9eecc7d2c881b1eafaac932684ee5f768895cd577cd28c1fd7c413a0b0c29d87

Analysis

max time kernel
3019307s
max time network
17s
platform
android_x64
resource
android-x64-20220823-en
resource tags

androidarch:x64arch:x86image:android-x64-20220823-enlocale:en-usos:android-10-x64system
submitted
26/11/2022, 00:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
9eecc7d2c881b1eafaac932684ee5f768895cd577cd28c1fd7c413a0b0c29d87.apk
Size 1.5MB
Sample221126-bb1pasah88
SHA256 9eecc7d2c881b1eafaac932684ee5f768895cd577cd28c1fd7c413a0b0c29d87
MD5 9288592d14bb98cc5a7ed1dcd13c63d0
SHA1 c322e90ee840a6fa82cf42d4fee156ffaae5aad7
SHA512 ac7fd8fd4a3d9d9a31d044f53f68685a258606c9ed08ab4f0e47c10fc78b265fcb6ecb3573cba2a8a99f5770617a5300126f55b39c365b0faa04e2b4177a5708
SSDEEP 24576:EBjlxt4kPRxCzQGs/SY024jHxV81M9QXekk4Xv72sMbskxJcRgmw8Ci8CkjQwh:Ehl/PXq2B7GA14QX04Xv10dxJ5HLfjnh
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

ransomware

Malware Config

Signatures

Loads dropped Dex/Jar 1 IoCs

Runs executable file dropped to the device during analysis.

ioc	pid	Process
/data/user/0/com.oreq.bhcu.emvo/app_tjc/joy.jar	4774	com.oreq.bhcu.emvo

Requests dangerous framework permissions 9 IoCs

description	ioc
Allows an application to write to external storage.	android.permission.WRITE_EXTERNAL_STORAGE
Allows read only access to phone state, including the current cellular network information, the status of any ongoing calls, and a list of any PhoneAccounts registered on the device.	android.permission.READ_PHONE_STATE
Allows an application to read SMS messages.	android.permission.READ_SMS
Allows an application to send SMS messages.	android.permission.SEND_SMS
Allows an application to receive SMS messages.	android.permission.RECEIVE_SMS
Allows an application to monitor incoming MMS messages.	android.permission.RECEIVE_MMS
Allows an application to initiate a phone call without going through the Dialer user interface for the user to confirm the call.	android.permission.CALL_PHONE
Allows an application to see the number being dialed during an outgoing call with the option to redirect the call to a different number or abort the call altogether.	android.permission.PROCESS_OUTGOING_CALLS
Allows an app to access approximate location.	android.permission.ACCESS_COARSE_LOCATION

Uses Crypto APIs (Might try to encrypt user data). 1 IoCs

ransomware

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	com.oreq.bhcu.emvo

com.oreq.bhcu.emvo
1⤵
- Loads dropped Dex/Jar
- Uses Crypto APIs (Might try to encrypt user data).
PID:4774

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

djoy.jar

Path /data/user/0/com.oreq.bhcu.emvo/app_tjc/djoy.jar
Size 66KB
SHA256 0ade33f2144d84999286e47a59693634482f23ad028c1ed408963a843f9bca44
MD5 75ba605bcfe18a0b5f3f6f883f25d423
SHA1 387cbab78be74a9a98d66f622f5d17d808af7163
SHA512 b3d43728f4c91f3422ff9b120e2669d4b9ab13bb85c538b5d0ae342073577ec671255221165592efd674dc8e6cc10fde0dd7b1fe680e41c37a5d35572ad5bf5e
SSDEEP 1536:pYm6vF0/lrtbeVQTV4KHhbb0R4CMWaz6PhSUSrTPXBtkTN/F4uKbnWyir:um690PayTVvh30Rb7g6PsUc9ab4uOny
MD5 SHA1 SHA512 SSDEEP

Submit Download

joy.jar

Path /data/user/0/com.oreq.bhcu.emvo/app_tjc/joy.jar
Size 135KB
SHA256 c67629746eb7eb4203a24e4843c824ff0e7eefd3905003f2790ce90c08dfaa29
MD5 b6dfe0e23cf40553349b3df37d5be11a
SHA1 ac89b62afbd460f9aeb8a708dbf36df7f756c1ad
SHA512 1c944593a77d1af298e6fd8e9641958cb75c15c9ec697d3d72d1e9a0bf7c32529c50808a185fea9292af532d1c04dc688b32f37dea3f1a8cd16402d19b1b78be
SSDEEP 3072:tKIl3C0DV5B0Eg+RpO1Fn2jXktTzDKbLssUHO8CfEm1Z09Eyq:prh0Egi22jXkdK0uHEm1ZuEf
MD5 SHA1 SHA512 SSDEEP

Download

tjoy.jar

Path /data/user/0/com.oreq.bhcu.emvo/app_tjc/tjoy.jar
Size 66KB
SHA256 764b3505b93a104a1dc63b041d0256f8fccf8de928de562b112aa0807830bf80
MD5 a583245803ebb7c627f6c5afe73dea3d
SHA1 8e0d18478a5230bf537580181abbbf80d81c65b9
SHA512 ed2dc92f657a0fb7ba68034d0504e7f0afb325b765c4dfa522918d65ffe126e058dfea1b910410c5f334e8aad17eadcf28ba4fff04067148eaf1195dd1a2ddf6
SSDEEP 1536:Qur9qiVDIWE+vnw1ds4DE2cOwoBoL36DUqYDdYsnfb8Rg1EUeQ9P:QuroMxznkBDvLwx6jYHfb8RQuU
MD5 SHA1 SHA512 SSDEEP

Submit Download

apk958

Path /storage/emulated/0/.cache/apk958
Size 1.1MB
SHA256 c30d2fe8ad09243a805b1b3542dc4de133dd0b5574f30210fd2be2e5a5172285
MD5 79a0a7eaf924d233cba83bcf5e689a48
SHA1 cd3163ae2ca44e9104468ba3dcfb96f4a6057615
SHA512 9f6218134d2a9bfd3291847477f2e9c8c9de5bb4f2d334b27437d39e3f742215abb88925de03d89e1c389d2e0686d34f4cd5c5bd7d3a8b933085f9f4a33259a5
SSDEEP 24576:DBjlxt4kPRxCzQGs/SY024jHxV81M9QXekk4Xv72sMbsu:Dhl/PXq2B7GA14QX04Xv10P
MD5 SHA1 SHA512 SSDEEP

Submit Download

meise958.apk

Path /storage/emulated/0/.cache/meise958.apk
Size 1.1MB
SHA256 b95b74c030a8b6a8837a4937157a2842152cc383c621acfe118f717088b3c547
MD5 9cabdd5e71a414460ff8de61026eb7f9
SHA1 27f159e13f918df3a044a1c437a1d611727c58d4
SHA512 66646203123914a4558d8d6428fe1918f9ceba51b36ee182d8099006325f08a79f0be5ad0caf84a7c0c4f79b5738870a074df26e49090acfa5a7eed61228a0e4
SSDEEP 24576:gII0ZkWK8JyY06yM5cBQlxl0X6kkkeQO6EKWMTfigU4:1fZIHJMa6b0XJkkeJ6EKWMTfRx
MD5 SHA1 SHA512 SSDEEP

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads