agent_smith | 4304e04f719ee4092d91d6c50040dbd4fa3bce021c651f141fa006e99aaa123c

Analysis

max time kernel
550461s
max time network
160s
platform
android_x86
resource
android-x86-arm-20220621-en
resource tags

androidarch:armarch:x86image:android-x86-arm-20220621-enlocale:en-usos:android-9-x86system
submitted
21-07-2022 12:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

abhdhfjdcjo.apk
Size

8.7MB
MD5

87118a9b63adebe8ad642509ff76818b
SHA1

da699640a0670efd1c027658ed1756687c029ff4
SHA256

4304e04f719ee4092d91d6c50040dbd4fa3bce021c651f141fa006e99aaa123c
SHA512

fefbddf4ce865daa8e7f0bdcc28a8ce9fa93a05a73a8889b9ced5f1e46ccda15a54719b61d1731de480e94475282576cfb3b068979e58bd88b58a2a21764d9bc

Score

10^/10

agent_smith adware evasion ransomware

Malware Config

Signatures

Agent smith
Agent smith is a modular adware that installs malicious ADs into legitimate applications.
adware agent_smith
Reads information about phone network operator.
Uses Crypto APIs (Might try to encrypt user data). 1 IoCs
ransomware

Processes:

com.ljechbei

description ioc process

Framework API call javax.crypto.Cipher.doFinal com.ljechbei
Listens for changes in the sensor environment (might be used to detect emulation). 1 IoCs
evasion

Processes:

com.ljechbei

description ioc process

Framework API call android.hardware.SensorManager.registerListener com.ljechbei

description	ioc	process
Framework API call	javax.crypto.Cipher.doFinal	com.ljechbei

description	ioc	process
Framework API call	android.hardware.SensorManager.registerListener	com.ljechbei

com.ljechbei
1⤵
- Uses Crypto APIs (Might try to encrypt user data).
- Listens for changes in the sensor environment (might be used to detect emulation).
PID:4664

getprop ro.product.cpu.abi
2⤵
PID:4711

ls /sys/class/thermal
2⤵
PID:4746

ls /
2⤵
PID:4804

com.ljechbei:remote
1⤵
PID:4832

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

/data/user/0/com.ljechbei/app_tbs/core_private/download_upload
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/com.ljechbei/app_tbs/core_private/tbs_pv_config
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/com.ljechbei/app_tbs/core_private/tbscoreinstall.txt
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/com.ljechbei/app_tbs/core_private/tbslock.txt
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/com.ljechbei/app_tbs/share/core_info
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/com.ljechbei/files/stateless/dW1weF9pbnRlcm5hbA== /dW1weF9pbnRlcm5hbF8xNjU4NDA3Njg3OTY3
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/com.ljechbei/files/umeng_it.cache
Filesize
415B

MD5
c52a14e146f167a4412b73cfbfc2d179

SHA1
b2cf66fe6488381d21a2744aa3e8d784d66a2c7b

SHA256
85f4c803c8d11f0b89fc73ae56805832ef0c83eaa0df9a8396b34644fb8aab2a

SHA512
bcfa2a38a2c84d1eeb159556a588b10736602dac731eaa727346e3c5ffa75d70a90915d1fdc445213b46a026216edb921d89c4c66a5948a25cd2ba277e4aa87d

Download Submit
/data/user/0/com.ljechbei/shared_prefs/info.xml
Filesize
400B

MD5
241c2638b4ec9c0c35ba21acb68aba2a

SHA1
e5114adb9c3145d4e9d459418961a7df7b479d09

SHA256
8697dc14a2b25edbf4c3e2e9f9a97b5fdbac19af6575848d65fcdb73577dbe7b

SHA512
0b5eb61b3d567c93cef36e70280d642e36fe3cd25d050c979b40426b343b7294709ae5c27eb1415f0bc9607a0c10b95200068e85a6fe35ce40626cea26c5076c

Download Submit
/data/user/0/com.ljechbei/shared_prefs/remote_umeng_common_config.xml
Filesize
114B

MD5
53ebf3241afdbdafced147ea6074391a

SHA1
fdfabbdd727068a79d0d18ff1528cf126cf5566b

SHA256
4a085b284854d0936949fbfc72b956595061ba539aa0c6b9dd8ae9ebc1935cbc

SHA512
719b83127d203d44b98c4a28fee618d144724908ba4048204d41a2dab8180bab8f1b9c964305a4ee3bf0f75a20a10bdefcef7c205443cd24c5259f2aaa712ffd

Download Submit
/data/user/0/com.ljechbei/shared_prefs/remote_umeng_common_config.xml
Filesize
174B

MD5
4278c790a7d0d51d9f5c13d7a15edad6

SHA1
775b1fee2bfb2de3aff81ce723b0bd95f55a6f5e

SHA256
5fe8981ac2f84a8844d507406fe2e89f50eb282f7b6ed2b71d59f59d84180bf4

SHA512
87c96d6a694ed7afad414ba6da6cc3929d2d94f698528b154393f8df40605ea9bad0d3b1faa9bc4056ae62d841a312f27ff338ce22fa366562a8d3c2979adb1c

Download Submit
/data/user/0/com.ljechbei/shared_prefs/remote_umeng_common_config.xml
Filesize
239B

MD5
2251712bf1439bea69ba5b8ce9d38016

SHA1
f010a4a7a712550d26589edb24b15e9f185b5bfa

SHA256
ed5297a1d20baf7279bfdfe9f9d58da938a642c557fb855ad818aa5800cf272c

SHA512
5f59442d4beb29d0501e5409fca2974b4a5d58b38eeb2dacb1e6e1d212058e3af946fb2d1cc44bed9dda8acb294c0317f8c11a06dc467fbd30ecc05e01f4868d

Download Submit
/data/user/0/com.ljechbei/shared_prefs/tbs_download_config.xml
Filesize
200B

MD5
0fa9a38f5a3440a8fdfd3610773af521

SHA1
000e1c695ed9ea4b2eede761698df919c0ac0392

SHA256
1c56608ae2edb6639ea815de0ad60b7c18a3085aa060343cd2968d7c1ceccee3

SHA512
f117098828001223874ce06c581b9c70935137aad3a2bcb53d26d076677a63cd2f0d9b7385d68020c96f572153f67e93ccb6a5785e0d0035a6a8e3c334c1ba76

Download Submit
/data/user/0/com.ljechbei/shared_prefs/tbs_download_config.xml
Filesize
248B

MD5
963bcd65073de6f4240e1362f6cd2fda

SHA1
ef831a0a5a1513eb5d3f4d5e1f045148073b9720

SHA256
5013d6573e8dcb55321ab2f22dbc45b1f3e6a7e89d245e0d7f45d31646047eec

SHA512
824d1d99eb87d01834966dbdfbc372145c6c0d3df42579ff807b1afd8ff663517b51ada9a322d67a2a1766ddd3010e9178e01b5ddd818ae5bd185d54af389d07

Download Submit
/data/user/0/com.ljechbei/shared_prefs/tbs_download_config.xml
Filesize
248B

MD5
91209236869146f2c3357b11995a727d

SHA1
c5aef5ec523164fff2cb9b7e417e6223170282ad

SHA256
5cc264e1809b0771b764f8848a51bf156a81c53c42d1104cc57a0bf70bec4ed9

SHA512
b66c1c2a03f8a89a22771cddf13ce5d1151bcf2d949c87b2141a66ceced63c75de995cdc3c53544849baba05c120dc1fad4ccf2a2262283105231de4da0ea196

Download Submit
/data/user/0/com.ljechbei/shared_prefs/tbs_download_config.xml
Filesize
248B

MD5
d11b088cd302ad6efbe5611672a09b55

SHA1
b0802cc92af19148c8a34bad38d696a86ebbbdcd

SHA256
80231c9b59eda3f5120ad0353abad572b05453b710edd39a12561db8109e7509

SHA512
dbeba6ecc71e0cab9f042e36e7284b80395ad3c01d135b0e4a81cef4c1234c1620921fa16f193204d7988db0384bc420a85ae3df8f6d4631540dc2ef9bc0ec3b

Download Submit
/data/user/0/com.ljechbei/shared_prefs/tbs_download_config.xml
Filesize
673B

MD5
1924871f6cde1fd6871cea12981588c7

SHA1
ea380d67fa46ccee38a052658b08e8dbea2359ee

SHA256
a00672ca4d92a30ab10d39a0d08c635ee37e50baea46375e03618900a5d67277

SHA512
d3b545de029e5d84b4ff46040ded4a5f80ce2a89ad11fca5af2c6caf8c7590169f408070af0bac307cc5f315b580613c744e4a65954bf5fa80665ea775b04407

Download Submit
/data/user/0/com.ljechbei/shared_prefs/tbs_download_config.xml
Filesize
673B

MD5
a090a74d1ad9f7af5fd58dbf082ad3f4

SHA1
c46b94c8294c9b78bec93a23a35f22febe485668

SHA256
e9c242cdad3b378f1ae4043ec8f9963fa6b050967ef75d55a0ac549472a4978f

SHA512
a65880458b438699294474f1fd2a2487f3ed1a5ef4717cdf3b6635cb7b8237e7c1d708656f380efea0f2959fcfb2d3e4888b989bf2d07a44db240484e8ffe07f

Download Submit
/data/user/0/com.ljechbei/shared_prefs/umeng_common_config.xml
Filesize
174B

MD5
4278c790a7d0d51d9f5c13d7a15edad6

SHA1
775b1fee2bfb2de3aff81ce723b0bd95f55a6f5e

SHA256
5fe8981ac2f84a8844d507406fe2e89f50eb282f7b6ed2b71d59f59d84180bf4

SHA512
87c96d6a694ed7afad414ba6da6cc3929d2d94f698528b154393f8df40605ea9bad0d3b1faa9bc4056ae62d841a312f27ff338ce22fa366562a8d3c2979adb1c

Download Submit
/data/user/0/com.ljechbei/shared_prefs/umeng_common_config.xml
Filesize
239B

MD5
2251712bf1439bea69ba5b8ce9d38016

SHA1
f010a4a7a712550d26589edb24b15e9f185b5bfa

SHA256
ed5297a1d20baf7279bfdfe9f9d58da938a642c557fb855ad818aa5800cf272c

SHA512
5f59442d4beb29d0501e5409fca2974b4a5d58b38eeb2dacb1e6e1d212058e3af946fb2d1cc44bed9dda8acb294c0317f8c11a06dc467fbd30ecc05e01f4868d

Download Submit
/data/user/0/com.ljechbei/shared_prefs/umeng_common_config.xml
Filesize
114B

MD5
53ebf3241afdbdafced147ea6074391a

SHA1
fdfabbdd727068a79d0d18ff1528cf126cf5566b

SHA256
4a085b284854d0936949fbfc72b956595061ba539aa0c6b9dd8ae9ebc1935cbc

SHA512
719b83127d203d44b98c4a28fee618d144724908ba4048204d41a2dab8180bab8f1b9c964305a4ee3bf0f75a20a10bdefcef7c205443cd24c5259f2aaa712ffd

Download Submit
/data/user/0/com.ljechbei/shared_prefs/umeng_common_location.xml
Filesize
390B

MD5
9653e68d439bcbc555c26d97f4268ceb

SHA1
7a2ab5ddc7c24825a8b8993306aee89e0cbdef2c

SHA256
41c5ada848b59021aaa9f8e044c5725b54530637955c726b42543b673317b0a0

SHA512
30a311fea8e503e62d1c104a86a9bd0b6c921d5b0342451eb12dfe21670035285df85559e2a5f75c40134b2744ccd135e46881796c3963f15bd001c4957584e9

Download Submit
/storage/emulated/0/Android/data/com.ljechbei/files/tbslog/tbslog.txt
Filesize
15KB

MD5
c12a0bf3b43ca2f4015e0b99e8815bfc

SHA1
b24cbaea18831ca19dacf724b3603f32cce109a2

SHA256
d7076059d93cafcba3562fcfff0f740fa1485017973bf33761e913aa20b4e9fd

SHA512
e1948a945606932183f2176f08e5fd9334744fb706aba47d6711e43f8f790d08e3413717c9e6fc948a7c4b2f38b3b31e97270b9a776c0da575d116c3a1732d03

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads