a8ebbb0822f4b9487a87fb92260e364ca0cb526a5144a4167203767c605ae7e7

Analysis

max time kernel
3107559s
max time network
132s
platform
android_x86
resource
android-x86-arm-20220823-en
resource tags

androidarch:armarch:x86image:android-x86-arm-20220823-enlocale:en-usos:android-9-x86system
submitted
26-11-2022 21:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a8ebbb0822f4b9487a87fb92260e364ca0cb526a5144a4167203767c605ae7e7.apk
Size

2.7MB
MD5

701402f53e561c85d527f5db743e8e41
SHA1

e45b9d287445276b8216f418db65cc9ab5bb58d1
SHA256

a8ebbb0822f4b9487a87fb92260e364ca0cb526a5144a4167203767c605ae7e7
SHA512

6b9ecb64e3abada6ab29651307c7fb281fc3a372f62fb32b891d45cf12c9d8af7650deb9a350dfb17b3b1ed868888a1d246d9d3c21b27f2f26b941cc663adefe
SSDEEP

49152:pVFkq7rdC6WvP3NWS3M9Oz33sy8ujyXeWLTmPOaAe8gxP+UXvP3NWS5lx7rnLvqD:nDC6WvP3wOz3quYMA2xP+UXvP3FlxvL0

Score

7^/10

ransomware

Malware Config

Signatures

Acquires the wake lock. 1 IoCs

Processes:

com.kbbs.souhuyingyin

description ioc process

Framework service call android.os.IPowerManager.acquireWakeLock com.kbbs.souhuyingyin

description	ioc	process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.kbbs.souhuyingyin

Loads dropped Dex/Jar 3 IoCs

Runs executable file dropped to the device during analysis.

Processes:

/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.kbbs.souhuyingyin/files/csouhuyingyinco.jar --output-vdex-fd=42 --oat-fd=43 --oat-location=/data/user/0/com.kbbs.souhuyingyin/files/oat/x86/csouhuyingyinco.odex --compiler-filter=quicken --class-loader-context=&com.kbbs.souhuyingyin

ioc	pid	process
/data/user/0/com.kbbs.souhuyingyin/files/csouhuyingyinco.jar	4160	/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.kbbs.souhuyingyin/files/csouhuyingyinco.jar --output-vdex-fd=42 --oat-fd=43 --oat-location=/data/user/0/com.kbbs.souhuyingyin/files/oat/x86/csouhuyingyinco.odex --compiler-filter=quicken --class-loader-context=&
/data/user/0/com.kbbs.souhuyingyin/files/csouhuyingyinco.jar	4086	com.kbbs.souhuyingyin
/storage/emulated/0/Android/data/location/locCache/app/com.kbbs.souhuyingyin/vpl.dex	4086	com.kbbs.souhuyingyin

Reads information about phone network operator.
Uses Crypto APIs (Might try to encrypt user data). 1 IoCs
ransomware

Processes:

com.kbbs.souhuyingyin

description ioc process

Framework API call javax.crypto.Cipher.doFinal com.kbbs.souhuyingyin

description	ioc	process
Framework API call	javax.crypto.Cipher.doFinal	com.kbbs.souhuyingyin

com.kbbs.souhuyingyin
1⤵
- Acquires the wake lock.
- Loads dropped Dex/Jar
- Uses Crypto APIs (Might try to encrypt user data).
PID:4086

/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.kbbs.souhuyingyin/files/csouhuyingyinco.jar --output-vdex-fd=42 --oat-fd=43 --oat-location=/data/user/0/com.kbbs.souhuyingyin/files/oat/x86/csouhuyingyinco.odex --compiler-filter=quicken --class-loader-context=&
2⤵
- Loads dropped Dex/Jar
PID:4160

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

/data/user/0/com.kbbs.souhuyingyin/databases/cn.cq.yz
Filesize
32KB

MD5
2126e5a70fb48e951bc40d707436cfae

SHA1
04d71d4988756e38a0ea6b0f4dad6896917038d5

SHA256
6b6c580bbe167dfaf7e26e6e062ec46286a4874ed816d59bf4bf79b07f29ffef

SHA512
38d24329e7ba27bd0c9597207213de716989663e405a21be61f2c4254e4db9b1dfef30017357171710f00f2d25f81cca2c5f3546a132b448faf45e51cc87da7d

Download Submit
/data/user/0/com.kbbs.souhuyingyin/databases/cn.cq.yz-journal
Filesize
524B

MD5
3e72e57791f50832e67a2e9c88c10b4c

SHA1
943f417dc67ab7604ee5b31495d5e75de7566c42

SHA256
20d5eab82c7f46dbf6c1add9a21b2717086b91d4c8f0ace34d61147cdfaa7a87

SHA512
63d4c6e20241617243c0b55af557800e13758c79cbbb500616631da48da434b3b63e914f3624cda41ff7fdc1d807950eb6f3b70ac5fb7478f041d316ef8c6b36

Download Submit
/data/user/0/com.kbbs.souhuyingyin/databases/cn.cq.yz-shm
Filesize
8B

MD5
7dea362b3fac8e00956a4952a3d4f474

SHA1
05fe405753166f125559e7c9ac558654f107c7e9

SHA256
af5570f5a1810b7af78caf4bc70a660f0df51e42baf91d4de5b2328de0e83dfc

SHA512
1b7409ccf0d5a34d3a77eaabfa9fe27427655be9297127ee9522aa1bf4046d4f945983678169cb1a7348edcac47ef0d9e2c924130e5bcc5f0d94937852c42f1b

Download Submit
/data/user/0/com.kbbs.souhuyingyin/databases/cn.cq.yz-wal
Filesize
40KB

MD5
8907ac2a8e21f63593f057de62d7ded6

SHA1
19ba8c9e97513603877bf469201a4ef906e4724d

SHA256
9a8549b7580d0148946e4f2d508020fc806fc89a88afece4fd3ea3cc29cab66e

SHA512
307b44d882d0208a19316d86dc6aa6db579a1d3780f78b70d19ef677304abf7412102ef0d3554e5fcc8506d500c5533df35c50ce56d93bb12804b50dce7ce421

Download Submit
/data/user/0/com.kbbs.souhuyingyin/files/csouhuyingyinco.jar
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/com.kbbs.souhuyingyin/files/csouhuyingyinco.jar
Filesize
428KB

MD5
2de9536d347a0df1b4ca645079a86a3b

SHA1
f6f21e0dcfe54b3fc258839f6deefce35410fdc1

SHA256
b37e966ea7bcd1ce5e2ff2f2b46a115e32a2864c535b3c5b42007f6769fff385

SHA512
ec744165bb459d2acaed8b77c8dfafcb9c36270beb517089beecc8d203930fb80f2ea3056fb64f35f015e1ba66e5c3639e94c30ff66f532e5787f43b382644d7

Download Submit
/data/user/0/com.kbbs.souhuyingyin/files/csouhuyingyinco.jar
Filesize
428KB

MD5
0ca7138023c18802277e730501d42d3d

SHA1
147c90c58b865733f6a721f2c24bb308d79cdfb5

SHA256
5d16aacf8f36c5b6e25daad3506e55fa956a655447a87370f5bb8e20eab54e3c

SHA512
21a23e85d121817cf5dccfc5e2d847ec1aac12ac5d09959dec26cf6de15b8826a9eae2a6d9541c690680142a1b1a34f864882d144d4e98b6347a1091952c900e

Download Submit
/data/user/0/com.kbbs.souhuyingyin/files/csouhuyingyinco.jar.x86.flock
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/com.kbbs.souhuyingyin/files/oat/csouhuyingyinco.jar.cur.prof
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/com.kbbs.souhuyingyin/files/oat/x86/csouhuyingyinco.odex
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/com.kbbs.souhuyingyin/files/oat/x86/csouhuyingyinco.vdex
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/storage/emulated/0/.xxx/adc.dex
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/storage/emulated/0/.xxx/adc.dex
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/storage/emulated/0/.xxx/adc.dex
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/storage/emulated/0/.xxx/adc.dex
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/storage/emulated/0/Android/data/location/locCache/app/com.kbbs.souhuyingyin/oat/x86/vpl.odex
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/storage/emulated/0/Android/data/location/locCache/app/com.kbbs.souhuyingyin/oat/x86/vpl.vdex
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/storage/emulated/0/Android/data/location/locCache/app/com.kbbs.souhuyingyin/vpl.dex
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/storage/emulated/0/Android/data/location/locCache/app/com.kbbs.souhuyingyin/vpl.dex
Filesize
223KB

MD5
2f5a0831182b3b89d59150c5b5c647e1

SHA1
783377889a70d20b74b31365f968b7a0403a049e

SHA256
ce1a23d24c6b5a21506b2597a6430f493b3c97c75c12fba6764154aaf782e612

SHA512
d5c87c9627542f561ce6efeb623c747414a8dfdeb5fd0b2e5da1fb5a29a6e912c9e62fb9d9fd24e5b32d781b423cdcd1e1a3e5d627b7080661c4776469042c40

Download Submit
/storage/emulated/0/Android/data/location/locCache/app/com.kbbs.souhuyingyin/vpl.dex.x86.flock
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/storage/emulated/0/Download/P.apk
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/storage/emulated/0/Download/P.apk
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit