e303d8bcdaba6046baab8e8c3648ffafb6743aa23952b0227162644b9f869a85

Analysis

max time kernel
3067089s
max time network
149s
platform
android_x86
resource
android-x86-arm-20220823-en
resource tags

androidarch:armarch:x86image:android-x86-arm-20220823-enlocale:en-usos:android-9-x86system
submitted
26-11-2022 13:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e303d8bcdaba6046baab8e8c3648ffafb6743aa23952b0227162644b9f869a85.apk
Size

3.0MB
MD5

a0a9ed3cb14160eea8657788e5ae05ba
SHA1

daf5b67b5311061e2a638ce6276689ac193fc9e8
SHA256

e303d8bcdaba6046baab8e8c3648ffafb6743aa23952b0227162644b9f869a85
SHA512

582b44a2e957fff748e4009e5c6605999823ff9b70664697e46bdff8bfc3f92795d676d2f9834e4d4cacf0e7a301fcd8b75a08f1d40b0fb25da1c666a88863e3
SSDEEP

49152:giyDa4D6K9aQefWK0oaDYEJY7541WjNJvotFMIpFAv4B6sxD5x9Ewep6S4/JbjqL:gxa4D9EWK0oF77nvoA0BLRzKwepjeJdy

Score

7^/10

infostealer ransomware

Malware Config

Signatures

Acquires the wake lock. 1 IoCs

Processes:

com.qy.beauty

description ioc process

Framework service call android.os.IPowerManager.acquireWakeLock com.qy.beauty
Reads the content of SMS inbox messages. 1 IoCs
infostealer

Processes:

com.qy.beauty

description ioc process

URI accessed for read content://sms/inbox com.qy.beauty
Reads information about phone network operator.
Uses Crypto APIs (Might try to encrypt user data). 1 IoCs
ransomware

Processes:

com.qy.beauty

description ioc process

Framework API call javax.crypto.Cipher.doFinal com.qy.beauty

description	ioc	process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.qy.beauty

description	ioc	process
URI accessed for read	content://sms/inbox	com.qy.beauty

description	ioc	process
Framework API call	javax.crypto.Cipher.doFinal	com.qy.beauty

com.qy.beauty
1⤵
- Acquires the wake lock.
- Reads the content of SMS inbox messages.
- Uses Crypto APIs (Might try to encrypt user data).
PID:4023

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

/data/user/0/com.qy.beauty/databases/DD.db
Filesize
24KB

MD5
b6e72c0aa36915aee5125aee6571ea57

SHA1
d67e6fa8999d98ad4b24ab4396226cb09889d0f2

SHA256
1e5595568d67754cc2be6dcc26146eba61250b62e637d377e6507ffa97fdd378

SHA512
06cb0872439e0773d0bc1ccb0bb54642f24fbcc0d01865c9e425394ed1a398b24a6d836f5c197d03220dff55b61844e3a95d0345f64114ece427379975c53f3f

Download Submit
/data/user/0/com.qy.beauty/databases/DD.db-journal
Filesize
524B

MD5
e55f2241495351d7c2ff674cbeed0e17

SHA1
0f38658cc41aec2dfaae91ebd9ded86395e9f1c3

SHA256
3ef958453e8613fabac64e73354b225ecfc87d17c956e947da6fcb513fbda3c2

SHA512
bedc3e6b1cd25c973f6619effc42ddfac61cde03563c325674bfe3eab04710e6c7b58624666ac8183784b8ec619bc04714badf84fb571f9d1dbb0bc533cd0ad1

Download Submit
/data/user/0/com.qy.beauty/databases/DD.db-shm
Filesize
8B

MD5
7dea362b3fac8e00956a4952a3d4f474

SHA1
05fe405753166f125559e7c9ac558654f107c7e9

SHA256
af5570f5a1810b7af78caf4bc70a660f0df51e42baf91d4de5b2328de0e83dfc

SHA512
1b7409ccf0d5a34d3a77eaabfa9fe27427655be9297127ee9522aa1bf4046d4f945983678169cb1a7348edcac47ef0d9e2c924130e5bcc5f0d94937852c42f1b

Download Submit
/data/user/0/com.qy.beauty/databases/DD.db-wal
Filesize
40KB

MD5
2e5fa05bb63fa2cb01c2043d38cfe6e6

SHA1
4770645cc3f9db2528331f6cc3fa0a61d2eae9db

SHA256
5a7fa4b99e7c5eddd0291092affc57df7a554817de700de428742ee4aa4112a2

SHA512
cccae7e203da807b979b0c104c12f907ba49ef85925b58deb87c3f4afb0d417c2f13654658d4ecf55fc6ae87f08ad1aa87a6d9dc87b4c12184f9c0425fe7b4ff

Download Submit
/data/user/0/com.qy.beauty/databases/qy_db_pay
Filesize
4KB

MD5
f2b4b0190b9f384ca885f0c8c9b14700

SHA1
934ff2646757b5b6e7f20f6a0aa76c7f995d9361

SHA256
0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514

SHA512
ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1

Download Submit
/data/user/0/com.qy.beauty/databases/qy_db_pay-journal
Filesize
524B

MD5
dc79d9d38f9ac00e5c9871617ad2b9bc

SHA1
9bd6b7a50fb0f32d8e479e90baeedfc85180f198

SHA256
b05ea1cb11fcb6df6e0a43b4db865af5321b07e904e616e13bb568896d376fff

SHA512
c3a57575cbddc11f9dde5a1b94e044c4691f7a86f99703101c1fd48ab0f33e3c7cdebd5329cfbc483ebb806b67b11616635467ea56628fedc3af312857675da7

Download Submit
/data/user/0/com.qy.beauty/databases/qy_db_pay-shm
Filesize
8B

MD5
7dea362b3fac8e00956a4952a3d4f474

SHA1
05fe405753166f125559e7c9ac558654f107c7e9

SHA256
af5570f5a1810b7af78caf4bc70a660f0df51e42baf91d4de5b2328de0e83dfc

SHA512
1b7409ccf0d5a34d3a77eaabfa9fe27427655be9297127ee9522aa1bf4046d4f945983678169cb1a7348edcac47ef0d9e2c924130e5bcc5f0d94937852c42f1b

Download Submit
/data/user/0/com.qy.beauty/databases/qy_db_pay-wal
Filesize
56KB

MD5
85a3746b19e958394b7c17d35f888fa3

SHA1
ab2698e1c4cc7807236d430cf2f97a568fef61af

SHA256
222eeb60bdbaec450a29dddce5da950679ec38f4bf9e58e10e80ca0c9ddcd356

SHA512
2efb68b7b387b527b3d9016f0742cf2bfbcefd2c1ca30d0e39358115307ffddda1ebd52a09eee9a95df569068b5b2f6e24bea8042155933430dcbf4a3cadbff7

Download Submit
/data/user/0/com.qy.beauty/databases/umengstatsdata
Filesize
4KB

MD5
f2b4b0190b9f384ca885f0c8c9b14700

SHA1
934ff2646757b5b6e7f20f6a0aa76c7f995d9361

SHA256
0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514

SHA512
ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1

Download Submit
/data/user/0/com.qy.beauty/databases/umengstatsdata-journal
Filesize
524B

MD5
48bb2a1e958d29b892b748f35f6853a8

SHA1
47b45b9fcd26e2ee642181460cc0465b38e79588

SHA256
e4940695ff03dedb76830303c6d34c0f9a32e5025bea8efad053f56d6c37644d

SHA512
08adbd0b98d2595c6f12312edc7e427dc1abddffae9701e29cf8a478aa7851cd375caa3e150983c8259c3e98b5bc3d455b511fd6e20a88ee5d7d2a4de9eb95ed

Download Submit
/data/user/0/com.qy.beauty/databases/umengstatsdata-shm
Filesize
8B

MD5
7dea362b3fac8e00956a4952a3d4f474

SHA1
05fe405753166f125559e7c9ac558654f107c7e9

SHA256
af5570f5a1810b7af78caf4bc70a660f0df51e42baf91d4de5b2328de0e83dfc

SHA512
1b7409ccf0d5a34d3a77eaabfa9fe27427655be9297127ee9522aa1bf4046d4f945983678169cb1a7348edcac47ef0d9e2c924130e5bcc5f0d94937852c42f1b

Download Submit
/data/user/0/com.qy.beauty/databases/umengstatsdata-wal
Filesize
108KB

MD5
877d8a81fc5b4003994f7dabc802e420

SHA1
6327595e85c87e59f6bc8a7eb10ceea044f47d44

SHA256
298e9b9137aea4d2d8fb547834adaf549d129c9826b1ca70064098052ed08b2b

SHA512
09e5bcc16ce2948472c39bc17b96f66d1738cee858b8c30656196e49317688674515adef3d23aa2d3213c9dc2cbf4a5a61bd46a3acd4c001f0de7c5de357b7d7

Download Submit
/data/user/0/com.qy.beauty/files/meinv
Filesize
171B

MD5
0f03295188d1e626cd15f695f71f44a0

SHA1
bf17a19c072308a70102dba2a36673f6a905bf01

SHA256
dc610a6a7ea683fce5d1f74ee4e206dd0195f10d7b95d5dc6117dd1937904e92

SHA512
fdb3c67e5632747d9c1dde2a0f732285621e317d2743367f02bb2268523e1b74d1030aab0d24520678eabff1f7cf662040f75144b0a9d42fe1f6e600cd8b72e7

Download Submit
/storage/emulated/0/com.qy.beauty.start.times/com.qy.beauty
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads