83de12517304b6b1d7411596fd89dc2f0ff6342eaea0f92e11824f1a2db1beb0

Analysis

max time kernel
2822209s
max time network
141s
platform
android_x86
resource
android-x86-arm-20220823-en
resource tags

androidarch:armarch:x86image:android-x86-arm-20220823-enlocale:en-usos:android-9-x86system
submitted
24-11-2022 02:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

83de12517304b6b1d7411596fd89dc2f0ff6342eaea0f92e11824f1a2db1beb0.apk
Size

6.1MB
MD5

fbac8e2d630ae70eec54683f4ec1a251
SHA1

acd6396bd57ec66529b6a7793f37f6d4e6d3528d
SHA256

83de12517304b6b1d7411596fd89dc2f0ff6342eaea0f92e11824f1a2db1beb0
SHA512

9554bfc80d0d7d48cf6fa82ee32e0574991316bc8212aa9bbd8627352f3eff8fe9f19f068aa1735d7cc6211256ef077bab7e5eb7b2aca53aa52e50bfb8fcbd14
SSDEEP

196608:j19MhYKYs1ENDk+qNL49e6tpQe5K5lPKrfh2XzeFrv170QiHAeYkAY52e:jaYKYs1ENDmM9e6tH544hW61v170QiHX

Score

8^/10

infostealer ransomware

Malware Config

Signatures

Requests cell location 1 IoCs
Uses Android APIs to to get current cell location.

Processes:

com.main.gm25

description ioc process

Framework service call com.android.internal.telephony.ITelephony.getCellLocation com.main.gm25
Reads the content of SMS inbox messages. 1 IoCs
infostealer

Processes:

com.main.gm25

description ioc process

URI accessed for read content://sms/inbox com.main.gm25
Reads information about phone network operator.
Uses Crypto APIs (Might try to encrypt user data). 1 IoCs
ransomware

Processes:

com.main.gm25

description ioc process

Framework API call javax.crypto.Cipher.doFinal com.main.gm25

description	ioc	process
Framework service call	com.android.internal.telephony.ITelephony.getCellLocation	com.main.gm25

description	ioc	process
URI accessed for read	content://sms/inbox	com.main.gm25

description	ioc	process
Framework API call	javax.crypto.Cipher.doFinal	com.main.gm25

com.main.gm25
1⤵
- Requests cell location
- Reads the content of SMS inbox messages.
- Uses Crypto APIs (Might try to encrypt user data).
PID:4043

/system/bin/sh
2⤵
PID:4216

ls -l /sbin/su
3⤵
PID:4256

ls -l /system/sbin/su
3⤵
PID:4355

ls -l /system/bin/su
3⤵
PID:4432

ls -l /system/xbin/su
3⤵
PID:4477

ls -l /odm/bin/su
3⤵
PID:4567

ls -l /vendor/bin/su
3⤵
PID:4607

ls -l /vendor/xbin/su
3⤵
PID:4647

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

/data/user/0/com.main.gm25/databases/mydata
Filesize
4KB

MD5
f2b4b0190b9f384ca885f0c8c9b14700

SHA1
934ff2646757b5b6e7f20f6a0aa76c7f995d9361

SHA256
0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514

SHA512
ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1

Download Submit
/data/user/0/com.main.gm25/databases/mydata-journal
Filesize
524B

MD5
5f723c9959339d38bdeddca25d01e45e

SHA1
c7f1373aedfb59a82329e72961ea22acd74d476f

SHA256
5c97c32bef7d1dc32411f713afbb733d4b1d12f012696ce1ca449b34a9267402

SHA512
5842e29a4caf09458e71a44502a4fbdaaaccabfc1c98286956925ec665d1537ed542bcc8fa94129d7fc4e98909b04a8a2fa288161bfb0a35b0a3a45b0e74a5e8

Download Submit
/data/user/0/com.main.gm25/databases/mydata-shm
Filesize
8B

MD5
7dea362b3fac8e00956a4952a3d4f474

SHA1
05fe405753166f125559e7c9ac558654f107c7e9

SHA256
af5570f5a1810b7af78caf4bc70a660f0df51e42baf91d4de5b2328de0e83dfc

SHA512
1b7409ccf0d5a34d3a77eaabfa9fe27427655be9297127ee9522aa1bf4046d4f945983678169cb1a7348edcac47ef0d9e2c924130e5bcc5f0d94937852c42f1b

Download Submit
/data/user/0/com.main.gm25/databases/mydata-wal
Filesize
68KB

MD5
573639daac583491817340ec3ad8781b

SHA1
a8ccb06bf7b5985a9bba5de239faefdbe510c253

SHA256
2d733dd233ac89d5e22255eeebe8c08c45b74aac83434f0dc09f449f1f56bed6

SHA512
85e54721e553ab10e55c2499b2345f3c3e2453bdcca60cc1a0a27475f459a4252a377bb8218d9aa7da5b7721f8a41a422e4c6f81eb4068f0230b964e5dabdef4

Download Submit
/data/user/0/com.main.gm25/files/.imprint
Filesize
848B

MD5
7dbbdb89eb347b90e022cead1163dd00

SHA1
212519b4ef96cb4272b05f08605ab2a20ad81bee

SHA256
fdbe11ce21526f11b76e1bc2eec6050f1e04c1575307e559c0a680e535f49d18

SHA512
b0cc364f3f7c5b2a729cc947aabc52a39aaac5eacf3a284b5f97458cfac97a098952f47b97b3801fd4096a45f498c680ad00aef1809ead0c849da4bce4205f2d

Download Submit
/data/user/0/com.main.gm25/files/umeng_it.cache
Filesize
211B

MD5
9064ad5c579e57bf5bfd24aaed8424be

SHA1
fa289757d9fe11be87d4bb0e35653f1c031e1aa9

SHA256
ddff3537618cd47356b15e73bdba0da25b5e4a2e06b62260f0e25073bd7dbf6a

SHA512
0cf0adb538cf6e95b015ffe2caab6663343a8f54043fa01c1f13dba6ac0014a0fd6817c313cecb2a2a96dd808d55f1c6bc47357d64595378c5552f5c4d3618b3

Download Submit
/data/user/0/com.main.gm25/shared_prefs/push_shared_file.xml
Filesize
125B

MD5
ff52260b2e1120e746d4151db725d091

SHA1
55593b8395aa15113c2e2dde7618ca4e0afb8f7c

SHA256
1792d8c666330d2ddcf20be0fc25e40f8886ca01bf9a97f1d26fe0efbf91569e

SHA512
916889ddf5874e272bcb8f10afd99934878e09bc08b7706b272842189e87c6d6c9dc07b290d47d502d830b89facf283496d2c38fd9c2ca7f9791e07e6bb2232f

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads