54cda5369660312d06d75b34cd4333457a4cc9b5239d615f45db54e2ed02f4e7

Analysis

max time kernel
2945649s
max time network
143s
platform
android_x64
resource
android-x64-arm64-20220823-en
resource tags

androidarch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20220823-enlocale:en-usos:android-11-x64system
submitted
25-11-2022 10:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

54cda5369660312d06d75b34cd4333457a4cc9b5239d615f45db54e2ed02f4e7.apk
Size

4.6MB
MD5

b45fa7f5250c25d999da645a498ac026
SHA1

85efc4e36a8c20e3216be0277e44407015578478
SHA256

54cda5369660312d06d75b34cd4333457a4cc9b5239d615f45db54e2ed02f4e7
SHA512

d96533a5c4053cbbf6b1b85da4fb0ad6ff851c672db8e3bb5a576201f7f51e58aa8bcbc51cb3b439634fb2d753b5986aac2f1759c990524c1c49dc3cc3d1fa84
SSDEEP

98304:xB/7jU4RFtmNMFK9UFZJOFtwC3xFfBLPvsUncTCPh+RHmEPH5mf:xBc4QNIwUFZJaDhF5js4cmyfhk

Score

8^/10

ransomware

Malware Config

Signatures

Requests cell location 1 IoCs
Uses Android APIs to to get current cell location.

Processes:

com.artsplanet.pesoclocklitefree

description ioc process

Framework service call com.android.internal.telephony.ITelephony.getCellLocation com.artsplanet.pesoclocklitefree

description	ioc	process
Framework service call	com.android.internal.telephony.ITelephony.getCellLocation	com.artsplanet.pesoclocklitefree

Loads dropped Dex/Jar 2 IoCs

Runs executable file dropped to the device during analysis.

Processes:

com.artsplanet.pesoclocklitefree

ioc	pid	process
/data/user/0/com.artsplanet.pesoclocklitefree/files/brews.hyt.wfer.jar	4536	com.artsplanet.pesoclocklitefree
/data/user/0/com.artsplanet.pesoclocklitefree/cache/1582435991586.jar	4536	com.artsplanet.pesoclocklitefree

Reads information about phone network operator.
Uses Crypto APIs (Might try to encrypt user data). 1 IoCs
ransomware

Processes:

com.artsplanet.pesoclocklitefree

description ioc process

Framework API call javax.crypto.Cipher.doFinal com.artsplanet.pesoclocklitefree

description	ioc	process
Framework API call	javax.crypto.Cipher.doFinal	com.artsplanet.pesoclocklitefree

com.artsplanet.pesoclocklitefree
1⤵
- Requests cell location
- Loads dropped Dex/Jar
- Uses Crypto APIs (Might try to encrypt user data).
PID:4536

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

/data/user/0/com.artsplanet.pesoclocklitefree/app_webview/.com.google.Chrome.UVxIAw

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/com.artsplanet.pesoclocklitefree/app_webview/Default/Cookies

Filesize
64KB

MD5
dfb2098ca7b3bf16d6f5f1e7d3839af5

SHA1
ebb7a8bc886062d77a4092bd306b77a0ce7a3e9d

SHA256
e4119d32577d7fc63b267cc23eb7a9bbfb12d238f23e08918c38838fe0181224

SHA512
fccec45399258eb98220b7f01b492a72b8b3d1254dec6e196e344d89a0376c6ee24534a31a6675c866d4a17256d3ac6823657eaf04e1d386757d0cbfc6597e50

Download Submit
/data/user/0/com.artsplanet.pesoclocklitefree/app_webview/Default/Cookies-journal

Filesize
1KB

MD5
db9451268183ef5b44931770b7d280fa

SHA1
5e09fbe8721d02c7167b66fdf0a9296668162c57

SHA256
e2b07381e9156cfea50f7cae45b3963c2aa4dd30a7a33ef3f743902b60395cb1

SHA512
f26ee9ad2ead1b2a35615f6f8e356159a30cc11959841e941370859927677e12d4ed820a679cd4ef55f87dd3bf78db25b8281c7d57686cd54e220f8a55764c2c

Download Submit
/data/user/0/com.artsplanet.pesoclocklitefree/app_webview/Default/GPUCache/index

Filesize
48B

MD5
6d7d499960179766cd4261d12dacc411

SHA1
e6f8553b0015e12b23cc551afe98763f3b1c9bed

SHA256
c96ac03cfdbc6f4c1bdcdf764f1a6573f852e7aae5ef405969516b93ed271182

SHA512
6526c668477a01a850b8757b77dd3e7be27ad1991f5cf777685efcb03a21f31b71f6eae00f326931599baae4b16360e33e3d0f2894f1b2c1753391df02a14547

Download Submit
/data/user/0/com.artsplanet.pesoclocklitefree/app_webview/Default/GPUCache/index-dir/temp-index

Filesize
96B

MD5
84333fb566d8ce351b3b61dfd80ea83f

SHA1
fc49a2762ee41a28671d6a1675b9eb7739d8a6d5

SHA256
bb6105f45d19f2c5e227e65c8497645fe0e4eb9eed4f96a3f7750906ab6292bc

SHA512
a4d83146c0a04c752af292fd8336fe7fb81e1baef23148c1541325556df4ebf29104d1e7d8a9f45315dcea6084affe45aab1dcc2f30376e4a54f82027807630b

Download Submit
/data/user/0/com.artsplanet.pesoclocklitefree/app_webview/Default/Session Storage/000001.dbtmp

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
/data/user/0/com.artsplanet.pesoclocklitefree/app_webview/Default/Session Storage/000003.log

Filesize
61B

MD5
9f7eadc15e13d0608b4e4d590499ae2e

SHA1
afb27f5c20b117031328e12dd3111a7681ff8db5

SHA256
5c3a5b578ab9fe853ead7040bc161929ea4f6902073ba2b8bb84487622b98923

SHA512
88455784c705f565c70fa0a549c54e2492976e14643e9dd0a8e58c560d003914313df483f096bd33ec718aeec7667b8de063a73627aa3436ba6e7e562e565b3f

Download Submit
/data/user/0/com.artsplanet.pesoclocklitefree/app_webview/Default/Session Storage/LOCK

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/com.artsplanet.pesoclocklitefree/app_webview/Default/Session Storage/LOG

Filesize
144B

MD5
ca2f3e3f754af355bbea4b1f0a5e9d46

SHA1
cf195e2743ef630fa72c625fdde00d9d584b9212

SHA256
6bb322aabd89d1016a106a629887e6124018841b58cf17dc7d60e2ffa1db87a6

SHA512
99f2134496df959fa0ecf269aa1bb45a4605fd503f81309c8ab700e219012d3e2a4774b5f8870ecad5cf9dfa6bad809fbf82b9b84b2ce68dd8fe4f7fb794be5a

Download Submit
/data/user/0/com.artsplanet.pesoclocklitefree/app_webview/Default/Session Storage/MANIFEST-000001

Filesize
41B

MD5
5af87dfd673ba2115e2fcf5cfdb727ab

SHA1
d5b5bbf396dc291274584ef71f444f420b6056f1

SHA256
f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

SHA512
de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

Download Submit
/data/user/0/com.artsplanet.pesoclocklitefree/app_webview/Default/Web Data

Filesize
120KB

MD5
a48cd9324b1f8754b07f00d863b840f3

SHA1
11c6614775b35a58f440971dfc87c8aaac6d6173

SHA256
8859a216183793485d4699bf69d7ed96904679834188d07b9a70424d47eb1420

SHA512
35fa712f0af4a5eeed7e00e4e59ed5027dc6609d268462fe79d92043be9ae0c5961ce9e1d2f64b1a196c9b6aa6242b8b83817b3ee4c1058596c58a99c45478b1

Download Submit
/data/user/0/com.artsplanet.pesoclocklitefree/app_webview/Default/Web Data-journal

Filesize
2KB

MD5
fedd8ac8d4c3081c85b8f6279d10330b

SHA1
60ff58450e58fa94327c17ad67f9a3b584b9eb57

SHA256
03056d11e06d57ebe843712638723dfd045136a5b606dd6b7355daec086049af

SHA512
2d0a5c4cdcb9135252b47f5e0944c6f873178eeb867da773b6e5cf082612a7aa1ef333fe0d5c74334acee2891b3887a5e19554b5c18f4d2479167afcf5a9bf9b

Download Submit
/data/user/0/com.artsplanet.pesoclocklitefree/app_webview/variations_seed_new

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/com.artsplanet.pesoclocklitefree/app_webview/variations_stamp

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/com.artsplanet.pesoclocklitefree/app_webview/webview_data.lock

Filesize
38B

MD5
e00a96469ecf1bbf82e483ca8ffac527

SHA1
ca9c1ebd55dc56b4be25a58b755d2383f9760e47

SHA256
b308b4bbaa2f37d1a767c9855771379a8ff039f6f9578a72ae10a8604bd719dc

SHA512
46136180c480bf58204711837ef0e781f300df5ef863157310636c0ea8c9eef4efac4e8be8062d1cfd72aebd3c5a28b0c84541779f1075895e5361e069cbefe6

Download Submit
/data/user/0/com.artsplanet.pesoclocklitefree/cache/1582435991586.jar

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/com.artsplanet.pesoclocklitefree/cache/1582435991586.jar

Filesize
20KB

MD5
fde2ee00cbd121cfab5290b078aa3ceb

SHA1
e2b77d5320e155e413d040a8c20020962065b2f8

SHA256
2897b0812077c654a9b3fbb0b6303d5cde681eeba7ad9981de65716c7810d685

SHA512
a9326aff8e454a2b4ac09984ef2a65fddd4dc146b4c44d839035549bff8c9fdaae490326d0b018f76c1ca2e4fb25426d74f550ca0950982fba632a023af99a56

Download Submit
/data/user/0/com.artsplanet.pesoclocklitefree/cache/WebView/Crashpad/settings.dat

Filesize
40B

MD5
0987a3df8ca94b83eed22830f5c69973

SHA1
5ffe97662fa3a164060c05e1c815b8f9c3005370

SHA256
748b084914bc632be161f552c344f8f5b595f8613b8b7606de0acbbde7fe2d5c

SHA512
20026330a444c2649b26ef3bfa77362d5dac9460ec3510d703d9c35eda7a9287d99ced76872d3df9bae3d9aae14fa673c5e64e341cfb6190a925730549e9ca99

Download Submit
/data/user/0/com.artsplanet.pesoclocklitefree/cache/WebView/Default/HTTP Cache/Code Cache/js/index

Filesize
48B

MD5
6d7d499960179766cd4261d12dacc411

SHA1
e6f8553b0015e12b23cc551afe98763f3b1c9bed

SHA256
c96ac03cfdbc6f4c1bdcdf764f1a6573f852e7aae5ef405969516b93ed271182

SHA512
6526c668477a01a850b8757b77dd3e7be27ad1991f5cf777685efcb03a21f31b71f6eae00f326931599baae4b16360e33e3d0f2894f1b2c1753391df02a14547

Download Submit
/data/user/0/com.artsplanet.pesoclocklitefree/cache/WebView/Default/HTTP Cache/Code Cache/js/index-dir/temp-index

Filesize
96B

MD5
f427490a9cef4f359323c98752b31f4a

SHA1
ba6c4fed55a7d57264f084e005a40399b790a2ac

SHA256
2b120e8fcab7e506f637abf07a2ef4993e56a53e3281701370346fbfe524929c

SHA512
46c40db5de773e692f1032cc07f19c872d94afe2f219e09a8b577a5ba0e2bedef3d19863327e009b7dcb4eae31f5ce89cf415b2838292b83da5cb6d592fbeac2

Download Submit
/data/user/0/com.artsplanet.pesoclocklitefree/cache/WebView/Default/HTTP Cache/Code Cache/wasm/index

Filesize
48B

MD5
6d7d499960179766cd4261d12dacc411

SHA1
e6f8553b0015e12b23cc551afe98763f3b1c9bed

SHA256
c96ac03cfdbc6f4c1bdcdf764f1a6573f852e7aae5ef405969516b93ed271182

SHA512
6526c668477a01a850b8757b77dd3e7be27ad1991f5cf777685efcb03a21f31b71f6eae00f326931599baae4b16360e33e3d0f2894f1b2c1753391df02a14547

Download Submit
/data/user/0/com.artsplanet.pesoclocklitefree/cache/WebView/Default/HTTP Cache/Code Cache/wasm/index-dir/temp-index

Filesize
96B

MD5
e51550280aa89e041e130747a09ca3a0

SHA1
cbe57b6c39bb74916b89247a85d2ab200b175e9b

SHA256
421a3b224ab5a5cc5debb13d4fc8e4309b9228e2f3699fcb6f91e21a65f95cad

SHA512
a00ddad01383c8148d149ff16ef2dc0b911b58b6eeff1230dd632e89e40ebe9feb90d551c761e045342bd120e57cbbcc8700778313417c2b4e453dc05145853b

Download Submit
/data/user/0/com.artsplanet.pesoclocklitefree/cache/WebView/Default/HTTP Cache/f038e94cb33282ab_0

Filesize
400B

MD5
a62b20c6608b3694260e345c1d80b467

SHA1
ea6bec313d9a059a7f4e1e72bf8cfbae621846d8

SHA256
6da95ae1acbfb719cf6466b2e0cbf3379ce393df0f2f7061acfd4048ccd3a929

SHA512
f68c3bfae54b8f75d56a63cd823e99ce8c6472db38a5120508540b4ecd1a724f29156f93dca5a61939408c74312689c0fc58084d2e2240e584c87d5a3a4bdd8b

Download Submit
/data/user/0/com.artsplanet.pesoclocklitefree/cache/WebView/Default/HTTP Cache/index

Filesize
48B

MD5
6d7d499960179766cd4261d12dacc411

SHA1
e6f8553b0015e12b23cc551afe98763f3b1c9bed

SHA256
c96ac03cfdbc6f4c1bdcdf764f1a6573f852e7aae5ef405969516b93ed271182

SHA512
6526c668477a01a850b8757b77dd3e7be27ad1991f5cf777685efcb03a21f31b71f6eae00f326931599baae4b16360e33e3d0f2894f1b2c1753391df02a14547

Download Submit
/data/user/0/com.artsplanet.pesoclocklitefree/cache/WebView/Default/HTTP Cache/index-dir/temp-index

Filesize
144B

MD5
81c6a35848aaaa75aa7094bf83a9b110

SHA1
ae57cfe5976b4289ec57e3d2d4be4d7c5cd35b25

SHA256
f9d71cc9530e1de1a625b6d4ab05d2b83d9c568208d9290f540cf944987ee611

SHA512
3259747987a6b49abd6e223b5c7242a94c81e48735ae119929f95a7357fcb5745f96d4337bc81be94caeed36a1126e429c4ca56cd798abfaab08f988516052e3

Download Submit
/data/user/0/com.artsplanet.pesoclocklitefree/cache/WebView/Default/HTTP Cache/index-dir/temp-index

Filesize
96B

MD5
fe4836a14c9df9fe49f25eeb6cb777b1

SHA1
06b2c6bf5fd144459188a075c7945364db2c7974

SHA256
4bb86335cd75330a2404825e6ab4e2d3c150e879167e8f861d918111d90c081c

SHA512
4c244959f53aceb697612260be2dd31c174f8d87d4389debd69bb6be0e5a348a60d8c687ebb7a39e8c609195be48c6ea8842f68b024762a9ad5b16294c00653b

Download Submit
/data/user/0/com.artsplanet.pesoclocklitefree/cache/WebView/font_unique_name_table.pb

Filesize
57KB

MD5
f080fa2a56ab5479d58063e5ea871447

SHA1
4b3fd57a98916fa5784305b76ba30af26b5253d9

SHA256
0aa374bc456330fd1b5daf18d25b4bb8e2df1998dfa85466f2c31843ff56e815

SHA512
8aee3186a95b389d39882620b7c4199a29aa50580aa98a381b2931a934de6406943c89d4d00ebeabff21e2b03b4a4adcc01e37e32a2335c4838be24bdbf61936

Download Submit
/data/user/0/com.artsplanet.pesoclocklitefree/cache/oat/1582435991586.jar.cur.prof

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/com.artsplanet.pesoclocklitefree/files/brews.hyt.wfer.jar

Filesize
216KB

MD5
e2fd482b4554db4051460458529fb09e

SHA1
6a1163ab52e5dc9dcfee7fac7e283089dc1616e7

SHA256
252654ac814c2e618a14c33e0fe23bfb06c89ab99534f78bcf895a534fba9272

SHA512
8aeb2a2f223a5a0e3a195fc0f9ebe399f5b3d83866e78283230daacbbff86e244da500ddbc14c2726f9e8fcd5f74b1cd2b928132537dcce51a745f70c7844afb

Download Submit
/data/user/0/com.artsplanet.pesoclocklitefree/files/brews.hyt.wfer.jar

Filesize
421KB

MD5
82dd84333c519cf97806339a5f05b1ac

SHA1
d85c4cdc8b73526dc860b5e6df4a2125bfa77fe3

SHA256
768b9a242306b1560837b3a0ef1a93773617fcc80d4b9333306d4be5bad9a8a2

SHA512
87b3286157bea723384720fcb4f06d9f47a2fdc3eae76c5fa68877c44de9927f0be1c9ff80bb273805f1b34f936f02d3869c1e977a6d2718646527ec1579f900

Download Submit
/data/user/0/com.artsplanet.pesoclocklitefree/files/gaClientId

Filesize
36B

MD5
6a6d10d81ea61b11b886f05fa2a7ed02

SHA1
9c37511672a1ff1a9baeae2f46233fb165105f65

SHA256
84749df30921576b7517a6e94999aa7250812c5ff485b8f75c13bacf5b8e89c9

SHA512
18afee72084febe840198b4f0330c3074fe15508ecb92389656beef01ce6f2dad5483c7204b8dad6f3ed074c985e0ad848c91577eb6c7c7a7c0e1949f6067647

Download Submit
/data/user/0/com.artsplanet.pesoclocklitefree/files/oat/brews.hyt.wfer.jar.cur.prof

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/com.artsplanet.pesoclocklitefree/shared_prefs/WebViewChromiumPrefs.xml

Filesize
127B

MD5
97ccd9a2b2063143df56b6937f961ca4

SHA1
5e78a91ae5df289ce83443cb7d5589dd3504fb5d

SHA256
248ff7928128015b1cfe3e6517c8f9b8c9511bfb8c8baf44fc1370640eac61fd

SHA512
86c05a5bb3d7eedea390664796966e9e5a5bf846c85808da54407788a76b3ee25b91428242a1e76d8765bfe51e1ba3636617fbab6e7dbb39fcc433e07c3fcd3b

Download Submit
/data/user/0/com.artsplanet.pesoclocklitefree/shared_prefs/admob.xml

Filesize
133B

MD5
3560e2ae2c5c074972ae7891ec66686e

SHA1
e31dd6ee9dc3e50f5e91f0447007e62e2f672afe

SHA256
7d19709ed89f6621cbacbead7fbb2c86470c2b5bff6823220d6d735a469877bd

SHA512
1449678211700523e0484626f3949948693467d55d90cc42a6a53a5f763167ff65fcb5377b7c9a2a820c9ce4b9d6f2084734fe16a3e07c023cd281227c9166a8

Download Submit