961fea50ceaf316835443a790b4c2f4343e1f367b8b63bb76bc0f836f0578c68

Analysis

max time kernel
2979415s
max time network
160s
platform
android_x64
resource
android-x64-arm64-20220823-en
resource tags

androidarch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20220823-enlocale:en-usos:android-11-x64system
submitted
25-11-2022 17:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

961fea50ceaf316835443a790b4c2f4343e1f367b8b63bb76bc0f836f0578c68.apk
Size

1020KB
MD5

149f1471d656dbacaa5c12a94e019aba
SHA1

65fef10898d185d575614ac3b113084313c2741b
SHA256

961fea50ceaf316835443a790b4c2f4343e1f367b8b63bb76bc0f836f0578c68
SHA512

40170f87a60d19ebcee3003182641eb745c2666a5af9568f76e3b260fd44bad7ffbcb2648fb4e74a215db80bb4581bc8d603f1e0929a634c0afb5a17e0d49acb
SSDEEP

24576:zihxviAr0xB1F70fI+26V1yLlvR1DlHoHoh:zcJHr6+rzyhvzlIs

Score

8^/10

banker ransomware

Malware Config

Signatures

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps). 1 IoCs
banker

Processes:

cn.yidonghui

description ioc process

Framework service call android.content.pm.IPackageManager.getInstalledApplications cn.yidonghui
Uses Crypto APIs (Might try to encrypt user data). 1 IoCs
ransomware

Processes:

cn.yidonghui

description ioc process

Framework API call javax.crypto.Cipher.doFinal cn.yidonghui

description	ioc	process
Framework service call	android.content.pm.IPackageManager.getInstalledApplications	cn.yidonghui

description	ioc	process
Framework API call	javax.crypto.Cipher.doFinal	cn.yidonghui

cn.yidonghui
1⤵
- Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps).
- Uses Crypto APIs (Might try to encrypt user data).
PID:4513

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

/data/user/0/cn.yidonghui/databases/yidonghui.db
Filesize
80KB

MD5
ab4858ed5343faf0f8d779515cacdb46

SHA1
04be187c5fa393f623275f50af8238499391d2b6

SHA256
9a3fb2b78fbc410dfe1b96876c665d7446088fde629c12b3c9b12acc46c27a98

SHA512
a9fccc0f0bf9ccc093d1d4bb08c5a2fcc5c7815b4d26eef4171217ec4726ed0744aae22c291b04807593ae75b0773ac1a2c75565efe6b0d979fc9a3b678f5787

Download Submit
/data/user/0/cn.yidonghui/databases/yidonghui.db-journal
Filesize
1KB

MD5
5254a6dbf6c5de0f610437b45c6094a3

SHA1
cdd83de4df094e3b90628914dca39876aef34b92

SHA256
2785a3c2bfc470ba8bf64c118cb976f32df82511d6e7a5de26a01ca8af1d35c2

SHA512
16cfdb45d7d67bb4b17a3f10c9993937cfb162d2d34dc8901fedddc99fd697a5d0888802ef943deaa5739a4a0b406f5e61fceb25049beaca0f6f7b7b09f4c161

Download Submit
/data/user/0/cn.yidonghui/shared_prefs/MainActivity.xml
Filesize
119B

MD5
d132b0120d87e26044c12c01b41416ff

SHA1
23e8025906a14e42a04392a8ad0cd33c91e9902a

SHA256
042e27e73e04fe731325d3a5a5ddc87cd08831ca9b3a58a446bfe533ef992497

SHA512
d93539d29f713a6236bf3d11f5796d31fadc9166a219ff2ae50c5cf0d054b617cf0d062c69f80d79ec6a224d066059050a39038169dfe4e41a015f7f6a8e7535

Download Submit
/data/user/0/cn.yidonghui/shared_prefs/MainActivity.xml
Filesize
161B

MD5
ff5b7e4f04ee01c757b8cf9add030a27

SHA1
1e8d448b9901974b50438613c53237a34cca2807

SHA256
e1f681f6bea768b60355594324eb5ad74718ef4be6840e738f4de99d8dd127cc

SHA512
899618e8767581e695edea6a214f4c9d8080b73389663cdad5c5e3436be81a815fd7ccb12a6b696ae01bc7f84d9068a5b5d80a4036e93d8494de9379d54d6bde

Download Submit
/data/user/0/cn.yidonghui/shared_prefs/setting.xml
Filesize
123B

MD5
6c013a73717ad8a9240e26c8e5023abc

SHA1
cca1af6199cc7dca228b7daca2d36026ea4bd0b8

SHA256
646858f95f6e71079b1010ea3a6d47ab849ace289f91b110fb6f060d98628064

SHA512
422d1da2d05c1f249b7fd88ea9dea6769d28987b5f16d54998580a800e51a7b503cad680ff26db333ebcc47857a81d4254ddefb9d6c71d3a8c983959cda330fa

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads