Analysis

  • max time kernel
    2645201s
  • max time network
    26s
  • platform
    android_x64
  • resource
    android-x64-arm64-20220621-en
  • submitted
    14-08-2022 18:42

General

  • Target

    gen_signed.apk

  • Size

    3.3MB

  • MD5

    393bfacf5aa8809348fe403cdf1dfada

  • SHA1

    ea9ceef4bbb07ce390af11cbcfda14e2f999ee65

  • SHA256

    553f2a06d025f54961e4f6f8697d38b63b896a67eadda3743d3d00b2cd4edb10

  • SHA512

    55ab8eb80d1ca31bec19debc9565a348e1ca269b1ad5dd7bc000435b41dd83c6c8f535ce30ead65127a9f13dad740cbd7357415e600bb62067a209965868d9c4

  • SSDEEP

    98304:xEVF6aL7fDW3v0AMYfccAZP67A0/mMVyzKi/En/:x46x3vKcAZP600/5k8/

Score
7/10

Malware Config

Signatures

  • Acquires the wake lock. 1 IoCs
  • Checks Android system properties for emulator presence. 1 IoCs

Processes

  • ir.shz.shzkisi
    1⤵
    • Acquires the wake lock.
    • Checks Android system properties for emulator presence.
    PID:4384
    • ping -c 2 -W 10 -v google.com
      2⤵
        PID:4510

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • /data/user/0/ir.shz.shzkisi/app_webview/Default/GPUCache/index
      Filesize

      48B

      MD5

      6d7d499960179766cd4261d12dacc411

      SHA1

      e6f8553b0015e12b23cc551afe98763f3b1c9bed

      SHA256

      c96ac03cfdbc6f4c1bdcdf764f1a6573f852e7aae5ef405969516b93ed271182

      SHA512

      6526c668477a01a850b8757b77dd3e7be27ad1991f5cf777685efcb03a21f31b71f6eae00f326931599baae4b16360e33e3d0f2894f1b2c1753391df02a14547

    • /data/user/0/ir.shz.shzkisi/app_webview/Default/GPUCache/index-dir/temp-index
      Filesize

      96B

      MD5

      754ec9dea16ada6bd947dd9b0f2b2251

      SHA1

      0a3326322c7e4c52c3ac61e77739247c888e4e3b

      SHA256

      163a506795b34671392d6be1b8ec870da73641615fb11a5bf14729582f13cd3c

      SHA512

      17a80b1c409b736aac3d14e9be958e9013eb81292a4c19173c20ee066fee66245caa6cb0106da8f06709f983b4c6e4c156316ab0cb03f75d0213bbbb6b1dd689

    • /data/user/0/ir.shz.shzkisi/app_webview/Default/Web Data
      Filesize

      120KB

      MD5

      a48cd9324b1f8754b07f00d863b840f3

      SHA1

      11c6614775b35a58f440971dfc87c8aaac6d6173

      SHA256

      8859a216183793485d4699bf69d7ed96904679834188d07b9a70424d47eb1420

      SHA512

      35fa712f0af4a5eeed7e00e4e59ed5027dc6609d268462fe79d92043be9ae0c5961ce9e1d2f64b1a196c9b6aa6242b8b83817b3ee4c1058596c58a99c45478b1

    • /data/user/0/ir.shz.shzkisi/app_webview/Default/Web Data-journal
      Filesize

      2KB

      MD5

      13e095088ec0be2e0d7b0bdfb5e43c8f

      SHA1

      9c6011e1230cf30dd94f69bdda317841f147fa73

      SHA256

      fa12fc267a3386a9869f65018129196bcd662fae0bdda58c9b429f3275702b35

      SHA512

      cb68a141ba8f595456fb19b2d0361b257158f5a00abeb278c4482ca8695e5bf9dad7f979cfd10dc0607dbf6410c593960b07681edd7fbdbacd89e1a384837f68

    • /data/user/0/ir.shz.shzkisi/app_webview/variations_seed_new
      MD5

      d41d8cd98f00b204e9800998ecf8427e

      SHA1

      da39a3ee5e6b4b0d3255bfef95601890afd80709

      SHA256

      e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

      SHA512

      cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

    • /data/user/0/ir.shz.shzkisi/app_webview/variations_stamp
      MD5

      d41d8cd98f00b204e9800998ecf8427e

      SHA1

      da39a3ee5e6b4b0d3255bfef95601890afd80709

      SHA256

      e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

      SHA512

      cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

    • /data/user/0/ir.shz.shzkisi/app_webview/webview_data.lock
      Filesize

      20B

      MD5

      808fd31290a0a21e2fa6f867f85cd7db

      SHA1

      30f1231c584f2f58fa885fa9a6957df596e48241

      SHA256

      336227f3ee1ce4f9a818ec22497e197d3cbedbba6fbb4a1c5fa47d593c7a8085

      SHA512

      3311a86ff3ef935609ef72968d3b785216044fe098d632f206349d0c27667a072a5af4cbb8392b5107c143e3598b5b29a24882b7a59ac4014ca9b80cb6d77d10

    • /data/user/0/ir.shz.shzkisi/cache/1
      Filesize

      52B

      MD5

      422dfe21cd16c5c8945866286a9f893b

      SHA1

      52942cbd8912cd94946622376041caaa49943fe7

      SHA256

      a85ab906b3fd10f2af0c61a449ae35d178b6faa4890756a652af924b6f17187c

      SHA512

      3078be3d98fb11947391dd516d0204ee5f157c98a91ed837e9b70dacb7f9e5427004313937e37cf5a9d81affd0d5fd8ebd41fdcaba123b5dce4f5afe573ba2fd

    • /data/user/0/ir.shz.shzkisi/cache/WebView/Default/HTTP Cache/Code Cache/js/index
      Filesize

      48B

      MD5

      6d7d499960179766cd4261d12dacc411

      SHA1

      e6f8553b0015e12b23cc551afe98763f3b1c9bed

      SHA256

      c96ac03cfdbc6f4c1bdcdf764f1a6573f852e7aae5ef405969516b93ed271182

      SHA512

      6526c668477a01a850b8757b77dd3e7be27ad1991f5cf777685efcb03a21f31b71f6eae00f326931599baae4b16360e33e3d0f2894f1b2c1753391df02a14547

    • /data/user/0/ir.shz.shzkisi/cache/WebView/Default/HTTP Cache/Code Cache/wasm/index
      Filesize

      48B

      MD5

      6d7d499960179766cd4261d12dacc411

      SHA1

      e6f8553b0015e12b23cc551afe98763f3b1c9bed

      SHA256

      c96ac03cfdbc6f4c1bdcdf764f1a6573f852e7aae5ef405969516b93ed271182

      SHA512

      6526c668477a01a850b8757b77dd3e7be27ad1991f5cf777685efcb03a21f31b71f6eae00f326931599baae4b16360e33e3d0f2894f1b2c1753391df02a14547

    • /data/user/0/ir.shz.shzkisi/cache/WebView/font_unique_name_table.pb
      Filesize

      24B

      MD5

      0e4aa88fbb1a5541662c09b5b0f59931

      SHA1

      030d9b4367bdd3b4fe6116fb07399b31ff2a9f8b

      SHA256

      0c773fe663d408b027b91daf3557e10f63599dfb02d7b1e9fe604b42d824cc08

      SHA512

      782d64a49d09fc124975adf8f2e845f017579b9535389ef43f3dda29dec1101de2bc9ee2ca8b4b0508783b10d9e3697de945d4fba37991f0ef863c876b528a7b

    • /data/user/0/ir.shz.shzkisi/cache/~test.test
      Filesize

      4B

      MD5

      098f6bcd4621d373cade4e832627b4f6

      SHA1

      a94a8fe5ccb19ba61c4c0873d391e987982fbbd3

      SHA256

      9f86d081884c7d659a2feaa0c55ad015a3bf4f1b2b0b822cd15d6c15b0f00a08

      SHA512

      ee26b0dd4af7e749aa1a8ee3c10ae9923f618980772e473f8819a5d4940e0db27ac185f8a0e1d5f84f88bc887fd67b143732c304cc5fa9ad8e6f57f50028a8ff

    • /data/user/0/ir.shz.shzkisi/databases/google_app_measurement_local.db
      Filesize

      88KB

      MD5

      8dfcfdcef5a9793fb83bda404ec3f42b

      SHA1

      dd02caf5757e9fdaf184ab299c45e4c92ab3ae4b

      SHA256

      a59674cc863d7e977b030c7047072dc4c6d5ada1257917574fe184d886042cd2

      SHA512

      e04d1892c052fc3766881d3f21e26961714e575766cb316bcada34cce49cf6e17eb26c3fbdee0038ed2c75da0a9cab99e0e3e78374be20ce2790cc0d0d9cd807

    • /data/user/0/ir.shz.shzkisi/databases/google_app_measurement_local.db-journal
      Filesize

      1KB

      MD5

      2525a84bcffc5c3f0885efe086e5de81

      SHA1

      020530b6b38dadf09e118df9f6e3844b63e69a2a

      SHA256

      5694ca1d7c15c57c32d65f8d0dae0e838ef5b18121c251a9e7a228888a2d3343

      SHA512

      b3153d571e33096c21f9133a89a57a9f25da94ce65775184bfaffbdb9fe24ad8c4b08efa60b68e9e826f5d1684a76ce41e80aa6f50e4f857e1c1a87217ec39a8

    • /data/user/0/ir.shz.shzkisi/files/PersistedInstallation3336609392029263254tmp
      MD5

      d41d8cd98f00b204e9800998ecf8427e

      SHA1

      da39a3ee5e6b4b0d3255bfef95601890afd80709

      SHA256

      e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

      SHA512

      cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

    • /data/user/0/ir.shz.shzkisi/files/PersistedInstallation5962946121948224180tmp
      MD5

      d41d8cd98f00b204e9800998ecf8427e

      SHA1

      da39a3ee5e6b4b0d3255bfef95601890afd80709

      SHA256

      e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

      SHA512

      cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

    • /data/user/0/ir.shz.shzkisi/files/generatefid.lock
      MD5

      d41d8cd98f00b204e9800998ecf8427e

      SHA1

      da39a3ee5e6b4b0d3255bfef95601890afd80709

      SHA256

      e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

      SHA512

      cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

    • /data/user/0/ir.shz.shzkisi/no_backup/com.google.android.gms.appid-no-backup
      MD5

      d41d8cd98f00b204e9800998ecf8427e

      SHA1

      da39a3ee5e6b4b0d3255bfef95601890afd80709

      SHA256

      e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

      SHA512

      cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

    • /data/user/0/ir.shz.shzkisi/shared_prefs/FirebaseAppHeartBeat.xml
      Filesize

      134B

      MD5

      a3e3134217bf8a6e7d0db2ffc38a4c09

      SHA1

      3a6f2c11f243ab8882ea35271f847d873489b743

      SHA256

      83891fb7d315a6fc5c7e3ab3e7610f43912a0b557c8b77695f244f9d8d54abaf

      SHA512

      6a8ce128f3fa07e36fa4a72845636e616fd298ba5c0b70386eab85295358153aaeaf3e0ee39106c5cd0a600ebc4646a1c60b083acda31b13020aa7abf255c23f

    • /data/user/0/ir.shz.shzkisi/shared_prefs/FirebaseAppHeartBeat.xml
      Filesize

      188B

      MD5

      eff0566a022db568f6e8615c45529ea5

      SHA1

      d69edb3b80bb2f8561f477fb3afc0a7f4badac2a

      SHA256

      e70c5fa663e0a8f6201f743997e9dcbd297e7413e9c33dad000857c8e66c8aa3

      SHA512

      f889733e2a98298d7efb9595b5f3ae046dbc4dba8da81873167a8626572d823842d31be4f26083e7a3860dcd82508dca0175a543728c51cb389256018e004b18

    • /data/user/0/ir.shz.shzkisi/shared_prefs/FirebaseAppHeartBeat.xml
      Filesize

      239B

      MD5

      37997b71b65970a1d7244f304d1c3edf

      SHA1

      3476351fff196d97a52f9d4ad809851d3c884c54

      SHA256

      347c0eee6a8d513dbe1f3dd487228e107b436222c59e2db016c621aa6a1b2b2b

      SHA512

      8b5b982d82ae4186464d938094e4de993e4d3a9e4891c7b289db58439e682857fed3bc3e885bc004dae916c07d8ac9756ed7f997507887288fe8c862c7b1deb5

    • /data/user/0/ir.shz.shzkisi/shared_prefs/WebViewChromiumPrefs.xml
      Filesize

      127B

      MD5

      97ccd9a2b2063143df56b6937f961ca4

      SHA1

      5e78a91ae5df289ce83443cb7d5589dd3504fb5d

      SHA256

      248ff7928128015b1cfe3e6517c8f9b8c9511bfb8c8baf44fc1370640eac61fd

      SHA512

      86c05a5bb3d7eedea390664796966e9e5a5bf846c85808da54407788a76b3ee25b91428242a1e76d8765bfe51e1ba3636617fbab6e7dbb39fcc433e07c3fcd3b

    • /data/user/0/ir.shz.shzkisi/shared_prefs/com.google.android.gms.appid.xml
      Filesize

      192B

      MD5

      9e73ed221025fb22c977a77cb2c009c8

      SHA1

      bbe6efb47f5444c28faacbdb280a057ea4163d48

      SHA256

      1e377f80d59181d2cd9839f6a1d054805e7cee467062c49525c7196f9a9c1eef

      SHA512

      468e0766c8d55ea77764c372d1645af385bc9b2a03aed7491f13187c225394276b72862e9eca82702ead1a48078a5ed01b4e9a33fd94d71a145e41305ca57767

    • /data/user/0/ir.shz.shzkisi/shared_prefs/com.google.android.gms.appid.xml
      Filesize

      507B

      MD5

      ee5719a8f0a693d86920e88cf6eafc39

      SHA1

      8720d0fc82e1a0a5527f94abe6561ac51be068ad

      SHA256

      b61ea989c64aa681fbd8ca0f5b008a3770ac582649d0c5ba2e203965fc545fdc

      SHA512

      292e71e17be2fbf8539d027399ec6d0256d4e289aca75dc4283b5e8363744588b32226eff92c07f16cdd5d95a47f824e0a361e5d83c07370bf1f9bcbbbc9473b

    • /data/user/0/ir.shz.shzkisi/shared_prefs/com.google.android.gms.appid.xml
      Filesize

      565B

      MD5

      a3da36403dd0cc9976260691edc7c266

      SHA1

      91e379f7bcb7277277670f5933e5d87f13cd1a39

      SHA256

      c5b78ccf003ab6e1e61555dd4fff3504b771726ef0bf9064375b951e5071101d

      SHA512

      e93ccb3956e4fc69c807272867ce8a2c28734e44c29cf684d7f32634cd15b1c6ece870c920e559f9210d012fb21e4f804cc8c800e4de0389e1a516e14738a596

    • /data/user/0/ir.shz.shzkisi/shared_prefs/com.google.android.gms.measurement.prefs.xml
      Filesize

      606B

      MD5

      592aced30ec59db4f99b24c9e0e458a7

      SHA1

      1cdeb56d674ec5d60871df0cd2713e417b5730d7

      SHA256

      d8d0751ad4acef5ff26c021d589c887f09dfb8988cbdcf84de306c6c9da290cc

      SHA512

      3ea26bc45f8e5857fe4be818394cc1c6d3c9e238241109e3b4628d75ff058018381228edb68630286ad5fd01c2db10a394ba24d2ed51a77cbbe5eab4af1a2aec

    • /data/user/0/ir.shz.shzkisi/shared_prefs/com.google.android.gms.measurement.prefs.xml
      Filesize

      607B

      MD5

      fd3c4fe8e38eef4c26d17f0db7842004

      SHA1

      3c6cb644122e57d9cfa29ae47d947f0b0082e316

      SHA256

      03145590f17c9b321f29a0380e2bab40814f056bfc037f6bd4571c274d0da70c

      SHA512

      9f2f774a0fa06e05317cfe550dbb76844841ebe75e136645344b679de0b2b0bd412c68b0c16da796e6a83d2a6af0f7329af9accc716912c7fbfef631793f49f6

    • /data/user/0/ir.shz.shzkisi/shared_prefs/com.google.android.gms.measurement.prefs.xml
      Filesize

      719B

      MD5

      e50348eb685887ccd3161f1265a183d7

      SHA1

      c4171574f0cc48c3de8b825331f8c8dc0b885b13

      SHA256

      795169ce6d28bfbd1c1931cb00913b2a29e18f3947cce26b478d0dbbb693e11e

      SHA512

      0980efaaf65b81340f50842ca9dedf0fb7f6f983f14f157874fd424a87aafe4a80f21f96d8dedb484e77509766b2b89b1e480022d6e0e1bc017b5241b454f76a

    • /data/user/0/ir.shz.shzkisi/shared_prefs/com.google.android.gms.measurement.prefs.xml
      Filesize

      796B

      MD5

      07881fca4f50c091dbcc2737f11e4353

      SHA1

      cb57bcf3f73d343badc9c101b06ccf036f28ea5a

      SHA256

      7df212c35654d2b0214003bea4138165edde144a8dc18f49d3f26b14fea3dc8f

      SHA512

      0e96e3259c72dfccc68dae30f44291f1cccf0a3101791a23f903657bcce0f5db5cbda5c0035ae4789f4670052249b92aff7535ef3262b6ea6db2414b8d8eed34

    • /data/user/0/ir.shz.shzkisi/shared_prefs/com.google.android.gms.measurement.prefs.xml
      Filesize

      122B

      MD5

      250b4caeba60ddf53228405750ba66ca

      SHA1

      422ab714feb34e9f3b4f1cbe669887bcd581ddb1

      SHA256

      2478c97a377db9ce6a44977b4864a40af8b4f5e5c8f81892c424a608ddec911e

      SHA512

      373750c29942fef90281109b6025c398d0f4ac62b58a984a3651d09f8c016440bc40f6bd84fb6d40acf8e48a553d4c1d22e01a95c40a41567c079ba9a338afdb

    • /data/user/0/ir.shz.shzkisi/shared_prefs/com.google.android.gms.measurement.prefs.xml
      Filesize

      395B

      MD5

      a51c46dda4d8ff23e272666114d0f2f1

      SHA1

      5d12ee929085e4676e93f8167e31fb12e72a0fd1

      SHA256

      f0e882c65e6269150b00ca63a3fcd394839c5efd6a51376eceac629b6281d0fa

      SHA512

      2b99bc4f1f18ca84f8cc93e704bfe4dbc81b01fb23762cfc77ac6d133f75cb28988b7c121d08fb48288fe4b4f7d2ada3f79003a3b7f74184670ce832f89796d7