87f7a2518e27a4d2a087aff756c43fa9679729839498be156c370024ccc0ac1f

Analysis

max time kernel
3019348s
max time network
22s
platform
android_x64
resource
android-x64-20220823-en
resource tags

androidarch:x64arch:x86image:android-x64-20220823-enlocale:en-usos:android-10-x64system
submitted
26-11-2022 00:59

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

87f7a2518e27a4d2a087aff756c43fa9679729839498be156c370024ccc0ac1f.apk
Size

1.4MB
MD5

3bd5de7326345f0133813ca6f16779bc
SHA1

c220b68d1de61839ca71c2d21235994dfe45fe81
SHA256

87f7a2518e27a4d2a087aff756c43fa9679729839498be156c370024ccc0ac1f
SHA512

ff42be9b97f07c1c965d904602fe76e5e40bcb622740e0596748f4149b6ff2f3c4619ceba089ebba9043b09327640501cbf81a3471ba4af5505713ec03c87abc
SSDEEP

24576:R3JyuL/y2/2LCzcURBvpDZxRnPJK7qmBw7Wc6qaaxS8ZxJv0W7CkaxCeOhr:ZJ1GaBFPPI7qmBw7dZTFxJYdCDhr

Score

7^/10

ransomware

Malware Config

Signatures

Loads dropped Dex/Jar 1 IoCs
Runs executable file dropped to the device during analysis.

Processes:

com.sonl.evcr.qqys

ioc pid process

/data/user/0/com.sonl.evcr.qqys/app_tjc/joy.jar 4781 com.sonl.evcr.qqys

ioc	pid	process
/data/user/0/com.sonl.evcr.qqys/app_tjc/joy.jar	4781	com.sonl.evcr.qqys

Requests dangerous framework permissions 9 IoCs

Processes:

description	ioc
Allows an application to write to external storage.	android.permission.WRITE_EXTERNAL_STORAGE
Allows read only access to phone state, including the current cellular network information, the status of any ongoing calls, and a list of any PhoneAccounts registered on the device.	android.permission.READ_PHONE_STATE
Allows an application to read SMS messages.	android.permission.READ_SMS
Allows an application to send SMS messages.	android.permission.SEND_SMS
Allows an application to receive SMS messages.	android.permission.RECEIVE_SMS
Allows an application to monitor incoming MMS messages.	android.permission.RECEIVE_MMS
Allows an application to initiate a phone call without going through the Dialer user interface for the user to confirm the call.	android.permission.CALL_PHONE
Allows an application to see the number being dialed during an outgoing call with the option to redirect the call to a different number or abort the call altogether.	android.permission.PROCESS_OUTGOING_CALLS
Allows an app to access approximate location.	android.permission.ACCESS_COARSE_LOCATION

Uses Crypto APIs (Might try to encrypt user data). 1 IoCs
ransomware

Processes:

com.sonl.evcr.qqys

description ioc process

Framework API call javax.crypto.Cipher.doFinal com.sonl.evcr.qqys

description	ioc	process
Framework API call	javax.crypto.Cipher.doFinal	com.sonl.evcr.qqys

com.sonl.evcr.qqys
1⤵
- Loads dropped Dex/Jar
- Uses Crypto APIs (Might try to encrypt user data).
PID:4781

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

/data/user/0/com.sonl.evcr.qqys/app_tjc/djoy.jar
Filesize
66KB

MD5
75ba605bcfe18a0b5f3f6f883f25d423

SHA1
387cbab78be74a9a98d66f622f5d17d808af7163

SHA256
0ade33f2144d84999286e47a59693634482f23ad028c1ed408963a843f9bca44

SHA512
b3d43728f4c91f3422ff9b120e2669d4b9ab13bb85c538b5d0ae342073577ec671255221165592efd674dc8e6cc10fde0dd7b1fe680e41c37a5d35572ad5bf5e

Download Submit
/data/user/0/com.sonl.evcr.qqys/app_tjc/joy.jar
Filesize
135KB

MD5
b6dfe0e23cf40553349b3df37d5be11a

SHA1
ac89b62afbd460f9aeb8a708dbf36df7f756c1ad

SHA256
c67629746eb7eb4203a24e4843c824ff0e7eefd3905003f2790ce90c08dfaa29

SHA512
1c944593a77d1af298e6fd8e9641958cb75c15c9ec697d3d72d1e9a0bf7c32529c50808a185fea9292af532d1c04dc688b32f37dea3f1a8cd16402d19b1b78be

Download Submit
/data/user/0/com.sonl.evcr.qqys/app_tjc/oat/joy.jar.cur.prof
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/com.sonl.evcr.qqys/app_tjc/tjoy.jar
Filesize
66KB

MD5
a583245803ebb7c627f6c5afe73dea3d

SHA1
8e0d18478a5230bf537580181abbbf80d81c65b9

SHA256
764b3505b93a104a1dc63b041d0256f8fccf8de928de562b112aa0807830bf80

SHA512
ed2dc92f657a0fb7ba68034d0504e7f0afb325b765c4dfa522918d65ffe126e058dfea1b910410c5f334e8aad17eadcf28ba4fff04067148eaf1195dd1a2ddf6

Download Submit
/data/user/0/com.sonl.evcr.qqys/shared_prefs/joyssp.xml
Filesize
303B

MD5
d8de6910c0a6ae11c4a4a4bc31bd5314

SHA1
80a239b266d52073873f4f2b450f0e3b20ff6622

SHA256
9894f6ac814212a02218e4448db53c3d4fc0a8f0a8936e2bf6e5464638fb47a9

SHA512
a210bf5c796e9b5addfbb363ba3a636e7b29f3fd5d640a3c852ad0aa5528fc1b5da68eb3732a14191a1b9149940df0872781fd157bb22d42f50a8ec9541c5267

Download Submit
/storage/emulated/0/.cache/apk03
Filesize
1.1MB

MD5
dfca55473124f1feb214aa1d5dcc83c0

SHA1
0c600a85d34232b31a64cdb4944f72f8ec14c86e

SHA256
958283f84d0e65f9a894262679c1ac488a17ff7dbbf0ce30c360a74a5b1f2a5a

SHA512
f2b97732ed716cc0c63182c161ed856ee98ac3916ab6e9483bbb0f0dbee66a0e8ad6c792b08475e3c1fb2ae239de3588d2e57fe0dcd0e669d1f37456f292e307

Download Submit
/storage/emulated/0/.cache/youla1103.apk
Filesize
1.1MB

MD5
bd5b49123d0bd4088075faa6e869b7bc

SHA1
0137b7fc48fd9803382750f843bc4b8a876f08af

SHA256
b2d56da379b5dd087d663be8642e52b02372b5a2a6e87fc86264fcf268616ffc

SHA512
2df8b805f4bb50b2fa4f11aa760eeb1473a7616a30fde77deb14d0af2b72bfed485b2320f632cb0705ad725361e185ee8c475521ad80e70569741ce3df043a2f

Download Submit