Analysis
-
max time kernel
2936450s -
max time network
157s -
platform
android_x86 -
resource
android-x86-arm-20220823-en -
resource tags
androidarch:armarch:x86image:android-x86-arm-20220823-enlocale:en-usos:android-9-x86system -
submitted
25-11-2022 08:41
Static task
static1
Behavioral task
behavioral1
Sample
6015bfc8ecc94eb7a999f7880557de943d80518fd6f2f18ae091b5a82aded4d0.apk
Resource
android-x86-arm-20220823-en
General
-
Target
6015bfc8ecc94eb7a999f7880557de943d80518fd6f2f18ae091b5a82aded4d0.apk
-
Size
2.5MB
-
MD5
a94a4f9b67e34aad85507113dadf9729
-
SHA1
b98b20495452bb19e0f502642f96888b0b290b0d
-
SHA256
6015bfc8ecc94eb7a999f7880557de943d80518fd6f2f18ae091b5a82aded4d0
-
SHA512
abedf8c6858feb2e3d40f4127971d91127146b332f460ef36161aedd6def04470b64c972f0cd5169a25bc98120d5dd0cbfae4abfd23a06645aabee71d5a004b4
-
SSDEEP
49152:JASxVPa2KAPsU2a47NNpOv4uCRjl9s81csncj0HGmQFe3oeYUcunYzom3cTRexHl:JALmsla4FOvtgp9s81Pcj0HXQnX3z7fF
Malware Config
Signatures
-
Agent smith
Agent smith is a modular adware that installs malicious ADs into legitimate applications.
-
Requests cell location 1 IoCs
Uses Android APIs to to get current cell location.
Processes:
com.dfoiej8.ccsdyiadescription ioc process Framework service call com.android.internal.telephony.ITelephony.getCellLocation com.dfoiej8.ccsdyia -
Loads dropped Dex/Jar 2 IoCs
Runs executable file dropped to the device during analysis.
Processes:
com.dfoiej8.ccsdyia/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.dfoiej8.ccsdyia/files/one.dex --output-vdex-fd=123 --oat-fd=126 --oat-location=/data/user/0/com.dfoiej8.ccsdyia/files/oat/x86/one.odex --compiler-filter=quicken --class-loader-context=&ioc pid process /data/user/0/com.dfoiej8.ccsdyia/files/one.dex 4083 com.dfoiej8.ccsdyia /data/user/0/com.dfoiej8.ccsdyia/files/one.dex 4315 /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.dfoiej8.ccsdyia/files/one.dex --output-vdex-fd=123 --oat-fd=126 --oat-location=/data/user/0/com.dfoiej8.ccsdyia/files/oat/x86/one.odex --compiler-filter=quicken --class-loader-context=& -
Requests dangerous framework permissions 8 IoCs
Processes:
description ioc Allows an application to send SMS messages. android.permission.SEND_SMS Allows read only access to phone state, including the current cellular network information, the status of any ongoing calls, and a list of any PhoneAccounts registered on the device. android.permission.READ_PHONE_STATE Allows an application to write to external storage. android.permission.WRITE_EXTERNAL_STORAGE Allows an application to read SMS messages. android.permission.READ_SMS Allows an app to access approximate location. android.permission.ACCESS_COARSE_LOCATION Allows an app to access precise location. android.permission.ACCESS_FINE_LOCATION Allows an application to read from external storage. android.permission.READ_EXTERNAL_STORAGE Allows an application to receive SMS messages. android.permission.RECEIVE_SMS -
Reads information about phone network operator.
-
Uses Crypto APIs (Might try to encrypt user data). 1 IoCs
Processes:
com.dfoiej8.ccsdyiadescription ioc process Framework API call javax.crypto.Cipher.doFinal com.dfoiej8.ccsdyia
Processes
-
com.dfoiej8.ccsdyia1⤵
- Requests cell location
- Loads dropped Dex/Jar
- Uses Crypto APIs (Might try to encrypt user data).
-
/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.dfoiej8.ccsdyia/files/one.dex --output-vdex-fd=123 --oat-fd=126 --oat-location=/data/user/0/com.dfoiej8.ccsdyia/files/oat/x86/one.odex --compiler-filter=quicken --class-loader-context=&1⤵
- Loads dropped Dex/Jar
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
/data/user/0/com.dfoiej8.ccsdyia/app_jar/lpdf.jarFilesize
35KB
MD5e1ab911d4b585a26aae02d8540575013
SHA1ac148f7bdf95edddc97d9224ff51a771f1070520
SHA2568a71fab57b4a03f0b37095daa2eaa086ec6ed6c1c6166ca67c0e0a9e14cc85ca
SHA512983ec12cde3cbfaffb414b8c8eb17c793bee558eb51b9d5e630f9bd5f312e0ce55622719aad6097a799286c25001212b26d7053e7e110a4918beace33d3bcbc4
-
/data/user/0/com.dfoiej8.ccsdyia/app_jar/lpdf.jar.x86.flockMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
/data/user/0/com.dfoiej8.ccsdyia/app_jar/oat/x86/lpdf.odexMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
/data/user/0/com.dfoiej8.ccsdyia/app_jar/oat/x86/lpdf.vdexMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
/data/user/0/com.dfoiej8.ccsdyia/app_webview/Web DataFilesize
104KB
MD5dc79f9ce5f3ab5270b33e61119dfc959
SHA11844bf222a5144b513dcf2fb50a18c011701c647
SHA25647e65f4de08deabfd52ecdb8b0a29c61c482188b92c36182e2112ca0a8f4ff65
SHA51218b8894a7f35df516f423bbdebf1e05ce09eaf4345b139e59e603cadb81f8d1fa20f793438c28e8fd9a64e64f0684223d90ce6f10d3f93cb0c781049a8cff03e
-
/data/user/0/com.dfoiej8.ccsdyia/app_webview/Web Data-journalFilesize
1KB
MD5105842ea3c969c2c921afd195f5f51e0
SHA1265661f27bb7b0c24edc46203a1a5c325a0b6ea1
SHA25644f1897082a46e65d19705d4e528a01dd77d1bcd0d0a1874d743d62716248b4f
SHA5127a72e1c45d4a55648e157d254d803b11011791b86eccfc90aa8b25e20d5b73db9e6aa88c923d282df05a493c7b3b5410455a94dd8fb6003da2b97912fe5c9d38
-
/data/user/0/com.dfoiej8.ccsdyia/app_webview/metrics_guidMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
/data/user/0/com.dfoiej8.ccsdyia/app_webview/metrics_guidFilesize
36B
MD5afbcaf9c4db66bc9645e172a394115bc
SHA1d6f9e28b9f928b3b2a21158613dcc654bbc6b96b
SHA256d92be75422781323d123adbd5c178b75fc5ed0385b426cc995d61fb5919f965c
SHA512ac689c7cf48c6b4fc195043e9f6794a3ab98560b87b8a6f6076f109e1a17fe129b21502933d0497a46ca36b87ad264eeae845831695df9d16d6b4a0742b136da
-
/data/user/0/com.dfoiej8.ccsdyia/app_webview/variations_seed_newMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
/data/user/0/com.dfoiej8.ccsdyia/app_webview/variations_stampMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
/data/user/0/com.dfoiej8.ccsdyia/app_webview/webview_data.lockMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
/data/user/0/com.dfoiej8.ccsdyia/files/jiepayplugin.apkFilesize
45KB
MD5c83e81f064fbbff6870210fcc9abcf6c
SHA165f94be4a62160065ff192b9baac02da3a293031
SHA256fc37a898193dd0b37c226a5841936c88bc51a02bf99abe3f17ab84951a3aa1c9
SHA512100c617de8aadb73da780a8e16eccde545b9717bc0e77823efbc1d9831f13a2592a1a14d9e68ba49a364cf2a8029f6fee42d7268925da7f0112c18a5e9412164
-
/data/user/0/com.dfoiej8.ccsdyia/files/jiepayplugin.apk.x86.flockMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
/data/user/0/com.dfoiej8.ccsdyia/files/oat/x86/one.odexMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
/data/user/0/com.dfoiej8.ccsdyia/files/oat/x86/one.vdexMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
/data/user/0/com.dfoiej8.ccsdyia/files/oat/x86/yypyda.odexMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
/data/user/0/com.dfoiej8.ccsdyia/files/oat/x86/yypyda.vdexMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
/data/user/0/com.dfoiej8.ccsdyia/files/one.dexFilesize
59KB
MD51b5c4ae7e385db4551ced8c19386abe0
SHA112d4bc9728c4f1deec1b9b8aacbfe71c3ceeb4d4
SHA2568211fa61bdd647dc627a182c4e2a763024252dfd94d14f1f12c9c9b4df045d70
SHA512f56d74aa9a3c150034866b12abf7ed233fcc2bd03d7f34bfdfd61cd054952189311669892e91dfcbf5000f509210d56d094abff99371e4897bf7943ef5a2764b
-
/data/user/0/com.dfoiej8.ccsdyia/files/one.dexFilesize
59KB
MD51b5c4ae7e385db4551ced8c19386abe0
SHA112d4bc9728c4f1deec1b9b8aacbfe71c3ceeb4d4
SHA2568211fa61bdd647dc627a182c4e2a763024252dfd94d14f1f12c9c9b4df045d70
SHA512f56d74aa9a3c150034866b12abf7ed233fcc2bd03d7f34bfdfd61cd054952189311669892e91dfcbf5000f509210d56d094abff99371e4897bf7943ef5a2764b
-
/data/user/0/com.dfoiej8.ccsdyia/files/one.dexFilesize
59KB
MD51b5c4ae7e385db4551ced8c19386abe0
SHA112d4bc9728c4f1deec1b9b8aacbfe71c3ceeb4d4
SHA2568211fa61bdd647dc627a182c4e2a763024252dfd94d14f1f12c9c9b4df045d70
SHA512f56d74aa9a3c150034866b12abf7ed233fcc2bd03d7f34bfdfd61cd054952189311669892e91dfcbf5000f509210d56d094abff99371e4897bf7943ef5a2764b
-
/data/user/0/com.dfoiej8.ccsdyia/files/one.dex.x86.flockMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
/data/user/0/com.dfoiej8.ccsdyia/files/yypyda.apkFilesize
38KB
MD5cc860a00cae01d4f2e88cfcbf05f06ff
SHA187778550a32109a679a2d28dec9ca4e6c0ca19fc
SHA256494a419030f286fb05789ded096c05326a44fe2ff6708a0ad2e2c862c5d8d347
SHA512dbe68454e053ff4d494ebf60daa52b856f64b393d37f89a8f91a0239c4ae799f51621b5bb791a497d93ff7b2e8194acfccd82994399f20166596275ccbb10057
-
/data/user/0/com.dfoiej8.ccsdyia/files/yypyda.apk.x86.flockMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
/data/user/0/com.dfoiej8.ccsdyia/shared_prefs/WebViewChromiumPrefs.xmlFilesize
127B
MD521223e9184445fe043476484cd8cb1f9
SHA12b4813f849121d60ba35eb0889080668bb62c778
SHA256bb61b7c087c2ae2de93a7740ff75707342940557146366e92b840284cd9446af
SHA512be21408de0cc643650e5d9ab9057a8f9de88e37fbdc6417cfeba160402ec4cd14fccbc82cbbfd941ecfc0bb3d4056ee61ac199efdc99d647d53e65818835fd48
-
/data/user/0/com.dfoiej8.ccsdyia/shared_prefs/XinZF_conf.xmlFilesize
122B
MD576a516ec620e2508e512a673a58347a3
SHA1386e9ee5d38602ebdca74bc24b24d75b1a765e8c
SHA256245368df69958cb3da7feaea45e63731daf36a8954e5982bc36ed91eb439c6b5
SHA512e4e96e50d4119fb2ba9d28b997b4991cf5e14ea7ea43c25304c3a40850a7744491f25e2ee0c7e500bc02e203669ff1cdee302f96534960bbcca3760ff8d192a8
-
/data/user/0/com.dfoiej8.ccsdyia/shared_prefs/XinZF_conf.xmlFilesize
170B
MD59b6e0b006aa112efb1be2037ecf5ef6f
SHA1f32fa3abba5ad770e9a0fcfdb94c1212c54755e4
SHA2562c736078c8293297e0af8b25698287a0e8d5454e353e69dd3e82122e3cf77fe4
SHA51256f0d1f233ee345330c34b5e0574817dd076718eb88a738226b146314d0d046181e8a3895585b2c247929929fc8f0e1a7abd9cf8a0ca82b85a6b1f85b1859768
-
/data/user/0/com.dfoiej8.ccsdyia/shared_prefs/com.dfoiej8.ccsdyia_preferences.xmlFilesize
143B
MD5b42e16f4ffbff69f849649ed930621e1
SHA1c27935bf2bb8476b21a5fedc7e9818756d794d23
SHA2562988ebd386a1fdf07b9c5c76101fbdcf751fe428f851e5cbc4d2e4129fa63fac
SHA5122cabdeec8066da00ce01045967e93043a141c916d1f246a48d0220eb60ed0fa0ea2d6111d223db51f4dfbffb17b2dd383819ea11f3eba499ada85c80c0de9193
-
/data/user/0/com.dfoiej8.ccsdyia/shared_prefs/com.dfoiej8.ccsdyia_preferences.xmlFilesize
200B
MD5142dd8e207b666a5478ed366744215b7
SHA137257562da78d0e12272ca52c5b4740ea83c6fd2
SHA2567dc838da9972a9d380b06c5ee73a19a47497d8e7e03ee4d41b8f131e89ae0a09
SHA5125818a272cdfefde961bfdbcb9911a6382bbcc11b43516500e27d8ac404f0db51cd1f77e0b72c528a70d1a4a85caafdc3e467e179f7c3347143a55a1cdce6d1f4
-
/data/user/0/com.dfoiej8.ccsdyia/shared_prefs/info.xmlFilesize
400B
MD5095c029c3d0e76d0034b329981fb140d
SHA1424fe9afb968d94e1c2f76f3ae13104a072ff3a9
SHA2564840d87fc8e8159288a86972072ef1875c831eea61d3f65ec1c6ee62731ecb4a
SHA5120f45644867afd3fa923ea1aa800c75cbf4c6e6945b1eee8c5a1fca0afeda6f8482298ea5d2365dde830e02bfbf686709915eaa2150d9a8bdd1327ad68f1cc523
-
/data/user/0/com.dfoiej8.ccsdyia/shared_prefs/umeng_common_config.xmlFilesize
112B
MD5845c74019d6cb41e26ab0e16a36efb67
SHA1fceca10171606bd72830eb680bb9df83cdeb8bfb
SHA2560730d9a41c551a9e0f88175d339c10a7282d15be895198ee93b35e29641dfadd
SHA512faf00bdda0d63cdaf158569c49a3babe015a411f301c7c85657388117b82b5a34dd4a6417e371e3fb1650e99bf4ef27c3f8dae8440f17093b827df9bd4123f57
-
/data/user/0/com.dfoiej8.ccsdyia/shared_prefs/umeng_common_config.xmlFilesize
172B
MD519b4cb69c6028418e0d8318393fbe097
SHA10b1d0367f40c2579c8e9b782cb6f0d0c5325aa42
SHA2560865173ceedf93f7f2c6c5ed9e6b9ea48671228c35e7c592c350dfc6fa33ca0b
SHA5129f3116c24233b0d221a2ae2bf122f0b485d42c893f7051ac989e452a30d6ed36b191d2c1e1b0b2986b3cb4fb44bdc153ec5eb1ebc9cb45950a6308d021dabdc4
-
/data/user/0/com.dfoiej8.ccsdyia/shared_prefs/umeng_common_config.xmlFilesize
237B
MD59f1626ff370587c8e005db408c30b106
SHA1836fd783097a15eb4e190bd1f0ec0170240e8ca8
SHA256afa2ac72e48bd348904649656a61d903935d297da484abc48e9c205d68453037
SHA5120abfa701fa27cf37288c89c1285c901b056d1c2805e14599273896e68f86ad1b969531d4cb646e05b571429db8d1ebac504326af492a3c087b08102fec36002e
-
/data/user/0/com.dfoiej8.ccsdyia/shared_prefs/umeng_common_location.xmlFilesize
390B
MD55cb30012f95f87bd6064ef7e548d7f1f
SHA1c2333a463250b2f529bcd65734b880b9daddd10a
SHA256af7c46049a295e92289b78b889b1189f0b787f99e320b5bb64b7b38929718a95
SHA512ce98c40606d8dce645d489099f187dadc8b49951f05ac43df33df6120e83ac9ea4caa78c6f3d55e5ed4bd2d770ba33e15edc5dec1a2b31fb23433d26fa33dde5