Resubmissions

31-10-2022 16:21

221031-ttnrkaccdp 10

31-08-2022 14:05

220831-rdtlrsfcej 10

Analysis

  • max time kernel
    782405s
  • max time network
    16s
  • platform
    android_x86
  • resource
    android-x86-arm-20220823-en
  • resource tags

    androidarch:armarch:x86image:android-x86-arm-20220823-enlocale:en-usos:android-9-x86system
  • submitted
    31-10-2022 16:21

General

  • Target

    divar.apk

  • Size

    2.3MB

  • MD5

    9082147d32ce71e3da1469bd9a0cdff9

  • SHA1

    2db449cb6fc44b39f0e38d628c5fe72a056f35fd

  • SHA256

    cd3720fcdfb015b745e1a560ce5f4ed198d5a8afe79c0cf7bdecb7c47e33455e

  • SHA512

    26e536bbfc943e4a71e3dc4201fdd19a54274974171e46902d4d55261267dc2b767bf5da0966e1988488a3d092ce558dd85ebb93adb9d70359eb1df59ad7c25a

  • SSDEEP

    49152:A/Yyeit+zalch6z5Oz2vpqLwR6L2zsq7IlVCxd0qAnibUO74kg:OYyeit+za+2chLU6L19lw0qDUO+

Score
7/10

Malware Config

Signatures

  • Acquires the wake lock. 1 IoCs
  • Reads information about phone network operator.

Processes

  • com.psiphon3
    1⤵
    • Acquires the wake lock.
    PID:4116
    • ping -c 2 -W 10 -v google.com
      2⤵
        PID:4188

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • /data/user/0/com.psiphon3/cache/~test.test
      Filesize

      4B

      MD5

      098f6bcd4621d373cade4e832627b4f6

      SHA1

      a94a8fe5ccb19ba61c4c0873d391e987982fbbd3

      SHA256

      9f86d081884c7d659a2feaa0c55ad015a3bf4f1b2b0b822cd15d6c15b0f00a08

      SHA512

      ee26b0dd4af7e749aa1a8ee3c10ae9923f618980772e473f8819a5d4940e0db27ac185f8a0e1d5f84f88bc887fd67b143732c304cc5fa9ad8e6f57f50028a8ff

    • /data/user/0/com.psiphon3/databases/crash_reports
      Filesize

      4KB

      MD5

      f2b4b0190b9f384ca885f0c8c9b14700

      SHA1

      934ff2646757b5b6e7f20f6a0aa76c7f995d9361

      SHA256

      0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514

      SHA512

      ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1

    • /data/user/0/com.psiphon3/databases/crash_reports-journal
      Filesize

      524B

      MD5

      8abb1e97be5094b35fcd628a082a0f97

      SHA1

      e37d286bb93872eff6b5072274f8cb65fbc19c5f

      SHA256

      bfc664d4a74991fcd6ad641380f44bbcfaeeebfe85f6abf1d7062b62068bd417

      SHA512

      33f25a51cd4cf08399e3a8c1c3bab97ef178155189b4f5e0853c6df0d7dfa58f61f67017e5546899fb3bd26178ff63dc6a738c1360dabadbf2d262138a05094c

    • /data/user/0/com.psiphon3/databases/crash_reports-shm
      Filesize

      8B

      MD5

      7dea362b3fac8e00956a4952a3d4f474

      SHA1

      05fe405753166f125559e7c9ac558654f107c7e9

      SHA256

      af5570f5a1810b7af78caf4bc70a660f0df51e42baf91d4de5b2328de0e83dfc

      SHA512

      1b7409ccf0d5a34d3a77eaabfa9fe27427655be9297127ee9522aa1bf4046d4f945983678169cb1a7348edcac47ef0d9e2c924130e5bcc5f0d94937852c42f1b

    • /data/user/0/com.psiphon3/databases/crash_reports-wal
      Filesize

      40KB

      MD5

      5292f4899cdb25e56dabfe27ef1b4e17

      SHA1

      7395f13fe0fdeffa6f6d50947981af4d24edd9df

      SHA256

      c9c66b6753af14dde910c071de33f4582e0e63c13d5baec9282a247f0c5b90a9

      SHA512

      6faced6383a4aad1c521bfb7ea751fc0eaec8bc4fec28dd9c20dbaa2dbb1e4150b31dd14711aeeb3c9e0404162ebe8bb40f6395b4874668e1287aef0c0adb7af

    • /data/user/0/com.psiphon3/databases/google_app_measurement_local.db
      Filesize

      20KB

      MD5

      0a286ebde4b40231e9a92b57438641ea

      SHA1

      33677fd5366816806dfaec3e9435ba262e9e91ec

      SHA256

      852cb35acfc4dd096e9f30ef1c2b7fb2b62b85ddb45969d275d0aef3ad224ad3

      SHA512

      813074b46419e28ad3482063b521da94b9576c8d0d4964b261f0016b07d7733817e2cf8c564af65cf74a3c31c36e90ff50af7d1a5b80fdb3f6332a42b5535ab0

    • /data/user/0/com.psiphon3/databases/google_app_measurement_local.db-journal
      Filesize

      524B

      MD5

      a4c9f5b2cda5d6c9679b6a7ac59b3cc8

      SHA1

      6b0a7ffb613100785a6b45b81b1edb2a1527fdb0

      SHA256

      b89241b5e0fca2f59bc42d39127a9b4e54033e031b327287e3986ced524a35bf

      SHA512

      222a77a852f9082c21a8e22794ae4e0c3691dff8af869c6befb56cbbd4f9c8a300937ea61e23abb112c21870ebc80d55bf1dc6176e3f7f4b1f402f5a79b474fb

    • /data/user/0/com.psiphon3/databases/google_app_measurement_local.db-shm
      Filesize

      8B

      MD5

      7dea362b3fac8e00956a4952a3d4f474

      SHA1

      05fe405753166f125559e7c9ac558654f107c7e9

      SHA256

      af5570f5a1810b7af78caf4bc70a660f0df51e42baf91d4de5b2328de0e83dfc

      SHA512

      1b7409ccf0d5a34d3a77eaabfa9fe27427655be9297127ee9522aa1bf4046d4f945983678169cb1a7348edcac47ef0d9e2c924130e5bcc5f0d94937852c42f1b

    • /data/user/0/com.psiphon3/databases/google_app_measurement_local.db-shm
      Filesize

      8B

      MD5

      7dea362b3fac8e00956a4952a3d4f474

      SHA1

      05fe405753166f125559e7c9ac558654f107c7e9

      SHA256

      af5570f5a1810b7af78caf4bc70a660f0df51e42baf91d4de5b2328de0e83dfc

      SHA512

      1b7409ccf0d5a34d3a77eaabfa9fe27427655be9297127ee9522aa1bf4046d4f945983678169cb1a7348edcac47ef0d9e2c924130e5bcc5f0d94937852c42f1b

    • /data/user/0/com.psiphon3/databases/google_app_measurement_local.db-wal
      Filesize

      36KB

      MD5

      6cf816ee2752c878cf1f9c0b260c5782

      SHA1

      3844c3ff30c899659e49637a0a6ea38c9b774eeb

      SHA256

      77b4b90de2b385fe935b9fc02eaf1072745f271ada5146fce1aaf95138846ae0

      SHA512

      d2c9045d3b1de370d0ba04e64fe29d7c520de794b9cfe166457029e30a9efe5843aed9fda17c6d908a37f5055829a9d2fc7f699534457ab15c0260de2b630b72

    • /data/user/0/com.psiphon3/databases/google_app_measurement_local.db-wal
      Filesize

      4KB

      MD5

      d219eb3a02c2c6f594c8a034b25a9a09

      SHA1

      2bb443fb2403f9a8647ac565e5d5c819679115fb

      SHA256

      d7003e824bdfcddc1c198ec46342369bdd29c1dfd1401705e88978202b81bcbb

      SHA512

      e906c44b3412b65a1b63427b76d1e5abad323d42df30855d0a7d7757a78748cef6297e91cf8ee6166454f510061be2383b0ccc9d88e645ed95d39b639af15230

    • /data/user/0/com.psiphon3/files/firebase_inter_process_mutex-lock_write_report_to_sqlite.lock
      MD5

      d41d8cd98f00b204e9800998ecf8427e

      SHA1

      da39a3ee5e6b4b0d3255bfef95601890afd80709

      SHA256

      e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

      SHA512

      cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

    • /data/user/0/com.psiphon3/no_backup/com.google.android.gms.appid-no-backup
      MD5

      d41d8cd98f00b204e9800998ecf8427e

      SHA1

      da39a3ee5e6b4b0d3255bfef95601890afd80709

      SHA256

      e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

      SHA512

      cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

    • /data/user/0/com.psiphon3/shared_prefs/com.google.android.gms.appid.xml
      Filesize

      2KB

      MD5

      803e425b4495851b88f8fcbce9b37026

      SHA1

      eac6327ff9e445059295fd45725334a83c6659b2

      SHA256

      10deb1b3aff11e95e254b328d511aa81dc092f3d2e3022c7353fa98cfb816e05

      SHA512

      a8a161f6dfd409828c30c1f7c9cb9e68f0f51a1648efd2feeb7b616c9184915c5e3825855842d4e70a298ba8e24efae5bf12eaa150efd69c0f04cca41171babc

    • /data/user/0/com.psiphon3/shared_prefs/com.google.android.gms.appid.xml
      Filesize

      2KB

      MD5

      d678169b828b67eafbe2bb4cceee04bd

      SHA1

      26df3153af4e3998615ccdf239a21e2bd17914a1

      SHA256

      49ea9a46e028a95979a7900b73a24748819628de42f4f6f8f3a006f22bded5e1

      SHA512

      9341392c24ec5f1efd4a721e28a270b5afc9b3fa3d13b73ad0a40456bfd5b4ca90fe1f0a53c9666736e55c7604395d98c4b0af18741e7667b62dcc191bc5c52a

    • /data/user/0/com.psiphon3/shared_prefs/com.google.android.gms.measurement.prefs.xml
      Filesize

      519B

      MD5

      b62a3cbe58454f0be5a37f75ce6944a1

      SHA1

      59ca3b0fd482e28fc783251a7ffc04ef72aabdf5

      SHA256

      a24922f8d57c1cd220b9b04f9cc4ca198dcb5b8f0827bc2ff30f7f2f70a8a71a

      SHA512

      e9a2a6f2a78bd01d820871bb2bc400173d24eb38e365ff82995623850b167328a8f5c1680cb408508df3d6b36cbe64ba10cec18c8eba8875d48cd79c1386b858

    • /data/user/0/com.psiphon3/shared_prefs/com.google.android.gms.measurement.prefs.xml
      Filesize

      122B

      MD5

      250b4caeba60ddf53228405750ba66ca

      SHA1

      422ab714feb34e9f3b4f1cbe669887bcd581ddb1

      SHA256

      2478c97a377db9ce6a44977b4864a40af8b4f5e5c8f81892c424a608ddec911e

      SHA512

      373750c29942fef90281109b6025c398d0f4ac62b58a984a3651d09f8c016440bc40f6bd84fb6d40acf8e48a553d4c1d22e01a95c40a41567c079ba9a338afdb

    • /data/user/0/com.psiphon3/shared_prefs/com.google.android.gms.measurement.prefs.xml
      Filesize

      360B

      MD5

      4159b272f88d7e905c473f0e55e9a913

      SHA1

      2f642134e7aa66b611edf6ce9051f7a61a4a775b

      SHA256

      058959eafad9319c764f13ca494c9a910d3eeb6776b798dbfeb4617e89d00075

      SHA512

      4653ca1b4300530b512a6825085db53a72634ffe007152b236296fc33e11980a040fd7f57d789d828e1778c06c9edcb401ef1be38d23f1cc5c53714267c3287d

    • /data/user/0/com.psiphon3/shared_prefs/com.google.android.gms.measurement.prefs.xml
      Filesize

      456B

      MD5

      15916cc7432113ebe1f380f7674f915a

      SHA1

      69fc8a8c946084fb28c02360cc05f132d37a87ee

      SHA256

      28befd570e9507d2c370aa75690b854db412fa93b6cd15d3e6e444bc57018e61

      SHA512

      005b142e5b374592b6a87010e1a56388d9b1f58b5368f65a272aa2fedae9a7375813ddfff754a20d16bd6db2925ba8ba0ee06ced678c143ab16c292705ebd3b3