81ca0199882eaf315eb627f658ee00d0be8a5fcfe5143de5c70b9f281fd021d0

Analysis

max time kernel
2770879s
max time network
138s
platform
android_x86
resource
android-x86-arm-20220823-en
resource tags

androidarch:armarch:x86image:android-x86-arm-20220823-enlocale:en-usos:android-9-x86system
submitted
23-11-2022 15:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

81ca0199882eaf315eb627f658ee00d0be8a5fcfe5143de5c70b9f281fd021d0.apk
Size

5.7MB
MD5

0b29fe731c48b9b8f517603c3b0a6732
SHA1

83091af23093b8ae2221a7586a2a2d2d6134a96e
SHA256

81ca0199882eaf315eb627f658ee00d0be8a5fcfe5143de5c70b9f281fd021d0
SHA512

a133b69ea5ca1b048251de16323399b7c3a54395738faf87587ae9b6fa42e67cfd24108d354207391f1ff6210de48bb25067f8167898a1d0f534fc11a15f5202
SSDEEP

98304:4hqUDB+RDfNCznCR5wa0j1LL34erwmerNqn4HD4i2fnPbivYznTXIDnQrgE78zr/:4hrDB+nCjCELVzYrNqn4yvPWwznTXOnd

Score

8^/10

infostealer ransomware

Malware Config

Signatures

Requests cell location 1 IoCs
Uses Android APIs to to get current cell location.

Processes:

com.lemoncats.fish

description ioc process

Framework service call com.android.internal.telephony.ITelephony.getCellLocation com.lemoncats.fish
Reads the content of SMS inbox messages. 1 IoCs
infostealer

Processes:

com.lemoncats.fish

description ioc process

URI accessed for read content://sms/inbox com.lemoncats.fish
Reads information about phone network operator.
Uses Crypto APIs (Might try to encrypt user data). 1 IoCs
ransomware

Processes:

com.lemoncats.fish

description ioc process

Framework API call javax.crypto.Cipher.doFinal com.lemoncats.fish

description	ioc	process
Framework service call	com.android.internal.telephony.ITelephony.getCellLocation	com.lemoncats.fish

description	ioc	process
URI accessed for read	content://sms/inbox	com.lemoncats.fish

description	ioc	process
Framework API call	javax.crypto.Cipher.doFinal	com.lemoncats.fish

com.lemoncats.fish
1⤵
- Requests cell location
- Reads the content of SMS inbox messages.
- Uses Crypto APIs (Might try to encrypt user data).
PID:4050

/system/bin/sh
2⤵
PID:4184

ls -l /sbin/su
3⤵
PID:4217

ls -l /system/sbin/su
3⤵
PID:4295

ls -l /system/bin/su
3⤵
PID:4325

ls -l /system/xbin/su
3⤵
PID:4343

ls -l /odm/bin/su
3⤵
PID:4370

ls -l /vendor/bin/su
3⤵
PID:4388

ls -l /vendor/xbin/su
3⤵
PID:4407

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

/data/user/0/com.lemoncats.fish/databases/DD.db

Filesize
24KB

MD5
1160bdb34c9ba04ec06a4fc55a0a94a2

SHA1
1a92e7feed5a50c41bdb71d659d3c540960c6852

SHA256
c7595244dfedab35db68e8ae8072dae2e8364bc0d279e3bff0683fe87bdfe9c1

SHA512
1a7ab1e310038114379dde29d6825138b9dbdfbcdbc6fadeec0270a2a4fe12a045b44eb5455c1480167160594fe7c0cc2288b2c11248d60576fc5b2fa513ef71

Download Submit
/data/user/0/com.lemoncats.fish/databases/DD.db-journal

Filesize
524B

MD5
3c179c78e4debad021020dd003bac000

SHA1
4685156d914827df111aef931ee8b5845b7aa142

SHA256
791df6a871000cab2eb3061cebdad55205bf1725f77c543e936971b88d54c2e9

SHA512
d9dce4aa7162deff29e890dcb18a0d2d6d57129b60ba02262fd368cfab934326b66576c4b37b693e48f18c090f72f3ec6098d01f13a87f02bc9dfbb4422a2e38

Download Submit
/data/user/0/com.lemoncats.fish/databases/DD.db-shm

Filesize
8B

MD5
7dea362b3fac8e00956a4952a3d4f474

SHA1
05fe405753166f125559e7c9ac558654f107c7e9

SHA256
af5570f5a1810b7af78caf4bc70a660f0df51e42baf91d4de5b2328de0e83dfc

SHA512
1b7409ccf0d5a34d3a77eaabfa9fe27427655be9297127ee9522aa1bf4046d4f945983678169cb1a7348edcac47ef0d9e2c924130e5bcc5f0d94937852c42f1b

Download Submit
/data/user/0/com.lemoncats.fish/databases/DD.db-wal

Filesize
40KB

MD5
0471da825ed7423927c1d3dd3735bdca

SHA1
bbaa38e6042b380013f5d0440ebb21420c203444

SHA256
8f7c572b8f25e0fb46f64df4f9fde935ea2add72ea892a3669dc3b8ece53d920

SHA512
7be39bbb1b23b1fb4757352e290ae4f288ee472b65db6b6116708d66dd285a0cf91ea042f91e170564c16777312d059ebd4f8cd4e50ab32d2d72b5e9c45da6d9

Download Submit
/data/user/0/com.lemoncats.fish/databases/mydata

Filesize
4KB

MD5
f2b4b0190b9f384ca885f0c8c9b14700

SHA1
934ff2646757b5b6e7f20f6a0aa76c7f995d9361

SHA256
0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514

SHA512
ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1

Download Submit
/data/user/0/com.lemoncats.fish/databases/mydata-journal

Filesize
524B

MD5
be6b641d682f795fe62b49b927a963f7

SHA1
443c333c573185979615e8a9b39b1fe244f141d5

SHA256
0d9b4549bb6ec74f01bda84e467216c409117f4dc22cfce6dcc8871368ed4aa5

SHA512
2d0dd443e987bbcccd19298bdeaa4c5bc9766c7ee60bf939a0f1b4537f944360a6fcc5ca79dc4537b8138623eb1a1351c0c208ae1203e4f089f8a3a05792ac88

Download Submit
/data/user/0/com.lemoncats.fish/databases/mydata-shm

Filesize
8B

MD5
7dea362b3fac8e00956a4952a3d4f474

SHA1
05fe405753166f125559e7c9ac558654f107c7e9

SHA256
af5570f5a1810b7af78caf4bc70a660f0df51e42baf91d4de5b2328de0e83dfc

SHA512
1b7409ccf0d5a34d3a77eaabfa9fe27427655be9297127ee9522aa1bf4046d4f945983678169cb1a7348edcac47ef0d9e2c924130e5bcc5f0d94937852c42f1b

Download Submit
/data/user/0/com.lemoncats.fish/databases/mydata-wal

Filesize
68KB

MD5
cbc8e93bdf6f54d58d444b60692f6887

SHA1
5f3d7ba87c72c4ff2a26f87288e956b606d28548

SHA256
074e3606d33a4d855fabf20f14049673105f864849a8a56829acd941cf9b117d

SHA512
0c18987544e2f54101c1ac5b2de8fcb5bbff947df1ea29a53154b36e0bd5c59e9c19a8ecfc95240533d98b80ca6326d4c8e349189008b2fc8d484264faf8c1dc

Download Submit
/storage/emulated/0/com.s360.start.times/com.lemoncats.fish

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads