agent_smith | 3510bd80692f5e5a76f630a6474bb11df75fa6b98b438e9c99319699dc359a9c

Analysis

max time kernel
2936927s
max time network
132s
platform
android_x86
resource
android-x86-arm-20220823-en
resource tags

androidarch:armarch:x86image:android-x86-arm-20220823-enlocale:en-usos:android-9-x86system
submitted
25/11/2022, 08:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3510bd80692f5e5a76f630a6474bb11df75fa6b98b438e9c99319699dc359a9c.apk
Size

2.5MB
MD5

8601ad5b5fbbb2b0635215cecacd8bde
SHA1

e8d134b28538ec615fc71b0319b07a90d0019628
SHA256

3510bd80692f5e5a76f630a6474bb11df75fa6b98b438e9c99319699dc359a9c
SHA512

79250735290bf3ef81547ca20b80f3abca2868706c9ddf78ba896b46677ef2b986f4bd904045d1ff9eda67848685cb7be07d995449b6dd8470a357f13aa2b5ab
SSDEEP

49152:LASxVPa2K2YCNW7ym67cc6J51j4jfz5f6r+xHdRe3oeYUcunYzoI3cTRexHyUP5:LAL2YCW7ymA6J51gfzp6od7X3zjfZR

Score

10^/10

agent_smith adware ransomware

Malware Config

Signatures

Agent smith
Agent smith is a modular adware that installs malicious ADs into legitimate applications.
adware agent_smith

Requests cell location 1 IoCs

Uses Android APIs to to get current cell location.

description	ioc	Process
Framework service call	com.android.internal.telephony.ITelephony.getCellLocation	com.wrysdop.fghsdy

Reads information about phone network operator.

Uses Crypto APIs (Might try to encrypt user data). 1 IoCs

ransomware

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	com.wrysdop.fghsdy

com.wrysdop.fghsdy
1⤵
- Requests cell location
- Uses Crypto APIs (Might try to encrypt user data).
PID:4130

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

/data/user/0/com.wrysdop.fghsdy/app_jar/lpdf.jar

Filesize
35KB

MD5
e1ab911d4b585a26aae02d8540575013

SHA1
ac148f7bdf95edddc97d9224ff51a771f1070520

SHA256
8a71fab57b4a03f0b37095daa2eaa086ec6ed6c1c6166ca67c0e0a9e14cc85ca

SHA512
983ec12cde3cbfaffb414b8c8eb17c793bee558eb51b9d5e630f9bd5f312e0ce55622719aad6097a799286c25001212b26d7053e7e110a4918beace33d3bcbc4

Download Submit
/data/user/0/com.wrysdop.fghsdy/app_webview/Web Data

Filesize
104KB

MD5
dc79f9ce5f3ab5270b33e61119dfc959

SHA1
1844bf222a5144b513dcf2fb50a18c011701c647

SHA256
47e65f4de08deabfd52ecdb8b0a29c61c482188b92c36182e2112ca0a8f4ff65

SHA512
18b8894a7f35df516f423bbdebf1e05ce09eaf4345b139e59e603cadb81f8d1fa20f793438c28e8fd9a64e64f0684223d90ce6f10d3f93cb0c781049a8cff03e

Download Submit
/data/user/0/com.wrysdop.fghsdy/app_webview/Web Data-journal

Filesize
1KB

MD5
b69172b1f2a023e6a1c340cc6b9f8f40

SHA1
751f9c4191fb0b0215cd98b031000378a1000f41

SHA256
3758c1f70fa8e6d531e585f67a12546577f596039a91cd9135b391bdf72ec78f

SHA512
765470c2f9b417fae116d8a4e83868e28ed66d39f66c722c3a4131f3074c16cc555b4533e44a30c9e6046ae89779a71621296e49b4e5ba659f07e2586b8da9c7

Download Submit
/data/user/0/com.wrysdop.fghsdy/app_webview/metrics_guid

Filesize
36B

MD5
202e7026fbc45d49a556fc238b0f86ef

SHA1
0f2f884647136c7423b594aac2a7297b67dbf7f8

SHA256
fd912361fb3c6cddd6d4a908df6d13930912f201e17955cd6245ad1401d8a99b

SHA512
754405be4263e7904b8a7975ae94296b0c9534a32083bdaea970895dd617ccb92013dca7aa65282c91dd7559266a72ff4599b16468fca706db0b973a48f4e20e

Download Submit
/data/user/0/com.wrysdop.fghsdy/files/jiepayplugin.apk

Filesize
41KB

MD5
bbbf0678c3a75a8404e7826d9bece9bd

SHA1
f0d4d4e6fe4b41211d1854e50fad991f6ff506f0

SHA256
9eacd9c8f7c5836a6d9045d9dd1d51d6914b0060089e7e86d3c023e05f601a62

SHA512
3ef522f3d01b7768a5b22647fa40dcfee1ccdcc8c02245d1c86e8d2e1f15e546fc4052c4ab487ef6a1e68c6f70bae6535fe6a936e50f201cb9d7754030f66c25

Download Submit
/data/user/0/com.wrysdop.fghsdy/files/yypyda.apk

Filesize
38KB

MD5
cc860a00cae01d4f2e88cfcbf05f06ff

SHA1
87778550a32109a679a2d28dec9ca4e6c0ca19fc

SHA256
494a419030f286fb05789ded096c05326a44fe2ff6708a0ad2e2c862c5d8d347

SHA512
dbe68454e053ff4d494ebf60daa52b856f64b393d37f89a8f91a0239c4ae799f51621b5bb791a497d93ff7b2e8194acfccd82994399f20166596275ccbb10057

Download Submit
/data/user/0/com.wrysdop.fghsdy/shared_prefs/WebViewChromiumPrefs.xml

Filesize
127B

MD5
21223e9184445fe043476484cd8cb1f9

SHA1
2b4813f849121d60ba35eb0889080668bb62c778

SHA256
bb61b7c087c2ae2de93a7740ff75707342940557146366e92b840284cd9446af

SHA512
be21408de0cc643650e5d9ab9057a8f9de88e37fbdc6417cfeba160402ec4cd14fccbc82cbbfd941ecfc0bb3d4056ee61ac199efdc99d647d53e65818835fd48

Download Submit
/data/user/0/com.wrysdop.fghsdy/shared_prefs/umeng_common_config.xml

Filesize
111B

MD5
b5797240c1d39c7a38f108bba07928fe

SHA1
3035c6f34cfa164f5683cc1b9a72253ccba344c8

SHA256
eac2135000aaa93aae30442fc6fe70373a082a812fa9c06dc2c6aa54b275efb5

SHA512
d55431562190fcb45c7890743d51240b3ee3bb9f0783c6e9025478dc3a0a460e8a8e755a74f894dbd389892dcca52cf3f6435fac893b7b9463d6cbc74e2f6040

Download Submit
/data/user/0/com.wrysdop.fghsdy/shared_prefs/umeng_common_config.xml

Filesize
171B

MD5
4f6b95cbf53ff74776d14ee3ae4ebf37

SHA1
c3c241c5f3f655b7e650ec63e0ac9c130209771b

SHA256
1f2fee59c998ee2b56de64abcf836ff321c201d96d94d04a7227907a806d7de3

SHA512
6f5a6b34d72acf290acfa97611e14c46cedaf746508b59e796d865f050510f3e2fcdd1062513ed39d43e5eb3bdaac03ad54de9e51be5ddf4908b6f5c6553c439

Download Submit
/data/user/0/com.wrysdop.fghsdy/shared_prefs/umeng_common_config.xml

Filesize
236B

MD5
3f46e3c6dcd2fc1ebf4431dcc31cc602

SHA1
d2d5794ad1ba2521abeca7d0bb2cf9793018035f

SHA256
7a3e72eb5e3003e78e36ef00a11d0b5bbe83d82ed12809e861e249920af06780

SHA512
0b231ded5d5e07715853eadb6fe39093469de4c632eb03aed791c06eb153d08e7c6f62bdc46cf5fbc9b7eb1b6e6d356b51bfaf86de1efce0ac53a731f59ef456

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads