fccbc82cbbfd941ecfc0bb3d4056ee61ac199efdc99d647d53e65818835fd48
-
/data/user/0/com.dfoiej8.ccsdyia/shared_prefs/umeng_common_config.xmlFilesize
111B
MD5980971337ca2fcffecf3d34f3eb4fc41
SHA1b84696e2b9a1378d8a1b56cb3db1391e17b28292
SHA2560a967618be7960e0883cc7ff9a50c56f2445e969d337d28ef81d57423a154b1e
SHA5127576ae54d4ef552cfb639481614c8fe509a211a42faf9fd43a3a23690db6f753717f27aea5d2b0a9d52b5d1330aa4a41723848b49460b606a17ab3298991a05b
-
/data/user/0/com.dfoiej8.ccsdyia/shared_prefs/umeng_common_config.xmlFilesize
171B
MD564a92b865f2a7e9fd7c128a1ce7fb163
SHA16eec6579a36f6de798e911bc453887bc92bb774e
SHA256f82a0048af0e48210e4d464e7d4f19e394f46a43148928273f54a06270565809
SHA5123732636db83e1b3fb86b5631bf7147fa01f4fc60cb92a309854c20a9e31ae474daf029831601a24ef7ea51a7f01ed2867f7c8d6624ba9c6d068825bca8658fff
-
/data/user/0/com.dfoiej8.ccsdyia/shared_prefs/umeng_common_config.xmlFilesize
236B
MD5c7b8fbe1ca899d1e7a0dbfa0a9b35106
SHA1d52f807376951e69c91bfe9d93384d5ec5be4d3b
SHA25681b1a164d6bc007d21d17a208f4aac433cb3d961d7f44d7f645d94d0a1a00c2a
SHA5124909a0f24619aac5ecb5c42064f2f8e05a77f359cd967a03bb2221465e64464ce919046cc062fdafecd6a686e06926e74cdb1d11e60592f616ba9ee4eb566cc1
-
/storage/emulated/0/.DataStorage/ContextData.xmlFilesize
65B
MD59781ca003f10f8d0c9c1945b63fdca7f
SHA14156cf5dc8d71dbab734d25e5e1598b37a5456f4
SHA2563325d2a819fdd8062c2cdc48a09b995c9b012915bcdf88b1cf9742a7f057c793
SHA51225a9877e274e0e9df29811825bd4f680fa0bf0ae6219527e4f1dcd17d0995d28b2926192d961a06ee5bef2eed73b3f38ec4ffdd0a1cda7ff2a10dc5711ffdf03
-
/storage/emulated/0/.DataStorage/ContextData.xmlFilesize
111B
MD556ce00968ee89a11d4062a28410b9c9b
SHA1d0ea6032cc67f2afdb69ee71d4ffb66b3dea3d64
SHA256458b15652d9de585f1b80792e655127806b160afd0d01c17d8fc164732b89887
SHA512d5302316ed7511b1e3493fd2e5697ed20e28a643e760b51ee070070e1d791b882496ae70116c6e798ea269258b11ca49ab3b0e99c8619e5bed646df09a78cc92
-
/storage/emulated/0/.DataStorage/ContextData.xmlFilesize
213B
MD529f8fa2d87924d2f0a4b6bc1ed783006
SHA168f65ce09f48121c0971b621bda46918f43172ce
SHA25672f30f662f724c9e123ea1fdc5e2f1283fef0bd8201739e3aadcd169a83094b3
SHA51240d207811854a6fd1fc1abe1d81b54f79ea78044b61eadcb462ea749123854692fddb1de432561fa03e702e3c88bb055af6ab873228b0c79939ce2e8880b6940
-
/storage/emulated/0/.UTSystemConfig/Global/Alvin2.xmlFilesize
65B
MD59781ca003f10f8d0c9c1945b63fdca7f
SHA14156cf5dc8d71dbab734d25e5e1598b37a5456f4
SHA2563325d2a819fdd8062c2cdc48a09b995c9b012915bcdf88b1cf9742a7f057c793
SHA51225a9877e274e0e9df29811825bd4f680fa0bf0ae6219527e4f1dcd17d0995d28b2926192d961a06ee5bef2eed73b3f38ec4ffdd0a1cda7ff2a10dc5711ffdf03
-
/storage/emulated/0/.UTSystemConfig/Global/Alvin2.xmlFilesize
111B
MD552f0eaff73175b3271aa1bffe8ffdeec
SHA171de12f73e5ce232b4e301b3b1a21e95309b1f9a
SHA256c3572cb96e42d6da471037054b5b41ef015250b11a63ec804f9cda9c7f133aa9
SHA51260bdfbf8772eda0298131a65308d12a6b04a1dee142fdc96023a749e08f66c9bab9de723f4bf0bedd20f83a542fcc50e3be94ad300689c6c6e6e6856a08b0259
-
/storage/emulated/0/.UTSystemConfig/Global/Alvin2.xmlFilesize
167B
MD53418ed5443c31a67e5e7703024bc014b
SHA11c8641e507ac48e89e937fb378a822a604ad1ff1
SHA256772fddd9e6364ba7d188484366027bd96b7bce6fefa122d2d44f9cc9b503eab9
SHA5122aafa4a19e5ff40c602124afcc771705ae2385b7cf96ee5f170c93a1a7e0c9c9a4fee4cd836cdc804af6cbc9d0e31cf9518e8e1d1678f5b73a1db158abacb0f3