5db3122b9ea5627316d111bb8e5d999b84a585ecccfd8a9f7b0add7ba1354e1a

Analysis

max time kernel
1456170s
max time network
162s
platform
android_x86
resource
android-x86-arm-20220823-en
resource tags

androidarch:armarch:x86image:android-x86-arm-20220823-enlocale:en-usos:android-9-x86system
submitted
08-11-2022 11:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

57f8a57320eeed2f5b5a316d67319191ce717cc51384318966b61f95722e275f.apk
Size

4.2MB
MD5

f7dfd4eb1b1c6ba338d56761b3975618
SHA1

e6c5a40eeb84528c0d4c79f2a43c1521444e33d9
SHA256

57f8a57320eeed2f5b5a316d67319191ce717cc51384318966b61f95722e275f
SHA512

83e9cca68ad2405f2350d723c6a3aab82d0a5c80cbedeca07be021a6031624d78d24057875a80612d47e38e232b4aeeb01a60f3ca7e4220cd22aa9fc19566e9b
SSDEEP

98304:Myzk4JfL6O33NWwTTMTJleNzQwy67vlGu8DQ9NtGnWNEE4cy1ys8/yzfrYdA:MakOLNNzkONkJIlGu8uNsWNEPvUs8/O

Score

8^/10

banker evasion ransomware

Malware Config

Signatures

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps). 1 IoCs
banker

Processes:

com.pycdvgljmfgh3hgp8jo72giu.omflsx1q2g

description ioc process

Framework service call android.content.pm.IPackageManager.getInstalledApplications com.pycdvgljmfgh3hgp8jo72giu.omflsx1q2g
Removes a system notification. 1 IoCs
evasion

Processes:

com.pycdvgljmfgh3hgp8jo72giu.omflsx1q2g

description ioc process

Framework service call android.app.INotificationManager.cancelNotificationWithTag com.pycdvgljmfgh3hgp8jo72giu.omflsx1q2g
Uses Crypto APIs (Might try to encrypt user data). 1 IoCs
ransomware

Processes:

com.pycdvgljmfgh3hgp8jo72giu.omflsx1q2g

description ioc process

Framework API call javax.crypto.Cipher.doFinal com.pycdvgljmfgh3hgp8jo72giu.omflsx1q2g

description	ioc	process
Framework service call	android.content.pm.IPackageManager.getInstalledApplications	com.pycdvgljmfgh3hgp8jo72giu.omflsx1q2g

description	ioc	process
Framework service call	android.app.INotificationManager.cancelNotificationWithTag	com.pycdvgljmfgh3hgp8jo72giu.omflsx1q2g

description	ioc	process
Framework API call	javax.crypto.Cipher.doFinal	com.pycdvgljmfgh3hgp8jo72giu.omflsx1q2g

com.pycdvgljmfgh3hgp8jo72giu.omflsx1q2g
1⤵
- Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps).
- Removes a system notification.
- Uses Crypto APIs (Might try to encrypt user data).
PID:4159

com.pycdvgljmfgh3hgp8jo72giu.omflsx1q2g:BackgroundService
1⤵
PID:4210

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

/data/user/0/com.pycdvgljmfgh3hgp8jo72giu.omflsx1q2g/app_webview/Cookies

Filesize
64KB

MD5
cb7543c4df600f2af58097cce0e334ba

SHA1
83cc92f38c27fdb4fa519b1ce2f37912f24af1f0

SHA256
64c022ae708f94ffde986e105d88f708884de325720bfb9925c4160a6d417233

SHA512
ad51cad0472327bd68aa2d791341cfafed58971752352537bb603ed18b15a3f9185e9150983a28ecd09606e8dcaef6d1c9d93213dd246ef7720f39842eb3d980

Download Submit
/data/user/0/com.pycdvgljmfgh3hgp8jo72giu.omflsx1q2g/app_webview/Cookies-journal

Filesize
1KB

MD5
80cb4fa55383908194e5f63c84344d2e

SHA1
cfa24d42597593d1a5377cafad8c369b6709311e

SHA256
bb9518c4aa32f37f510495adca947f390cc319e6da91483ca7d8bb58bb7be267

SHA512
efd2e282295991ef8115bcb90805a2b0291231c7a9545506375cc64343dae21966a4beff8e252135264f6b768e760ae8a1262a83f8e279efd46a69652cbad2ad

Download Submit
/data/user/0/com.pycdvgljmfgh3hgp8jo72giu.omflsx1q2g/app_webview/GPUCache/index

Filesize
20B

MD5
93027d42b314432c4216e6cfca48b384

SHA1
43448dd8102979c3926828182579691945eedd4e

SHA256
3cda72e67c62e52a342309c44f2cb3b6c1019c7b11822e2f628e48e254e2b41c

SHA512
a52d13cf7f5be196d1e2f135b8a010f80558c5d35e90e7792441d1c976517d55cf1c9587949db69ebef294cc6ef79529a65e7d779964793016efecacd152f70e

Download Submit
/data/user/0/com.pycdvgljmfgh3hgp8jo72giu.omflsx1q2g/app_webview/GPUCache/index-dir/temp-index

Filesize
48B

MD5
40987433a609bc453d74961b09fd8a0c

SHA1
0b25896df44216c815415a0249b9cc3bd04886fe

SHA256
e01aa22c667017ec0fc00a90d9c4d0ac8db2c14200ef21618ef4bd835ab1865c

SHA512
971713832ce0f12a80eb11cf2bb4e41e89c4907c59e5ac4922e0f46bb076423e50a8cca51a140b993dd8ee30c36aa6b4f4948c3910d20f81b577174cecc6e0e1

Download Submit
/data/user/0/com.pycdvgljmfgh3hgp8jo72giu.omflsx1q2g/app_webview/Web Data

Filesize
104KB

MD5
dc79f9ce5f3ab5270b33e61119dfc959

SHA1
1844bf222a5144b513dcf2fb50a18c011701c647

SHA256
47e65f4de08deabfd52ecdb8b0a29c61c482188b92c36182e2112ca0a8f4ff65

SHA512
18b8894a7f35df516f423bbdebf1e05ce09eaf4345b139e59e603cadb81f8d1fa20f793438c28e8fd9a64e64f0684223d90ce6f10d3f93cb0c781049a8cff03e

Download Submit
/data/user/0/com.pycdvgljmfgh3hgp8jo72giu.omflsx1q2g/app_webview/Web Data-journal

Filesize
1KB

MD5
879ca21ddd576a0c3f4130c6937a5b67

SHA1
4c3bb2b9bbeffe2eebdf721bc3d0355686ed629a

SHA256
7a1512e3036ad47ae19cfe312982a117dd537d6079ddf57c1e6c1781bee851cd

SHA512
b367e66f77ddeece8de58dbbc599def2b1b0e8297271034e5b4836da4b0b6fa7b6ee80b170cf7c8edda3cdff3add1b36fc2051bebebb880fd920fdb70203ff04

Download Submit
/data/user/0/com.pycdvgljmfgh3hgp8jo72giu.omflsx1q2g/app_webview/metrics_guid

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/com.pycdvgljmfgh3hgp8jo72giu.omflsx1q2g/app_webview/metrics_guid

Filesize
36B

MD5
ad3b19e617a3f54e777b652203da6aa2

SHA1
d5bed433d826bd14d1d3e8a74032e2fcca355d74

SHA256
ec599e6326b229bae96434bcdc60d534e32a75592b1b086c4cd6df86279b2587

SHA512
e170f78a9fa6982fe1e89719d8b59d3c244f754e0fcf82113710648b2338f7d3d1fc57f3bfc74cb46692ca151a06d3256eb599868d951193dfb36e8377d4ab92

Download Submit
/data/user/0/com.pycdvgljmfgh3hgp8jo72giu.omflsx1q2g/app_webview/variations_seed_new

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/com.pycdvgljmfgh3hgp8jo72giu.omflsx1q2g/app_webview/variations_stamp

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/com.pycdvgljmfgh3hgp8jo72giu.omflsx1q2g/app_webview/webview_data.lock

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/com.pycdvgljmfgh3hgp8jo72giu.omflsx1q2g/cache/org.chromium.android_webview/9dfee4d9ff88acfc_0

Filesize
7KB

MD5
8b8fab6a8b71a14ff35c82b2f1cb31ae

SHA1
d923a9bc4a14b697fe53a9214ea7e23285db1516

SHA256
c78a6a716362f6002dc08683c77f182d3a15b27f76eef66cf07c1c40114c8bef

SHA512
6e1d5eeae2d3df708b43ff93da3c8ade3d848427f023c191b5e45bba18f64790f98b091436cc53b0db4214413632dffd3bda6b1e132e4c95c9a13924b0afc70f

Download Submit
/data/user/0/com.pycdvgljmfgh3hgp8jo72giu.omflsx1q2g/cache/org.chromium.android_webview/index

Filesize
20B

MD5
93027d42b314432c4216e6cfca48b384

SHA1
43448dd8102979c3926828182579691945eedd4e

SHA256
3cda72e67c62e52a342309c44f2cb3b6c1019c7b11822e2f628e48e254e2b41c

SHA512
a52d13cf7f5be196d1e2f135b8a010f80558c5d35e90e7792441d1c976517d55cf1c9587949db69ebef294cc6ef79529a65e7d779964793016efecacd152f70e

Download Submit
/data/user/0/com.pycdvgljmfgh3hgp8jo72giu.omflsx1q2g/cache/org.chromium.android_webview/index-dir/temp-index

Filesize
72B

MD5
b24ab194e0d26746aaf6cb95f693e252

SHA1
27024b1997ef32776cf5fbfb22e120f4e5d3ca40

SHA256
603430dbf3275f2af508d922adc114f4920162021f40a26b43ab46b18cb18a16

SHA512
403218ecbe59d1b0a6b30347148d3e5da2b9f184e86f7a91afb6b502c1c25502d459c4506f74b7f6dceea0b042963b798e71b8c153e77605d0eb40cf01086c8a

Download Submit
/data/user/0/com.pycdvgljmfgh3hgp8jo72giu.omflsx1q2g/databases/sharked.db

Filesize
4KB

MD5
f2b4b0190b9f384ca885f0c8c9b14700

SHA1
934ff2646757b5b6e7f20f6a0aa76c7f995d9361

SHA256
0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514

SHA512
ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1

Download Submit
/data/user/0/com.pycdvgljmfgh3hgp8jo72giu.omflsx1q2g/databases/sharked.db-journal

Filesize
524B

MD5
c195027e0fb938ff252faa8db52f614e

SHA1
936f64123bfe4fab5090bc4f496e23dc053ea97e

SHA256
d3d654ae75c4710702f705f46b42c8eac7631c541b432dd5b0def4a63d81fef6

SHA512
53915416a726e5572f8373851a0888c6eb94b0811be37f5292a50f939cfb9d54bb5c0288e6efa004f2d7ee8984a1cfe1588b60be56d7947f7c412cfd60b88857

Download Submit
/data/user/0/com.pycdvgljmfgh3hgp8jo72giu.omflsx1q2g/databases/sharked.db-shm

Filesize
8B

MD5
7dea362b3fac8e00956a4952a3d4f474

SHA1
05fe405753166f125559e7c9ac558654f107c7e9

SHA256
af5570f5a1810b7af78caf4bc70a660f0df51e42baf91d4de5b2328de0e83dfc

SHA512
1b7409ccf0d5a34d3a77eaabfa9fe27427655be9297127ee9522aa1bf4046d4f945983678169cb1a7348edcac47ef0d9e2c924130e5bcc5f0d94937852c42f1b

Download Submit
/data/user/0/com.pycdvgljmfgh3hgp8jo72giu.omflsx1q2g/databases/sharked.db-wal

Filesize
144KB

MD5
dc1bd0c2adbb32f98a4da9b811934336

SHA1
ce2ac79cedf402f81df542b67796be3356df5c02

SHA256
110979b3171713c8f1c83b9eba5dce1e8d1b1a39004f26c1ca8edab818f48b48

SHA512
5893ad9ab5f5d9895320b0e5afc90f9bf79ae6a2763dfe881e1c44f19df9ea52d478b7ef64e600ca1fe925e84f37ad895040cc6c16c5281dc3e93ba6de4d90e0

Download Submit
/data/user/0/com.pycdvgljmfgh3hgp8jo72giu.omflsx1q2g/shared_prefs/WebViewChromiumPrefs.xml

Filesize
127B

MD5
21223e9184445fe043476484cd8cb1f9

SHA1
2b4813f849121d60ba35eb0889080668bb62c778

SHA256
bb61b7c087c2ae2de93a7740ff75707342940557146366e92b840284cd9446af

SHA512
be21408de0cc643650e5d9ab9057a8f9de88e37fbdc6417cfeba160402ec4cd14fccbc82cbbfd941ecfc0bb3d4056ee61ac199efdc99d647d53e65818835fd48

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads