602a5cef9cdcf610e95e326f5063214598f2cb83c1c47e7e85cabf2e595025c5

Analysis

max time kernel
3152499s
max time network
147s
platform
android_x86
resource
android-x86-arm-20220823-en
resource tags

androidarch:armarch:x86image:android-x86-arm-20220823-enlocale:en-usos:android-9-x86system
submitted
27-11-2022 07:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

602a5cef9cdcf610e95e326f5063214598f2cb83c1c47e7e85cabf2e595025c5.apk
Size

1.8MB
MD5

4ea92431fad94dbd3958c5d59a68b407
SHA1

ffb3aadbbaf33232c0ad388c0d536248bf9f58f2
SHA256

602a5cef9cdcf610e95e326f5063214598f2cb83c1c47e7e85cabf2e595025c5
SHA512

fe1e70934efec840074f360480443ac2274a9fa132eb312490a1f7a37cfebbc58ae4df82fb1597f2de0bacba52b05d332651c8daa78d862f603549bc7f3dee4a
SSDEEP

49152:SqWZ0xbeukqtvMyAS+Q6Qa0K90Zw0iNquIPdaq1rfY:waWQa0dU5IPdaq1jY

Score

7^/10

ransomware

Malware Config

Signatures

Acquires the wake lock. 1 IoCs

Processes:

com.android.kbbs

description ioc process

Framework service call android.os.IPowerManager.acquireWakeLock com.android.kbbs
Uses Crypto APIs (Might try to encrypt user data). 1 IoCs
ransomware

Processes:

com.android.kbbs

description ioc process

Framework API call javax.crypto.Cipher.doFinal com.android.kbbs

description	ioc	process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.android.kbbs

description	ioc	process
Framework API call	javax.crypto.Cipher.doFinal	com.android.kbbs

com.android.kbbs
1⤵
- Acquires the wake lock.
- Uses Crypto APIs (Might try to encrypt user data).
PID:4028

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

/data/user/0/com.android.kbbs/databases/cn.cq.yz
Filesize
32KB

MD5
2126e5a70fb48e951bc40d707436cfae

SHA1
04d71d4988756e38a0ea6b0f4dad6896917038d5

SHA256
6b6c580bbe167dfaf7e26e6e062ec46286a4874ed816d59bf4bf79b07f29ffef

SHA512
38d24329e7ba27bd0c9597207213de716989663e405a21be61f2c4254e4db9b1dfef30017357171710f00f2d25f81cca2c5f3546a132b448faf45e51cc87da7d

Download Submit
/data/user/0/com.android.kbbs/databases/cn.cq.yz-journal
Filesize
524B

MD5
75d5b5da22ae6d6f44f65e7ccb16da77

SHA1
c2741f8310792d22124c9b21a48ac5022cdf62a0

SHA256
d1a07711fb1a402a5378016f42fc40492fe97a811ea15e9a8ce495432ddca838

SHA512
fc95ddca5b884cca34be22d11c0f79c6a110802b8ee668eea44d001c1eb7a2122a4057368e4661a4705080c422c4359dde3df05d5bcc107aea9a6b44fa7ef016

Download Submit
/data/user/0/com.android.kbbs/databases/cn.cq.yz-shm
Filesize
8B

MD5
7dea362b3fac8e00956a4952a3d4f474

SHA1
05fe405753166f125559e7c9ac558654f107c7e9

SHA256
af5570f5a1810b7af78caf4bc70a660f0df51e42baf91d4de5b2328de0e83dfc

SHA512
1b7409ccf0d5a34d3a77eaabfa9fe27427655be9297127ee9522aa1bf4046d4f945983678169cb1a7348edcac47ef0d9e2c924130e5bcc5f0d94937852c42f1b

Download Submit
/data/user/0/com.android.kbbs/databases/cn.cq.yz-wal
Filesize
40KB

MD5
40d9ce775b4b5f78397f797b6ae154ed

SHA1
0c231518fb10e0c04ca7233c9b0654af5e23b9b3

SHA256
c967e758b75b0d47dfe3e11123ea0afb7dc632208c76746ea68e2d4a72cbd479

SHA512
46fbf6895cda4d45d99c91a071b27018d379ccd5bc44368d35b215caa41f58be40d03d19c810754d0f60208523829f618567dbd42c12e96e66d34585e4f95269

Download Submit
/storage/emulated/0/Download/P.apk
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/storage/emulated/0/Download/P.apk
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads