48bcecbb1f5be763acdb478dba1963ceb3d56ccf6f28fd51f0ff1e5d79bd9264

Analysis

max time kernel
2982258s
max time network
11s
platform
android_x86
resource
android-x86-arm-20220823-en
resource tags

androidarch:armarch:x86image:android-x86-arm-20220823-enlocale:en-usos:android-9-x86system
submitted
25-11-2022 19:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

48bcecbb1f5be763acdb478dba1963ceb3d56ccf6f28fd51f0ff1e5d79bd9264.apk
Size

12.7MB
MD5

deba907b5cfc77a876c20a4ca16c15ab
SHA1

4ad15097ce0e20a7ca1ac1522551149b3862507b
SHA256

48bcecbb1f5be763acdb478dba1963ceb3d56ccf6f28fd51f0ff1e5d79bd9264
SHA512

09e2e5a78b4c4f86119bfcec51efedb78693bfe4692f8aa5b550fc9ffa079bca3d25447407a25e1da21b633921cd47c3d0300dd449c53b3406221e09f59ff278
SSDEEP

196608:OfGof6A/kOqej6pAJtqxM9VuasQtvewJXOMziXMepb4Pya7ADYLsPmI7fssb1glz:qff/qJM9VuD9wJTi4JLKmKff+l

Score

7^/10

ransomware

Malware Config

Signatures

Loads dropped Dex/Jar 2 IoCs

Runs executable file dropped to the device during analysis.

Processes:

/system/bin/dex2oat --debuggable --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --debuggable --generate-mini-debug-info --dex-file=/data/user/0/com.arzen.xcmbwz.ifox/app_push_lib_v3_15/plugin-deploy.jar --output-vdex-fd=44 --oat-fd=45 --oat-location=/data/user/0/com.arzen.xcmbwz.ifox/app_push_lib_v3_15/oat/x86/plugin-deploy.odex --compiler-filter=quicken --class-loader-context=&com.arzen.xcmbwz.ifox

ioc	pid	process
/data/user/0/com.arzen.xcmbwz.ifox/app_push_lib_v3_15/plugin-deploy.jar	4119	/system/bin/dex2oat --debuggable --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --debuggable --generate-mini-debug-info --dex-file=/data/user/0/com.arzen.xcmbwz.ifox/app_push_lib_v3_15/plugin-deploy.jar --output-vdex-fd=44 --oat-fd=45 --oat-location=/data/user/0/com.arzen.xcmbwz.ifox/app_push_lib_v3_15/oat/x86/plugin-deploy.odex --compiler-filter=quicken --class-loader-context=&
/data/user/0/com.arzen.xcmbwz.ifox/app_push_lib_v3_15/plugin-deploy.jar	4065	com.arzen.xcmbwz.ifox

Uses Crypto APIs (Might try to encrypt user data). 1 IoCs
ransomware

Processes:

com.arzen.xcmbwz.ifox

description ioc process

Framework API call javax.crypto.Cipher.doFinal com.arzen.xcmbwz.ifox

description	ioc	process
Framework API call	javax.crypto.Cipher.doFinal	com.arzen.xcmbwz.ifox

com.arzen.xcmbwz.ifox
1⤵
- Loads dropped Dex/Jar
- Uses Crypto APIs (Might try to encrypt user data).
PID:4065

/system/bin/dex2oat --debuggable --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --debuggable --generate-mini-debug-info --dex-file=/data/user/0/com.arzen.xcmbwz.ifox/app_push_lib_v3_15/plugin-deploy.jar --output-vdex-fd=44 --oat-fd=45 --oat-location=/data/user/0/com.arzen.xcmbwz.ifox/app_push_lib_v3_15/oat/x86/plugin-deploy.odex --compiler-filter=quicken --class-loader-context=&
2⤵
- Loads dropped Dex/Jar
PID:4119

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

/data/user/0/com.arzen.xcmbwz.ifox/app_push_lib_v3_15/oat/plugin-deploy.jar.cur.prof
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/com.arzen.xcmbwz.ifox/app_push_lib_v3_15/oat/x86/plugin-deploy.odex
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/com.arzen.xcmbwz.ifox/app_push_lib_v3_15/oat/x86/plugin-deploy.vdex
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/com.arzen.xcmbwz.ifox/app_push_lib_v3_15/plugin-deploy.jar
Filesize
203KB

MD5
a8e0d96087006f31bb3b7565a61edb2a

SHA1
8a0afaca21a5dba7ddd35f3d3a7abdd7ea48d933

SHA256
c8543a07d4cf4d01c6e1270a598039aada1041bf046510f18c54061e46c0d060

SHA512
0d84932fe9c0c4ff819b89e5599ed931999c8a76cdd8451508a3ecac6bb500166ebfaa7969b795a51ebc6d20ebb2164cb4fa91be5219a13eb88710c3d04f314b

Download Submit
/data/user/0/com.arzen.xcmbwz.ifox/app_push_lib_v3_15/plugin-deploy.jar
Filesize
509KB

MD5
06668bb6db75530052316ff93d8ed7c6

SHA1
55fa23910b5959262d954a081ef8b751573ed96c

SHA256
36fa8a0ba5d6f1a52ec833c524ea719e2cfb8260663819492c22e781b24b3b8f

SHA512
0604ceace7dc62f86bcae9d1dd9976d8c60b7c17411dd602c388f3848dafb4b7574a54088fb28c4d1d3a257b782f945b0acc626d26218dd02d32ef83cf1d8945

Download Submit
/data/user/0/com.arzen.xcmbwz.ifox/app_push_lib_v3_15/plugin-deploy.jar
Filesize
509KB

MD5
06668bb6db75530052316ff93d8ed7c6

SHA1
55fa23910b5959262d954a081ef8b751573ed96c

SHA256
36fa8a0ba5d6f1a52ec833c524ea719e2cfb8260663819492c22e781b24b3b8f

SHA512
0604ceace7dc62f86bcae9d1dd9976d8c60b7c17411dd602c388f3848dafb4b7574a54088fb28c4d1d3a257b782f945b0acc626d26218dd02d32ef83cf1d8945

Download Submit
/data/user/0/com.arzen.xcmbwz.ifox/app_push_lib_v3_15/plugin-deploy.jar.x86.flock
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/com.arzen.xcmbwz.ifox/app_push_lib_v3_15/plugin-deploy.key
Filesize
174B

MD5
0e41e707b2bfc5c6772f803a86ddaa09

SHA1
14ce9a6e426300c85ce20d6f3fefd745cf40fd03

SHA256
656f2a9fa5df7450f876c56de1f7b22395de985dd11366bada3f62293e410b5d

SHA512
e254607c644d024a70249e11ae6ca3863c630bab8afa047353552c91f3c15fab733d9928193a51ed413355a10210ba35ea5c07d64baa0683b0733fbdd7d6101b

Download Submit
/storage/emulated/0/Android/data/com.skymobi.pay.app/plugins/com.skymobi.pay.opplugin_v2018.apk
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit