Overview

overview

8

Static

static

7

db3497685c...a0.apk

android-9-x86

8

Analysis

  • max time kernel
    2822346s
  • max time network
    132s
  • platform
    android_x86
  • resource
    android-x86-arm-20220823-en
  • resource tags

    androidarch:armarch:x86image:android-x86-arm-20220823-enlocale:en-usos:android-9-x86system
  • submitted
    24-11-2022 02:45

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    db3497685c683f50111770aaff03e52eef67debffd119c93dd3afe21801ba4a0.apk

  • Size

    3.0MB

  • MD5

    b37250f75f5965cbbcbe2c35aeeceeaa

  • SHA1

    7950439dd26bbc079e6b26c7e48e189963f11fe8

  • SHA256

    db3497685c683f50111770aaff03e52eef67debffd119c93dd3afe21801ba4a0

  • SHA512

    aa34936c03f3b80ed19b19b1b6a63b73bb30942560a9d82de479ea0a5d9aef4e2cb12023df474890d8a207e6971d6f4b2676a11220b141bfd686c8cbdb92ceca

  • SSDEEP

    49152:L7d8/YuJI9ipBSDPNJ1qtFGyn3ov4ZmsxYD/99Ewep6S4/JbjqcF5lODD3/zWwhk:NRv9ipBUn1qa+ZfclKwepjeJddODTMT

Score
8/10
ransomware

Malware Config

Signatures

  • Requests cell location 1 IoCs

    Uses Android APIs to to get current cell location.

  • Reads information about phone network operator.
  • Uses Crypto APIs (Might try to encrypt user data). 1 IoCs
    ransomware

Processes

  • com.qy.mv
    1⤵
    • Requests cell location
    • Uses Crypto APIs (Might try to encrypt user data).
    PID:4055
    • /system/bin/sh
      2⤵
        PID:4133
        • ls -l /sbin/su
          3⤵
            PID:4232
          • ls -l /system/sbin/su
            3⤵
              PID:4386
            • ls -l /system/bin/su
              3⤵
                PID:4447
              • ls -l /system/xbin/su
                3⤵
                  PID:4509
                • ls -l /odm/bin/su
                  3⤵
                    PID:4569
                  • ls -l /vendor/bin/su
                    3⤵
                      PID:4623
                    • ls -l /vendor/xbin/su
                      3⤵
                        PID:4679

                  Network

                  MITRE ATT&CK Matrix

                  Replay Monitor

                  Loading Replay Monitor...

                  Downloads

                  • /data/user/0/com.qy.mv/databases/qy_db_pay
                    Filesize

                    4KB

                    MD5

                    f2b4b0190b9f384ca885f0c8c9b14700

                    SHA1

                    934ff2646757b5b6e7f20f6a0aa76c7f995d9361

                    SHA256

                    0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514

                    SHA512

                    ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1

                    Download Submit
                  • /data/user/0/com.qy.mv/databases/qy_db_pay-journal
                    Filesize

                    524B

                    MD5

                    8d1ccafcbee164f7e02ba26d3bb35e9e

                    SHA1

                    cb3c39d2ebede03f914b93e5124133b9317e354c

                    SHA256

                    a5eccd3f01ffd228be95757f8c4f22e36f9c6c4cc282ce34ad3f8f92322dc72c

                    SHA512

                    45e5afc6a8b27f155f01aae818e6d30d5f012e74c1c880b41e919459c1f5e554c94b0040ed66e15c59671164fc382fb6fda1f863486e851faf5bc548661b28bd

                    Download Submit
                  • /data/user/0/com.qy.mv/databases/qy_db_pay-shm
                    Filesize

                    8B

                    MD5

                    7dea362b3fac8e00956a4952a3d4f474

                    SHA1

                    05fe405753166f125559e7c9ac558654f107c7e9

                    SHA256

                    af5570f5a1810b7af78caf4bc70a660f0df51e42baf91d4de5b2328de0e83dfc

                    SHA512

                    1b7409ccf0d5a34d3a77eaabfa9fe27427655be9297127ee9522aa1bf4046d4f945983678169cb1a7348edcac47ef0d9e2c924130e5bcc5f0d94937852c42f1b

                    Download Submit
                  • /data/user/0/com.qy.mv/databases/qy_db_pay-wal
                    Filesize

                    64KB

                    MD5

                    3a703e6294d7c927f95a4f2a00e470b9

                    SHA1

                    11136ac1688d4d0ea9b0da6a150dc81d2387ac2d

                    SHA256

                    0300e1db5f4820e4df3baf853e2a6aa4f8030f616fe9959a54922f0bdc27f5d5

                    SHA512

                    be2bb7aa9f5a494497e0aac56e98ec397732d715dfefba226bbe75530e9781adf0537222e2d0ea34c9ab0b49c0ba05656ef7107fe3e9965063c302e395cd167f

                    Download Submit
                  • /data/user/0/com.qy.mv/files/meinv
                    Filesize

                    171B

                    MD5

                    0f03295188d1e626cd15f695f71f44a0

                    SHA1

                    bf17a19c072308a70102dba2a36673f6a905bf01

                    SHA256

                    dc610a6a7ea683fce5d1f74ee4e206dd0195f10d7b95d5dc6117dd1937904e92

                    SHA512

                    fdb3c67e5632747d9c1dde2a0f732285621e317d2743367f02bb2268523e1b74d1030aab0d24520678eabff1f7cf662040f75144b0a9d42fe1f6e600cd8b72e7

                    Download Submit