Resubmissions

22-09-2022 17:06

220922-vml5tscab5 10

13-09-2022 03:06

220913-dl3mraeef6 7

Analysis

  • max time kernel
    1714105s
  • max time network
    160s
  • platform
    android_x64
  • resource
    android-x64-arm64-20220823-en
  • resource tags

    androidarch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20220823-enlocale:en-usos:android-11-x64system
  • submitted
    22-09-2022 17:06

General

  • Target

    d86da41bbac1a8c9e04313f0db3c76ab661692e83c218b673e038cb75e42994e.apk

  • Size

    2.2MB

  • MD5

    c863eac37df1b80de26334d6dfce8aec

  • SHA1

    ddd76dd8e4de655d7d67aacbec36694e8e221612

  • SHA256

    d86da41bbac1a8c9e04313f0db3c76ab661692e83c218b673e038cb75e42994e

  • SHA512

    cb376ddf558f47d92a53fd281600f2bf9ff760daf2fd53e20ceb1c941d5d3a400d8717a0588fa8676fc6a8fe4beee5d417fdc1581e587631bd3913bed0264135

  • SSDEEP

    49152:B/tI21hWuaWaTxuh0J9ZGc1d30O8xz1EUQq28I3Plb5:JtI21hWua7TxSKVwO4+598Y95

Score
7/10

Malware Config

Signatures

  • Acquires the wake lock. 1 IoCs
  • Reads information about phone network operator.

Processes

  • com.psiphon3
    1⤵
    • Acquires the wake lock.
    PID:4287
    • ping -c 2 -W 10 -v google.com
      2⤵
        PID:4336

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • /data/user/0/com.psiphon3/app_webview/Default/Cookies

      Filesize

      64KB

      MD5

      dfb2098ca7b3bf16d6f5f1e7d3839af5

      SHA1

      ebb7a8bc886062d77a4092bd306b77a0ce7a3e9d

      SHA256

      e4119d32577d7fc63b267cc23eb7a9bbfb12d238f23e08918c38838fe0181224

      SHA512

      fccec45399258eb98220b7f01b492a72b8b3d1254dec6e196e344d89a0376c6ee24534a31a6675c866d4a17256d3ac6823657eaf04e1d386757d0cbfc6597e50

    • /data/user/0/com.psiphon3/app_webview/Default/Cookies-journal

      Filesize

      1KB

      MD5

      4a2206179a7b873a376911a0e9823b29

      SHA1

      77456a0cb48cab441965a75ce7b6ed44a9bf9257

      SHA256

      2def068683a3d8e6afc223397e699eac8f7a5583cd2d545669bd0f98f5a9d426

      SHA512

      1b857b58502a77706819253ca1b7ac008f55401424f48556684fecaad9fc13dafa989fecbe8e740ab214e541c51a8a1f3ef74d3d50bbc4b22f45eafd268f43d1

    • /data/user/0/com.psiphon3/app_webview/Default/GPUCache/index

      Filesize

      48B

      MD5

      6d7d499960179766cd4261d12dacc411

      SHA1

      e6f8553b0015e12b23cc551afe98763f3b1c9bed

      SHA256

      c96ac03cfdbc6f4c1bdcdf764f1a6573f852e7aae5ef405969516b93ed271182

      SHA512

      6526c668477a01a850b8757b77dd3e7be27ad1991f5cf777685efcb03a21f31b71f6eae00f326931599baae4b16360e33e3d0f2894f1b2c1753391df02a14547

    • /data/user/0/com.psiphon3/app_webview/Default/GPUCache/index-dir/temp-index

      Filesize

      96B

      MD5

      599f699e47ae9c807682cd2d1f6be987

      SHA1

      a82adb75b2085163af99d673d990e36122ee8b7b

      SHA256

      04fd1f75d1b8346cd56a2d902c7fdaf81a50d162ad22717aca69b71e194dd0a0

      SHA512

      8c4ef585e04a7c0be3ce97956b9c6f04f81f14c40e42ea30545e3623480d3866070074c78218d845831880731109ca0b46ea991fce57d7e0c940b01cb83de841

    • /data/user/0/com.psiphon3/app_webview/Default/Web Data

      Filesize

      120KB

      MD5

      a48cd9324b1f8754b07f00d863b840f3

      SHA1

      11c6614775b35a58f440971dfc87c8aaac6d6173

      SHA256

      8859a216183793485d4699bf69d7ed96904679834188d07b9a70424d47eb1420

      SHA512

      35fa712f0af4a5eeed7e00e4e59ed5027dc6609d268462fe79d92043be9ae0c5961ce9e1d2f64b1a196c9b6aa6242b8b83817b3ee4c1058596c58a99c45478b1

    • /data/user/0/com.psiphon3/app_webview/Default/Web Data-journal

      Filesize

      2KB

      MD5

      3ef8707677d318a57e79e0da6c2bd359

      SHA1

      5d9190b0f57c074ca3e0e26b8a88da85aa615c02

      SHA256

      e3a4ffcd91952d02c7cac9622f99d80a8f1f1e5ef4f8bb244251e9e66c5a6958

      SHA512

      9c99d4d4fd5d9986bcf5cd9287674e7305aecea98821015df8dd9c7631dd9d66eba1842e2c27ce7682b274c98e7a65fb30529402767dde5dcbba02245bbbc375

    • /data/user/0/com.psiphon3/app_webview/webview_data.lock

      Filesize

      18B

      MD5

      a8e9d37206967f94991ef75910b13a69

      SHA1

      d4dff34b64ab6789673afaad0b6688a485151b21

      SHA256

      1d9ed69e6b5788cae9681c8ce63465d666dfe3738b183e6b4d8c2f2a0ababc4d

      SHA512

      07d8f5469672f83d11f2d8dc8ff777036a1c8cd69bed94c4815ed34b952d36601be2cdcf5847602933479020c829064d0d0383eb9ccdc37648b499f690f7aed7

    • /data/user/0/com.psiphon3/cache/1

      Filesize

      31B

      MD5

      8176b327eadc684a74f17a18bdae6292

      SHA1

      af5b89dead35782eb7b1466a3412c31b72240014

      SHA256

      2689052abc5526a9810fbae5d3f64ac500988559230846c0f089ad33f20b7633

      SHA512

      3071850d772c1f5ef28ff8133018cae8d59517a9674b7d941111170a9e28e38edb3e71491954f85bb30bed56a527a2dbc0e5a5b56d6bbbcec5d7f510bd46d6a8

    • /data/user/0/com.psiphon3/cache/2

      Filesize

      1B

      MD5

      7215ee9c7d9dc229d2921a40e899ec5f

      SHA1

      b858cb282617fb0956d960215c8e84d1ccf909c6

      SHA256

      36a9e7f1c95b82ffb99743e0c5c4ce95d83c9a430aac59f84ef3cbfab6145068

      SHA512

      f90ddd77e400dfe6a3fcf479b00b1ee29e7015c5bb8cd70f5f15b4886cc339275ff553fc8a053f8ddc7324f45168cffaf81f8c3ac93996f6536eef38e5e40768

    • /data/user/0/com.psiphon3/cache/WebView/Crashpad/settings.dat

      Filesize

      40B

      MD5

      afad72bdef067d11d733190f794ce011

      SHA1

      c38c96db3379e4ce4b5a2296c72584f33eddb415

      SHA256

      2baa64a6e882aab2549de79be1073e3558a5b0fdadac4af303857d14d52151ae

      SHA512

      ab6df1da6d0fd6d99661ee76178c7d50bdc6053ff7f532cd37535cc134f45a31d72911097c9d4abcf4d0b31e6643c3cb34eab4e3e905acbb12ade42e99ad3f7c

    • /data/user/0/com.psiphon3/cache/WebView/Default/HTTP Cache/2e7835adde895baf_0

      Filesize

      270B

      MD5

      bb8ef6315fdf6edb8a2300066921dd42

      SHA1

      64b9cd2ac11096e7c8ba1e49d20e278cbb023f08

      SHA256

      74ace003dd2404a418e62bed21b36bdac42197150c2e544da032d98e0727c69d

      SHA512

      2111cdddf3b1096650781cbba3cbd119902de78df6898c7c5ca700a7e654e8cccf7df8794c452f92de018d41c7369ee1c91be4f5958025e97d01d23fdda52ff8

    • /data/user/0/com.psiphon3/cache/WebView/Default/HTTP Cache/Code Cache/js/index

      Filesize

      48B

      MD5

      6d7d499960179766cd4261d12dacc411

      SHA1

      e6f8553b0015e12b23cc551afe98763f3b1c9bed

      SHA256

      c96ac03cfdbc6f4c1bdcdf764f1a6573f852e7aae5ef405969516b93ed271182

      SHA512

      6526c668477a01a850b8757b77dd3e7be27ad1991f5cf777685efcb03a21f31b71f6eae00f326931599baae4b16360e33e3d0f2894f1b2c1753391df02a14547

    • /data/user/0/com.psiphon3/cache/WebView/Default/HTTP Cache/Code Cache/js/index-dir/temp-index

      Filesize

      96B

      MD5

      f01c1e7115d602189b618e7d9fbd20fd

      SHA1

      a34de05a14cfdcad7cb6ff1088d1fc12d82c8cf8

      SHA256

      6ae4e65df14d5760826fccfd193091b0eca6b3517396ff79deb1f8da52698b6a

      SHA512

      1a334a9a51dbe1aa33954b254f4507a3103749d6da4cfa71371f003ea5168783fb068d105345607ce182d3093d727a015275e2dad76b11f5c2ddc8128f017f53

    • /data/user/0/com.psiphon3/cache/WebView/Default/HTTP Cache/Code Cache/wasm/index

      Filesize

      48B

      MD5

      6d7d499960179766cd4261d12dacc411

      SHA1

      e6f8553b0015e12b23cc551afe98763f3b1c9bed

      SHA256

      c96ac03cfdbc6f4c1bdcdf764f1a6573f852e7aae5ef405969516b93ed271182

      SHA512

      6526c668477a01a850b8757b77dd3e7be27ad1991f5cf777685efcb03a21f31b71f6eae00f326931599baae4b16360e33e3d0f2894f1b2c1753391df02a14547

    • /data/user/0/com.psiphon3/cache/WebView/Default/HTTP Cache/Code Cache/wasm/index-dir/temp-index

      Filesize

      96B

      MD5

      7f5350b1a4a55bc7ee34c5b3430c5210

      SHA1

      8ba00b626872a8bb801283333cb8f1287d4813c2

      SHA256

      915f39b69bb29e6819608670e600b4396121979c4b3e2018847c001b08ceb625

      SHA512

      82e82e976023dd89834924fbe8e35ff823eacd01b0c8366e55963501c46661e45f2eb29659311668164d5f0068f4ffca2738d84f794ac211feefa46403140a46

    • /data/user/0/com.psiphon3/cache/WebView/Default/HTTP Cache/index

      Filesize

      48B

      MD5

      6d7d499960179766cd4261d12dacc411

      SHA1

      e6f8553b0015e12b23cc551afe98763f3b1c9bed

      SHA256

      c96ac03cfdbc6f4c1bdcdf764f1a6573f852e7aae5ef405969516b93ed271182

      SHA512

      6526c668477a01a850b8757b77dd3e7be27ad1991f5cf777685efcb03a21f31b71f6eae00f326931599baae4b16360e33e3d0f2894f1b2c1753391df02a14547

    • /data/user/0/com.psiphon3/cache/WebView/Default/HTTP Cache/index-dir/temp-index

      Filesize

      144B

      MD5

      549126d835c44dfb6f24bb183d5f721b

      SHA1

      165b431709377e2c20e13aa3b58237e1cfbb165d

      SHA256

      e2a63b0185eac2281cc8e8bd9f54fa446b20341aecb8856932db300caccc96b1

      SHA512

      51a3e92bc7b844092de0566a02cc71349cc7859299fed34d5ed665b188e88bc40f3ab45bff5f30059623953f8e4ec9f7832c00a3ddd314fe75b921ad10704075

    • /data/user/0/com.psiphon3/cache/WebView/Default/HTTP Cache/index-dir/temp-index

      Filesize

      96B

      MD5

      ac5c30d7da9fdc3fc9039318adec2963

      SHA1

      624ff17ac8c1d79bc0a51acb1b4d432fc1b65557

      SHA256

      339a1ee9cac16960917a19489de7fe51d14963f2873f1812464f1c32195b8db1

      SHA512

      f8f48eea657744d4cb43fd04dcabcc9e6281be29ea2f6ae7d8ca36048bd227faed2b014372a3c328d55159e1638cf483ea23a198f283f64c64058ef4872e33a8

    • /data/user/0/com.psiphon3/cache/WebView/font_unique_name_table.pb

      Filesize

      57KB

      MD5

      f080fa2a56ab5479d58063e5ea871447

      SHA1

      4b3fd57a98916fa5784305b76ba30af26b5253d9

      SHA256

      0aa374bc456330fd1b5daf18d25b4bb8e2df1998dfa85466f2c31843ff56e815

      SHA512

      8aee3186a95b389d39882620b7c4199a29aa50580aa98a381b2931a934de6406943c89d4d00ebeabff21e2b03b4a4adcc01e37e32a2335c4838be24bdbf61936

    • /data/user/0/com.psiphon3/cache/~test.test

      Filesize

      4B

      MD5

      098f6bcd4621d373cade4e832627b4f6

      SHA1

      a94a8fe5ccb19ba61c4c0873d391e987982fbbd3

      SHA256

      9f86d081884c7d659a2feaa0c55ad015a3bf4f1b2b0b822cd15d6c15b0f00a08

      SHA512

      ee26b0dd4af7e749aa1a8ee3c10ae9923f618980772e473f8819a5d4940e0db27ac185f8a0e1d5f84f88bc887fd67b143732c304cc5fa9ad8e6f57f50028a8ff

    • /data/user/0/com.psiphon3/databases/crash_reports

      Filesize

      152KB

      MD5

      01e7794895357db4f621c0639470ef9b

      SHA1

      ee359e01e766f056aa9abfe88d36bae29bb02e5f

      SHA256

      ea079d560354a6e1a819315456b114ef78f8ee34c7e099af9f08b01759db7c31

      SHA512

      0ced9befcbb62894a262248a0f969d211a243f595b89b5a513e0933ccfebbf573be723a5518fa73c1f9e50ccef4ee2807d13b02094ab92d4f4770e20d6fdc69c

    • /data/user/0/com.psiphon3/databases/crash_reports-journal

      Filesize

      1KB

      MD5

      aad0c606294086a9b0188eaaf4cbc2ac

      SHA1

      d6cfa529053270e6c8e4d390eb84abb6dd164327

      SHA256

      e80aa4999aa5ab2d7cd000908a9e7eb242481596825c121168923eab6c94aaa9

      SHA512

      35e9f654e13146a68a2f20415c56d469c38cae031b33806e5325984578243d4188943171c9a1a4e17960e99abac0977612aba008993ba6b1b490a9e9b0a05291

    • /data/user/0/com.psiphon3/databases/google_app_measurement_local.db

      Filesize

      88KB

      MD5

      98faadd5c7ec8a240feaf3ac7dc73d1d

      SHA1

      44fda49fad4e49803a028b7a5294441c3ac3e1b9

      SHA256

      d87f878f1f2e3a5bceb365269d8ab43c854018833e6c4da096d474e082cb17fc

      SHA512

      bfa9c5b14bf555d5376dbb9461a9c80cc64adc0a5237c358a44bebd6dda418e07e56ff672c38df23094c439c926bf2502a24f5083f1681ef5953f43c3171382a

    • /data/user/0/com.psiphon3/databases/google_app_measurement_local.db-journal

      Filesize

      1KB

      MD5

      cbe22ce23071476a0c3b4c1c50355ce6

      SHA1

      1667263798408d6da6bd9fea4d9b85584d605b68

      SHA256

      5497decb656337a8ca94348896235589b6866a8e0e4739a1ba23c6f3be2b3d8e

      SHA512

      a0fed8aab7a927f955399019c38724fa4eb8685fe7148606e6918d3b255eb29246fa8102efe3029b23138f5c7cc886525a66071a812da2db5588e70892520ff1

    • /data/user/0/com.psiphon3/shared_prefs/WebViewChromiumPrefs.xml

      Filesize

      127B

      MD5

      97ccd9a2b2063143df56b6937f961ca4

      SHA1

      5e78a91ae5df289ce83443cb7d5589dd3504fb5d

      SHA256

      248ff7928128015b1cfe3e6517c8f9b8c9511bfb8c8baf44fc1370640eac61fd

      SHA512

      86c05a5bb3d7eedea390664796966e9e5a5bf846c85808da54407788a76b3ee25b91428242a1e76d8765bfe51e1ba3636617fbab6e7dbb39fcc433e07c3fcd3b

    • /data/user/0/com.psiphon3/shared_prefs/com.google.android.gms.appid.xml

      Filesize

      2KB

      MD5

      8ee88edd163eadb1410851746a027aad

      SHA1

      0d800f3aa66558609a4f8dbf1ca759408d927994

      SHA256

      11dc6f19cf66ff37703f01f83072b78ea01979311ac35f6cd7e972adbd9f8ebc

      SHA512

      a5a0cf442411d4c6e8f0860cd6d033f81071891d6884075f8601fa45c694ab91b2f350b4d573d3467342980743730cc0813cf9e5b50194590f82aac4ac11a1ff

    • /data/user/0/com.psiphon3/shared_prefs/com.google.android.gms.appid.xml

      Filesize

      2KB

      MD5

      5b21044e1c32ed99c8655896981080ec

      SHA1

      9e2ea3f1139503c816215055454dbde1a2acb1ca

      SHA256

      6fc808112e98ed375f6251595c626a3b8dcd8f93bd27d52103a14477d7981624

      SHA512

      300a9e9cdf454b52a95de9ba066c2fa47e4484fe051d826f7a46dcf5954a200a68e49d86ba59c2a4db572acfd17b24ca66d690aa18d2359fb4a0f5a480d9d6fd

    • /data/user/0/com.psiphon3/shared_prefs/com.google.android.gms.appid.xml

      Filesize

      2KB

      MD5

      06da4b762ef3637b8e40278d36f9633f

      SHA1

      600725a60162f9b12e86472360ce86ab912f5dab

      SHA256

      a26bd70c9f2e3f2e306aa239f4e8a323ed81607d37200cee3064fcb706066e99

      SHA512

      16692fbacc64fcaf7e92ab6d88685d0347a706e90d689641f52c5ba1bb2d1c9c56b4006c8bc03b5228853ee3ff140c98bc4343bb277dd81c88c5fc58d00ef858

    • /data/user/0/com.psiphon3/shared_prefs/com.google.android.gms.appid.xml

      Filesize

      2KB

      MD5

      b782d038904c5713185ff0e295845aaa

      SHA1

      725e09aec75380d794ce41116784d0e24e8ad7ef

      SHA256

      8b81c306867cc20501dc987feca647d4144f9342acf0701276c3c9ebcd28735d

      SHA512

      47701028d081c93d0c67d3149d79e75ed6a1b43b350c95b54e67b3b3b9f9030c8dfd8de48c473a57198fbb335d2dbf5949822c3f7adf091b632d12a3efbec9df

    • /data/user/0/com.psiphon3/shared_prefs/com.google.android.gms.measurement.prefs.xml

      Filesize

      122B

      MD5

      250b4caeba60ddf53228405750ba66ca

      SHA1

      422ab714feb34e9f3b4f1cbe669887bcd581ddb1

      SHA256

      2478c97a377db9ce6a44977b4864a40af8b4f5e5c8f81892c424a608ddec911e

      SHA512

      373750c29942fef90281109b6025c398d0f4ac62b58a984a3651d09f8c016440bc40f6bd84fb6d40acf8e48a553d4c1d22e01a95c40a41567c079ba9a338afdb

    • /data/user/0/com.psiphon3/shared_prefs/com.google.android.gms.measurement.prefs.xml

      Filesize

      360B

      MD5

      ca66ddb26aa290b40e08f17b519d9811

      SHA1

      a901870fea81a8f00d9d47dce6335128e20c528e

      SHA256

      56a619eb760ac71bbfb5190265bf39d7238221ea419bb8738ad6df3fda56c1e7

      SHA512

      4c5cd0b3141bb53d0aeb6282e90c246f087461d3cbe0aba4ba388d00573980856291dea37b2f4a24eed94e1f1c00243d7ddf34242f3db98914a860c554d906b0

    • /data/user/0/com.psiphon3/shared_prefs/com.google.android.gms.measurement.prefs.xml

      Filesize

      456B

      MD5

      cf63e00e718d1d30823b90b1bcda341f

      SHA1

      24974c961c7ebcff092fd438fc12bd16bbd46b8a

      SHA256

      c928672d21f6f715069677e654196135a108d568b0d38eddb5ca1f8fa039094e

      SHA512

      8947fcdbf0164a24f6aaa8034b7b1130d37f60e17aca43c85de556dafcbc49b5264c8135d9213552f1e2dec6def3ad0658f7d5839606253ef4b0540657f3aaf4

    • /data/user/0/com.psiphon3/shared_prefs/com.google.android.gms.measurement.prefs.xml

      Filesize

      519B

      MD5

      edf8fc66a4e85f2b5a95c308b1c71fe1

      SHA1

      15525c5c86ce75f2a619e95aa33e04c8524a328f

      SHA256

      8f3399410f63811af9aa480c345cf3972f62927747693d877397302ef012579c

      SHA512

      dba619c307f3197aa15cc377cf1632e99baff38837a2a0adda0a781028f5c70671a9bbf64a0eee9f53117e8276879897a1bb7c8104046480214afb53a86dad2d

    • /data/user/0/com.psiphon3/shared_prefs/com.google.android.gms.measurement.prefs.xml

      Filesize

      520B

      MD5

      db526702a2f9f2f27c8cca041727e15b

      SHA1

      9aa56ee590d6882e3562e6f47f9a4ec434b1ee93

      SHA256

      74fa872bd94acd85e87bf259ef8e1fdaa28fe9f32d501152ded1f12b62b7fa23

      SHA512

      9c3a8873d61b72b984a103cc782b5366c5cca3d4c005de6b2e934a74058026b625cf90958ca89476eecba92fe3d2adee1d48d44395e8bb4cf9f56df8748d42ef