2f0a158307f4895e711826d06b8a3157a99d41e9ec1d18d583e27be6302786b7

Analysis

max time kernel
3075197s
max time network
160s
platform
android_x86
resource
android-x86-arm-20220823-en
resource tags

androidarch:armarch:x86image:android-x86-arm-20220823-enlocale:en-usos:android-9-x86system
submitted
26-11-2022 14:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2f0a158307f4895e711826d06b8a3157a99d41e9ec1d18d583e27be6302786b7.apk
Size

3.5MB
MD5

d3dd8eeec6474a2f34ec1d66e31f2c13
SHA1

4bb07d3e6667a4b20d443a5dd91cf6f8852ab3aa
SHA256

2f0a158307f4895e711826d06b8a3157a99d41e9ec1d18d583e27be6302786b7
SHA512

66f7403ec63a9439f1e15cc57b49068613e2298c9c829ac323c046e9b3ef3e773b9bcba93cabab0c084e9bf83a64d19cedbd7763c7187afcaf771d161caeb4ec
SSDEEP

98304:Ruz3Lqq9Y/Q/ybicXrqSNSppQbVeCmUrOASFaMGIyuivMg0V8lQ26u1R9s70u:R8BaeSNIObVec61FaHIyux26uu

Score

7^/10

ransomware

Malware Config

Signatures

Requests dangerous framework permissions 4 IoCs

Processes:

description	ioc
Allows read only access to phone state, including the current cellular network information, the status of any ongoing calls, and a list of any PhoneAccounts registered on the device.	android.permission.READ_PHONE_STATE
Allows an application to write to external storage.	android.permission.WRITE_EXTERNAL_STORAGE
Allows an app to access precise location.	android.permission.ACCESS_FINE_LOCATION
Allows an app to access approximate location.	android.permission.ACCESS_COARSE_LOCATION

Reads information about phone network operator.
Uses Crypto APIs (Might try to encrypt user data). 1 IoCs
ransomware

Processes:

com.jr.sxpaokurenzhe

description ioc process

Framework API call javax.crypto.Cipher.doFinal com.jr.sxpaokurenzhe

description	ioc	process
Framework API call	javax.crypto.Cipher.doFinal	com.jr.sxpaokurenzhe

com.jr.sxpaokurenzhe
1⤵
- Uses Crypto APIs (Might try to encrypt user data).
PID:4101

getprop apps.customerservice.device
2⤵
PID:4178

com.jr.sxpaokurenzhe:milipay_sms_v1
1⤵
PID:4217

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

/data/user/0/com.jr.sxpaokurenzhe/files/__local_stat_cache.json
Filesize
25B

MD5
2d805b13f2f28dc3ca9bbcc000f49bb5

SHA1
9eac165b4d81258fd3967cde5cc53b53b1dabcb1

SHA256
c8a6624f390568f0ddcb9841336aec6a564460fdaf6624e562b32935b8956f19

SHA512
5db8c57bab36bcf9db698c1dce70318cbffc156dd1d1c1e09e5b7ba60aff07b598ebbf26c4bd8a2b03bd6e59ef2dde2d944a22a8d8a19ecc8378e83afb7c83b0

Download Submit
/data/user/0/com.jr.sxpaokurenzhe/files/payinfo.info
Filesize
2B

MD5
c2f3f489a00553e7a01d369c103c7251

SHA1
a0509b7780628bd9d9abc7eb8a2163477341053a

SHA256
23794d91c53ae875c8e247d72561e35d9d06ee07c70c9e0dbcc977a6d161504a

SHA512
0f446282a46dfefa3995e9e78443c907aca544aff495badfcb632b9df2457f8491babf852d8ebbe7ecc9392461b559e9e242960f13e624e79dbcfca44a6e5de1

Download Submit
/data/user/0/com.jr.sxpaokurenzhe/shared_prefs/pay_xml.xml
Filesize
119B

MD5
56be6b759e25d6f84fad17cf6f0af4a0

SHA1
769b9b85217158e11ad1ac346537143f3b291384

SHA256
742af9555a7b1c52ff65092c7809add85e5f66dc01b337c7994b10149e9dfcc2

SHA512
591ab4bf27cf5b08b3cd5690e1c290f487d7e787f03c25e120f63aefa53d31de5df7a47ee342db5c2784da71fcdb862ad74eb68416e3fd54da9db5c4217ddf5d

Download Submit
/data/user/0/com.jr.sxpaokurenzhe/shared_prefs/pay_xml.xml
Filesize
119B

MD5
56be6b759e25d6f84fad17cf6f0af4a0

SHA1
769b9b85217158e11ad1ac346537143f3b291384

SHA256
742af9555a7b1c52ff65092c7809add85e5f66dc01b337c7994b10149e9dfcc2

SHA512
591ab4bf27cf5b08b3cd5690e1c290f487d7e787f03c25e120f63aefa53d31de5df7a47ee342db5c2784da71fcdb862ad74eb68416e3fd54da9db5c4217ddf5d

Download Submit
/storage/emulated/0/plugin.apk
Filesize
334KB

MD5
1f0edf0d7a75d030f55c59ee5b813253

SHA1
aae3b917bc8b6b9c76e39293f997f9e4c7802f0f

SHA256
508027860809257287b8cf72cc0764a73598bc9f360237acb3de0e58529f937e

SHA512
83eeaf0b6cb218a7abf53ba3e09a4ad56495c7f8bfb52b723cc32e3785b452e73287297801a20c7cb86cc04852cfe536bccb715c93ab3a2c1652b931060a25d2

Download Submit