6c27ff0aa4cf6fc8d2f3628e1b61cbdc703df8cd162bcd3602bdda8e587484be

Analysis

max time kernel
3075306s
max time network
147s
platform
android_x86
resource
android-x86-arm-20220823-en
resource tags

androidarch:armarch:x86image:android-x86-arm-20220823-enlocale:en-usos:android-9-x86system
submitted
26-11-2022 14:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6c27ff0aa4cf6fc8d2f3628e1b61cbdc703df8cd162bcd3602bdda8e587484be.apk
Size

2.1MB
MD5

ae66e562af8d847b2760421fc4f3e1e4
SHA1

69f1f093fd917161afa31dac84eddd5caec0701c
SHA256

6c27ff0aa4cf6fc8d2f3628e1b61cbdc703df8cd162bcd3602bdda8e587484be
SHA512

612ee9180bb10e3f0e052ef6214cab838a7caec569b504d98ff73ccfdc276bef6d174cccc925f0cf027110f354433ed825eb72ae7d1ba737932544cf192b0451
SSDEEP

49152:GIX8z3uCou4hqdMLxDfBV03p9LBSsm1kaOXQ0C3zrwo1oMdVPeNyGb5C9kqT0yh0:gz3LyhqdMLxD43p99SN+lgv3Z+MdVPeB

Score

8^/10

ransomware

Malware Config

Signatures

Requests cell location 1 IoCs
Uses Android APIs to to get current cell location.

Processes:

com.google.video.info

description ioc process

Framework service call com.android.internal.telephony.ITelephony.getCellLocation com.google.video.info

description	ioc	process
Framework service call	com.android.internal.telephony.ITelephony.getCellLocation	com.google.video.info

Requests dangerous framework permissions 4 IoCs

Processes:

description	ioc
Allows read only access to phone state, including the current cellular network information, the status of any ongoing calls, and a list of any PhoneAccounts registered on the device.	android.permission.READ_PHONE_STATE
Allows an application to write to external storage.	android.permission.WRITE_EXTERNAL_STORAGE
Allows an app to access precise location.	android.permission.ACCESS_FINE_LOCATION
Allows an app to access approximate location.	android.permission.ACCESS_COARSE_LOCATION

Reads information about phone network operator.
Uses Crypto APIs (Might try to encrypt user data). 1 IoCs
ransomware

Processes:

com.google.video.info

description ioc process

Framework API call javax.crypto.Cipher.doFinal com.google.video.info

description	ioc	process
Framework API call	javax.crypto.Cipher.doFinal	com.google.video.info

com.google.video.info
1⤵
- Requests cell location
- Uses Crypto APIs (Might try to encrypt user data).
PID:4032

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

/data/user/0/com.google.video.info/databases/access.db
Filesize
4KB

MD5
f2b4b0190b9f384ca885f0c8c9b14700

SHA1
934ff2646757b5b6e7f20f6a0aa76c7f995d9361

SHA256
0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514

SHA512
ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1

Download Submit
/data/user/0/com.google.video.info/databases/access.db-journal
Filesize
524B

MD5
3454534ce627dccef19087796d80dc7c

SHA1
8dd26468491335d0f304bbb5df0baba3db9fe72c

SHA256
e6e20d9ebad348352763ce7ab124a6494d060f0bed0009e71b9d3e30d02a13cf

SHA512
8921741c190180ade24db88711b31c575f3cd83eb0dae3eb9f1120742db05e9bb8403cdd91f01ec10cbee128c8a14b8c9f3fce6aca5e331f148d1db983af4ce7

Download Submit
/data/user/0/com.google.video.info/databases/access.db-shm
Filesize
8B

MD5
7dea362b3fac8e00956a4952a3d4f474

SHA1
05fe405753166f125559e7c9ac558654f107c7e9

SHA256
af5570f5a1810b7af78caf4bc70a660f0df51e42baf91d4de5b2328de0e83dfc

SHA512
1b7409ccf0d5a34d3a77eaabfa9fe27427655be9297127ee9522aa1bf4046d4f945983678169cb1a7348edcac47ef0d9e2c924130e5bcc5f0d94937852c42f1b

Download Submit
/data/user/0/com.google.video.info/databases/access.db-wal
Filesize
32KB

MD5
a3531c543a31fb2684281efd392a32f7

SHA1
45d5ad555cb88cad145c0ce1cd34c45717487a55

SHA256
141a53a2d73623f99ca37dcd1f613c8a9a7e11ed393be69d2e3d0b6e673335a3

SHA512
090309a331ee081d3fdcedef5de41356378094806a7177ea1a49eff75cfdd43613002fdd72574c62a20d78d41edf93a974da8555e5ea481ea06fd2b19449863c

Download Submit
/data/user/0/com.google.video.info/files/__local_stat_cache.json
Filesize
25B

MD5
2d805b13f2f28dc3ca9bbcc000f49bb5

SHA1
9eac165b4d81258fd3967cde5cc53b53b1dabcb1

SHA256
c8a6624f390568f0ddcb9841336aec6a564460fdaf6624e562b32935b8956f19

SHA512
5db8c57bab36bcf9db698c1dce70318cbffc156dd1d1c1e09e5b7ba60aff07b598ebbf26c4bd8a2b03bd6e59ef2dde2d944a22a8d8a19ecc8378e83afb7c83b0

Download Submit
/data/user/0/com.google.video.info/shared_prefs/pay_xml.xml
Filesize
119B

MD5
56be6b759e25d6f84fad17cf6f0af4a0

SHA1
769b9b85217158e11ad1ac346537143f3b291384

SHA256
742af9555a7b1c52ff65092c7809add85e5f66dc01b337c7994b10149e9dfcc2

SHA512
591ab4bf27cf5b08b3cd5690e1c290f487d7e787f03c25e120f63aefa53d31de5df7a47ee342db5c2784da71fcdb862ad74eb68416e3fd54da9db5c4217ddf5d

Download Submit
/storage/emulated/0/backups/.SystemConfig/.cuid
Filesize
89B

MD5
c63c7df9a4ef110a8c2fbabc6f3e5bc6

SHA1
fe5b70b959e1e46097fc8c0d0bd90a2b0ca2ff63

SHA256
82385b531935ac10099083a34b7f7540595aceddbc2009ab9513c1f949f683a7

SHA512
c7d4c5c693d7d0c3824d7a409dbd0f425f9de46c0c9fe2a5f0bd225dce8dc1903b1c3ccfb85eb2b4759a824fb17683ee0a3058f8f20da17a59090867f2b628e9

Download Submit
/storage/emulated/0/plugin.apk
Filesize
334KB

MD5
4bec0edb4fdc63157aa0d2626b8cf71b

SHA1
6a76ed94b550ffb0b42623b3a97caa6a6866016b

SHA256
47dd9234fa1f3dd91b58456586b40e27d199e1b4b3219b43db43f49031a96869

SHA512
8b4d7dbccd35475748f5547a8861375b53f50f3e29b1bf6927d59c19dac2e0290f86e8f440f96801cd78be16e9dad5c093f5fec393d70f1b67c67ec6538e4240

Download Submit