Overview

overview

8

Static

static

7

16e414873b...6c.apk

android-9-x86

8

Analysis

  • max time kernel
    2822446s
  • max time network
    134s
  • platform
    android_x86
  • resource
    android-x86-arm-20220823-en
  • resource tags

    androidarch:armarch:x86image:android-x86-arm-20220823-enlocale:en-usos:android-9-x86system
  • submitted
    24-11-2022 02:45

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    16e414873b1dba7ef54a631eabb7f976c3de2c32a55e5f964acdd3f3c5b93c6c.apk

  • Size

    3.0MB

  • MD5

    453b2d42ee001c46c25b92d0110077cc

  • SHA1

    e86e910ea304d37d702148e9e3425aee4ff586b5

  • SHA256

    16e414873b1dba7ef54a631eabb7f976c3de2c32a55e5f964acdd3f3c5b93c6c

  • SHA512

    d3237871bfeb8e4188e02081c145c736ffaacfc6d208f5b327199163d2e72c3f840a05d5cca6b1914c0c0ed5ff5b95c51a69240a72b01f6d5c2a90488f5d09c5

  • SSDEEP

    98304:/FHROpBEnhO+iZHOlKwepjeJddNTAptHj6/ANRh:jOXEnE+iUlKhpj8RUHjmAd

Score
8/10
ransomware

Malware Config

Signatures

  • Requests cell location 1 IoCs

    Uses Android APIs to to get current cell location.

  • Reads information about phone network operator.
  • Uses Crypto APIs (Might try to encrypt user data). 1 IoCs
    ransomware

Processes

  • com.qy.mv
    1⤵
    • Requests cell location
    • Uses Crypto APIs (Might try to encrypt user data).
    PID:4043
    • /system/bin/sh
      2⤵
        PID:4197
        • ls -l /sbin/su
          3⤵
            PID:4265
          • ls -l /system/sbin/su
            3⤵
              PID:4406
            • ls -l /system/bin/su
              3⤵
                PID:4598
              • ls -l /system/xbin/su
                3⤵
                  PID:4726
                • ls -l /odm/bin/su
                  3⤵
                    PID:4794
                  • ls -l /vendor/bin/su
                    3⤵
                      PID:4852
                    • ls -l /vendor/xbin/su
                      3⤵
                        PID:4914

                  Network

                  MITRE ATT&CK Matrix

                  Replay Monitor

                  Loading Replay Monitor...

                  Downloads

                  • /data/user/0/com.qy.mv/databases/qy_db_pay
                    Filesize

                    4KB

                    MD5

                    f2b4b0190b9f384ca885f0c8c9b14700

                    SHA1

                    934ff2646757b5b6e7f20f6a0aa76c7f995d9361

                    SHA256

                    0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514

                    SHA512

                    ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1

                    Download Submit

                  • /data/user/0/com.qy.mv/databases/qy_db_pay-journal
                    Filesize

                    524B

                    MD5

                    a36735f3f1c716359ba590384978db00

                    SHA1

                    81b5b6fb0060d82021428b1fb80d4e567701bff7

                    SHA256

                    20b2f41f6f155bc1ab6e7d65ea9601318ffbeb7d82a82f269b4f0c98cee33d26

                    SHA512

                    7faf5cf359114da8127d0c836c9ec627755907343e261b6cb2d1eb22fa64891cb770bc23b3bef37bbb1439855f8e62f2572c39687b4be2b7427909654df0554b

                    Download Submit

                  • /data/user/0/com.qy.mv/databases/qy_db_pay-shm
                    Filesize

                    8B

                    MD5

                    7dea362b3fac8e00956a4952a3d4f474

                    SHA1

                    05fe405753166f125559e7c9ac558654f107c7e9

                    SHA256

                    af5570f5a1810b7af78caf4bc70a660f0df51e42baf91d4de5b2328de0e83dfc

                    SHA512

                    1b7409ccf0d5a34d3a77eaabfa9fe27427655be9297127ee9522aa1bf4046d4f945983678169cb1a7348edcac47ef0d9e2c924130e5bcc5f0d94937852c42f1b

                    Download Submit

                  • /data/user/0/com.qy.mv/databases/qy_db_pay-wal
                    Filesize

                    64KB

                    MD5

                    80c3331ecaa96f67bbe1b55968ad7b8d

                    SHA1

                    9867466a44b4db698794fd88614434a7fa71c29f

                    SHA256

                    db03641a59a356605f6c6ea36ff931a57e7ad1435ac08a484be9bb06f39d899e

                    SHA512

                    2e6f36cd1728cd3037ff862429fae2757393c318070489d5454722ac02ffc4d44998046236a10a7efd78f4159b199bf05d5414267c1b1b7c05e498c8d614d6b6

                    Download Submit

                  • /data/user/0/com.qy.mv/files/meinv
                    Filesize

                    171B

                    MD5

                    0f03295188d1e626cd15f695f71f44a0

                    SHA1

                    bf17a19c072308a70102dba2a36673f6a905bf01

                    SHA256

                    dc610a6a7ea683fce5d1f74ee4e206dd0195f10d7b95d5dc6117dd1937904e92

                    SHA512

                    fdb3c67e5632747d9c1dde2a0f732285621e317d2743367f02bb2268523e1b74d1030aab0d24520678eabff1f7cf662040f75144b0a9d42fe1f6e600cd8b72e7

                    Download Submit