Analysis

  • max time kernel
    2936450s
  • max time network
    157s
  • platform
    android_x86
  • resource
    android-x86-arm-20220823-en
  • resource tags

    androidarch:armarch:x86image:android-x86-arm-20220823-enlocale:en-usos:android-9-x86system
  • submitted
    25-11-2022 08:41

General

  • Target

    6015bfc8ecc94eb7a999f7880557de943d80518fd6f2f18ae091b5a82aded4d0.apk

  • Size

    2.5MB

  • MD5

    a94a4f9b67e34aad85507113dadf9729

  • SHA1

    b98b20495452bb19e0f502642f96888b0b290b0d

  • SHA256

    6015bfc8ecc94eb7a999f7880557de943d80518fd6f2f18ae091b5a82aded4d0

  • SHA512

    abedf8c6858feb2e3d40f4127971d91127146b332f460ef36161aedd6def04470b64c972f0cd5169a25bc98120d5dd0cbfae4abfd23a06645aabee71d5a004b4

  • SSDEEP

    49152:JASxVPa2KAPsU2a47NNpOv4uCRjl9s81csncj0HGmQFe3oeYUcunYzom3cTRexHl:JALmsla4FOvtgp9s81Pcj0HXQnX3z7fF

Malware Config

Signatures

  • Agent smith

    Agent smith is a modular adware that installs malicious ADs into legitimate applications.

  • Requests cell location 1 IoCs

    Uses Android APIs to to get current cell location.

  • Loads dropped Dex/Jar 2 IoCs

    Runs executable file dropped to the device during analysis.

  • Requests dangerous framework permissions 8 IoCs
  • Reads information about phone network operator.
  • Uses Crypto APIs (Might try to encrypt user data). 1 IoCs

Processes

  • com.dfoiej8.ccsdyia
    1⤵
    • Requests cell location
    • Loads dropped Dex/Jar
    • Uses Crypto APIs (Might try to encrypt user data).
    PID:4083
  • /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.dfoiej8.ccsdyia/files/one.dex --output-vdex-fd=123 --oat-fd=126 --oat-location=/data/user/0/com.dfoiej8.ccsdyia/files/oat/x86/one.odex --compiler-filter=quicken --class-loader-context=&
    1⤵
    • Loads dropped Dex/Jar
    PID:4315

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/user/0/com.dfoiej8.ccsdyia/app_jar/lpdf.jar
    Filesize

    35KB

    MD5

    e1ab911d4b585a26aae02d8540575013

    SHA1

    ac148f7bdf95edddc97d9224ff51a771f1070520

    SHA256

    8a71fab57b4a03f0b37095daa2eaa086ec6ed6c1c6166ca67c0e0a9e14cc85ca

    SHA512

    983ec12cde3cbfaffb414b8c8eb17c793bee558eb51b9d5e630f9bd5f312e0ce55622719aad6097a799286c25001212b26d7053e7e110a4918beace33d3bcbc4

  • /data/user/0/com.dfoiej8.ccsdyia/app_jar/lpdf.jar.x86.flock
    MD5

    d41d8cd98f00b204e9800998ecf8427e

    SHA1

    da39a3ee5e6b4b0d3255bfef95601890afd80709

    SHA256

    e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

    SHA512

    cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

  • /data/user/0/com.dfoiej8.ccsdyia/app_jar/oat/x86/lpdf.odex
    MD5

    d41d8cd98f00b204e9800998ecf8427e

    SHA1

    da39a3ee5e6b4b0d3255bfef95601890afd80709

    SHA256

    e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

    SHA512

    cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

  • /data/user/0/com.dfoiej8.ccsdyia/app_jar/oat/x86/lpdf.vdex
    MD5

    d41d8cd98f00b204e9800998ecf8427e

    SHA1

    da39a3ee5e6b4b0d3255bfef95601890afd80709

    SHA256

    e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

    SHA512

    cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

  • /data/user/0/com.dfoiej8.ccsdyia/app_webview/Web Data
    Filesize

    104KB

    MD5

    dc79f9ce5f3ab5270b33e61119dfc959

    SHA1

    1844bf222a5144b513dcf2fb50a18c011701c647

    SHA256

    47e65f4de08deabfd52ecdb8b0a29c61c482188b92c36182e2112ca0a8f4ff65

    SHA512

    18b8894a7f35df516f423bbdebf1e05ce09eaf4345b139e59e603cadb81f8d1fa20f793438c28e8fd9a64e64f0684223d90ce6f10d3f93cb0c781049a8cff03e

  • /data/user/0/com.dfoiej8.ccsdyia/app_webview/Web Data-journal
    Filesize

    1KB

    MD5

    105842ea3c969c2c921afd195f5f51e0

    SHA1

    265661f27bb7b0c24edc46203a1a5c325a0b6ea1

    SHA256

    44f1897082a46e65d19705d4e528a01dd77d1bcd0d0a1874d743d62716248b4f

    SHA512

    7a72e1c45d4a55648e157d254d803b11011791b86eccfc90aa8b25e20d5b73db9e6aa88c923d282df05a493c7b3b5410455a94dd8fb6003da2b97912fe5c9d38

  • /data/user/0/com.dfoiej8.ccsdyia/app_webview/metrics_guid
    MD5

    d41d8cd98f00b204e9800998ecf8427e

    SHA1

    da39a3ee5e6b4b0d3255bfef95601890afd80709

    SHA256

    e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

    SHA512

    cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

  • /data/user/0/com.dfoiej8.ccsdyia/app_webview/metrics_guid
    Filesize

    36B

    MD5

    afbcaf9c4db66bc9645e172a394115bc

    SHA1

    d6f9e28b9f928b3b2a21158613dcc654bbc6b96b

    SHA256

    d92be75422781323d123adbd5c178b75fc5ed0385b426cc995d61fb5919f965c

    SHA512

    ac689c7cf48c6b4fc195043e9f6794a3ab98560b87b8a6f6076f109e1a17fe129b21502933d0497a46ca36b87ad264eeae845831695df9d16d6b4a0742b136da

  • /data/user/0/com.dfoiej8.ccsdyia/app_webview/variations_seed_new
    MD5

    d41d8cd98f00b204e9800998ecf8427e

    SHA1

    da39a3ee5e6b4b0d3255bfef95601890afd80709

    SHA256

    e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

    SHA512

    cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

  • /data/user/0/com.dfoiej8.ccsdyia/app_webview/variations_stamp
    MD5

    d41d8cd98f00b204e9800998ecf8427e

    SHA1

    da39a3ee5e6b4b0d3255bfef95601890afd80709

    SHA256

    e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

    SHA512

    cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

  • /data/user/0/com.dfoiej8.ccsdyia/app_webview/webview_data.lock
    MD5

    d41d8cd98f00b204e9800998ecf8427e

    SHA1

    da39a3ee5e6b4b0d3255bfef95601890afd80709

    SHA256

    e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

    SHA512

    cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

  • /data/user/0/com.dfoiej8.ccsdyia/files/jiepayplugin.apk
    Filesize

    45KB

    MD5

    c83e81f064fbbff6870210fcc9abcf6c

    SHA1

    65f94be4a62160065ff192b9baac02da3a293031

    SHA256

    fc37a898193dd0b37c226a5841936c88bc51a02bf99abe3f17ab84951a3aa1c9

    SHA512

    100c617de8aadb73da780a8e16eccde545b9717bc0e77823efbc1d9831f13a2592a1a14d9e68ba49a364cf2a8029f6fee42d7268925da7f0112c18a5e9412164

  • /data/user/0/com.dfoiej8.ccsdyia/files/jiepayplugin.apk.x86.flock
    MD5

    d41d8cd98f00b204e9800998ecf8427e

    SHA1

    da39a3ee5e6b4b0d3255bfef95601890afd80709

    SHA256

    e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

    SHA512

    cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

  • /data/user/0/com.dfoiej8.ccsdyia/files/oat/x86/one.odex
    MD5

    d41d8cd98f00b204e9800998ecf8427e

    SHA1

    da39a3ee5e6b4b0d3255bfef95601890afd80709

    SHA256

    e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

    SHA512

    cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

  • /data/user/0/com.dfoiej8.ccsdyia/files/oat/x86/one.vdex
    MD5

    d41d8cd98f00b204e9800998ecf8427e

    SHA1

    da39a3ee5e6b4b0d3255bfef95601890afd80709

    SHA256

    e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

    SHA512

    cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

  • /data/user/0/com.dfoiej8.ccsdyia/files/oat/x86/yypyda.odex
    MD5

    d41d8cd98f00b204e9800998ecf8427e

    SHA1

    da39a3ee5e6b4b0d3255bfef95601890afd80709

    SHA256

    e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

    SHA512

    cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

  • /data/user/0/com.dfoiej8.ccsdyia/files/oat/x86/yypyda.vdex
    MD5

    d41d8cd98f00b204e9800998ecf8427e

    SHA1

    da39a3ee5e6b4b0d3255bfef95601890afd80709

    SHA256

    e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

    SHA512

    cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

  • /data/user/0/com.dfoiej8.ccsdyia/files/one.dex
    Filesize

    59KB

    MD5

    1b5c4ae7e385db4551ced8c19386abe0

    SHA1

    12d4bc9728c4f1deec1b9b8aacbfe71c3ceeb4d4

    SHA256

    8211fa61bdd647dc627a182c4e2a763024252dfd94d14f1f12c9c9b4df045d70

    SHA512

    f56d74aa9a3c150034866b12abf7ed233fcc2bd03d7f34bfdfd61cd054952189311669892e91dfcbf5000f509210d56d094abff99371e4897bf7943ef5a2764b

  • /data/user/0/com.dfoiej8.ccsdyia/files/one.dex
    Filesize

    59KB

    MD5

    1b5c4ae7e385db4551ced8c19386abe0

    SHA1

    12d4bc9728c4f1deec1b9b8aacbfe71c3ceeb4d4

    SHA256

    8211fa61bdd647dc627a182c4e2a763024252dfd94d14f1f12c9c9b4df045d70

    SHA512

    f56d74aa9a3c150034866b12abf7ed233fcc2bd03d7f34bfdfd61cd054952189311669892e91dfcbf5000f509210d56d094abff99371e4897bf7943ef5a2764b

  • /data/user/0/com.dfoiej8.ccsdyia/files/one.dex
    Filesize

    59KB

    MD5

    1b5c4ae7e385db4551ced8c19386abe0

    SHA1

    12d4bc9728c4f1deec1b9b8aacbfe71c3ceeb4d4

    SHA256

    8211fa61bdd647dc627a182c4e2a763024252dfd94d14f1f12c9c9b4df045d70

    SHA512

    f56d74aa9a3c150034866b12abf7ed233fcc2bd03d7f34bfdfd61cd054952189311669892e91dfcbf5000f509210d56d094abff99371e4897bf7943ef5a2764b

  • /data/user/0/com.dfoiej8.ccsdyia/files/one.dex.x86.flock
    MD5

    d41d8cd98f00b204e9800998ecf8427e

    SHA1

    da39a3ee5e6b4b0d3255bfef95601890afd80709

    SHA256

    e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

    SHA512

    cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

  • /data/user/0/com.dfoiej8.ccsdyia/files/yypyda.apk
    Filesize

    38KB

    MD5

    cc860a00cae01d4f2e88cfcbf05f06ff

    SHA1

    87778550a32109a679a2d28dec9ca4e6c0ca19fc

    SHA256

    494a419030f286fb05789ded096c05326a44fe2ff6708a0ad2e2c862c5d8d347

    SHA512

    dbe68454e053ff4d494ebf60daa52b856f64b393d37f89a8f91a0239c4ae799f51621b5bb791a497d93ff7b2e8194acfccd82994399f20166596275ccbb10057

  • /data/user/0/com.dfoiej8.ccsdyia/files/yypyda.apk.x86.flock
    MD5

    d41d8cd98f00b204e9800998ecf8427e

    SHA1

    da39a3ee5e6b4b0d3255bfef95601890afd80709

    SHA256

    e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

    SHA512

    cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

  • /data/user/0/com.dfoiej8.ccsdyia/shared_prefs/WebViewChromiumPrefs.xml
    Filesize

    127B

    MD5

    21223e9184445fe043476484cd8cb1f9

    SHA1

    2b4813f849121d60ba35eb0889080668bb62c778

    SHA256

    bb61b7c087c2ae2de93a7740ff75707342940557146366e92b840284cd9446af

    SHA512

    be21408de0cc643650e5d9ab9057a8f9de88e37fbdc6417cfeba160402ec4cd14fccbc82cbbfd941ecfc0bb3d4056ee61ac199efdc99d647d53e65818835fd48

  • /data/user/0/com.dfoiej8.ccsdyia/shared_prefs/XinZF_conf.xml
    Filesize

    122B

    MD5

    76a516ec620e2508e512a673a58347a3

    SHA1

    386e9ee5d38602ebdca74bc24b24d75b1a765e8c

    SHA256

    245368df69958cb3da7feaea45e63731daf36a8954e5982bc36ed91eb439c6b5

    SHA512

    e4e96e50d4119fb2ba9d28b997b4991cf5e14ea7ea43c25304c3a40850a7744491f25e2ee0c7e500bc02e203669ff1cdee302f96534960bbcca3760ff8d192a8

  • /data/user/0/com.dfoiej8.ccsdyia/shared_prefs/XinZF_conf.xml
    Filesize

    170B

    MD5

    9b6e0b006aa112efb1be2037ecf5ef6f

    SHA1

    f32fa3abba5ad770e9a0fcfdb94c1212c54755e4

    SHA256

    2c736078c8293297e0af8b25698287a0e8d5454e353e69dd3e82122e3cf77fe4

    SHA512

    56f0d1f233ee345330c34b5e0574817dd076718eb88a738226b146314d0d046181e8a3895585b2c247929929fc8f0e1a7abd9cf8a0ca82b85a6b1f85b1859768

  • /data/user/0/com.dfoiej8.ccsdyia/shared_prefs/com.dfoiej8.ccsdyia_preferences.xml
    Filesize

    143B

    MD5

    b42e16f4ffbff69f849649ed930621e1

    SHA1

    c27935bf2bb8476b21a5fedc7e9818756d794d23

    SHA256

    2988ebd386a1fdf07b9c5c76101fbdcf751fe428f851e5cbc4d2e4129fa63fac

    SHA512

    2cabdeec8066da00ce01045967e93043a141c916d1f246a48d0220eb60ed0fa0ea2d6111d223db51f4dfbffb17b2dd383819ea11f3eba499ada85c80c0de9193

  • /data/user/0/com.dfoiej8.ccsdyia/shared_prefs/com.dfoiej8.ccsdyia_preferences.xml
    Filesize

    200B

    MD5

    142dd8e207b666a5478ed366744215b7

    SHA1

    37257562da78d0e12272ca52c5b4740ea83c6fd2

    SHA256

    7dc838da9972a9d380b06c5ee73a19a47497d8e7e03ee4d41b8f131e89ae0a09

    SHA512

    5818a272cdfefde961bfdbcb9911a6382bbcc11b43516500e27d8ac404f0db51cd1f77e0b72c528a70d1a4a85caafdc3e467e179f7c3347143a55a1cdce6d1f4

  • /data/user/0/com.dfoiej8.ccsdyia/shared_prefs/info.xml
    Filesize

    400B

    MD5

    095c029c3d0e76d0034b329981fb140d

    SHA1

    424fe9afb968d94e1c2f76f3ae13104a072ff3a9

    SHA256

    4840d87fc8e8159288a86972072ef1875c831eea61d3f65ec1c6ee62731ecb4a

    SHA512

    0f45644867afd3fa923ea1aa800c75cbf4c6e6945b1eee8c5a1fca0afeda6f8482298ea5d2365dde830e02bfbf686709915eaa2150d9a8bdd1327ad68f1cc523

  • /data/user/0/com.dfoiej8.ccsdyia/shared_prefs/umeng_common_config.xml
    Filesize

    112B

    MD5

    845c74019d6cb41e26ab0e16a36efb67

    SHA1

    fceca10171606bd72830eb680bb9df83cdeb8bfb

    SHA256

    0730d9a41c551a9e0f88175d339c10a7282d15be895198ee93b35e29641dfadd

    SHA512

    faf00bdda0d63cdaf158569c49a3babe015a411f301c7c85657388117b82b5a34dd4a6417e371e3fb1650e99bf4ef27c3f8dae8440f17093b827df9bd4123f57

  • /data/user/0/com.dfoiej8.ccsdyia/shared_prefs/umeng_common_config.xml
    Filesize

    172B

    MD5

    19b4cb69c6028418e0d8318393fbe097

    SHA1

    0b1d0367f40c2579c8e9b782cb6f0d0c5325aa42

    SHA256

    0865173ceedf93f7f2c6c5ed9e6b9ea48671228c35e7c592c350dfc6fa33ca0b

    SHA512

    9f3116c24233b0d221a2ae2bf122f0b485d42c893f7051ac989e452a30d6ed36b191d2c1e1b0b2986b3cb4fb44bdc153ec5eb1ebc9cb45950a6308d021dabdc4

  • /data/user/0/com.dfoiej8.ccsdyia/shared_prefs/umeng_common_config.xml
    Filesize

    237B

    MD5

    9f1626ff370587c8e005db408c30b106

    SHA1

    836fd783097a15eb4e190bd1f0ec0170240e8ca8

    SHA256

    afa2ac72e48bd348904649656a61d903935d297da484abc48e9c205d68453037

    SHA512

    0abfa701fa27cf37288c89c1285c901b056d1c2805e14599273896e68f86ad1b969531d4cb646e05b571429db8d1ebac504326af492a3c087b08102fec36002e

  • /data/user/0/com.dfoiej8.ccsdyia/shared_prefs/umeng_common_location.xml
    Filesize

    390B

    MD5

    5cb30012f95f87bd6064ef7e548d7f1f

    SHA1

    c2333a463250b2f529bcd65734b880b9daddd10a

    SHA256

    af7c46049a295e92289b78b889b1189f0b787f99e320b5bb64b7b38929718a95

    SHA512

    ce98c40606d8dce645d489099f187dadc8b49951f05ac43df33df6120e83ac9ea4caa78c6f3d55e5ed4bd2d770ba33e15edc5dec1a2b31fb23433d26fa33dde5