561228f1174eb951ea8fefab66c2ea16fff7872cabe5fdff7e4c331a7cb1df5a

Analysis

max time kernel
3153745s
max time network
137s
platform
android_x86
resource
android-x86-arm-20220823-en
resource tags

androidarch:armarch:x86image:android-x86-arm-20220823-enlocale:en-usos:android-9-x86system
submitted
27-11-2022 07:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

561228f1174eb951ea8fefab66c2ea16fff7872cabe5fdff7e4c331a7cb1df5a.apk
Size

1.7MB
MD5

06717f5348df0e5e3a879780b40b37ff
SHA1

d7de611c42a9037ae510e2527c288dd485397881
SHA256

561228f1174eb951ea8fefab66c2ea16fff7872cabe5fdff7e4c331a7cb1df5a
SHA512

78d81c3426406ec58392d93c59198c48043b4c38585c28152f7530f4d7dba3045b185b24c370180f1b4b4ce2a6e634e07aee98b5f76bac687019a8a120928de9
SSDEEP

49152:Lkenm3LUd0b5xbpJqw34R6QdRv5kE1/V98aLQYnmsqk:Lkx7NVBiRFbviE3GaLQY6k

Score

7^/10

ransomware

Malware Config

Signatures

Acquires the wake lock. 1 IoCs

Processes:

com.defef.dfhgh

description ioc process

Framework service call android.os.IPowerManager.acquireWakeLock com.defef.dfhgh

description	ioc	process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.defef.dfhgh

Loads dropped Dex/Jar 3 IoCs

Runs executable file dropped to the device during analysis.

Processes:

com.defef.dfhgh/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/storage/emulated/0/Android/data/location/locCache/app/com.defef.dfhgh/v5pl.dex --output-vdex-fd=80 --oat-fd=81 --oat-location=/storage/emulated/0/Android/data/location/locCache/app/com.defef.dfhgh/oat/x86/v5pl.odex --compiler-filter=quicken --class-loader-context=&

ioc	pid	process
/storage/emulated/0/Android/data/location/locCache/app/com.defef.dfhgh/v5pl.dex	4121	com.defef.dfhgh
/storage/emulated/0/Android/data/location/locCache/app/com.defef.dfhgh/v5pl.dex	4231	/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/storage/emulated/0/Android/data/location/locCache/app/com.defef.dfhgh/v5pl.dex --output-vdex-fd=80 --oat-fd=81 --oat-location=/storage/emulated/0/Android/data/location/locCache/app/com.defef.dfhgh/oat/x86/v5pl.odex --compiler-filter=quicken --class-loader-context=&
/storage/emulated/0/Android/data/location/locCache/app/com.defef.dfhgh/v5pl.dex	4121	com.defef.dfhgh

Reads information about phone network operator.
Uses Crypto APIs (Might try to encrypt user data). 1 IoCs
ransomware

Processes:

com.defef.dfhgh

description ioc process

Framework API call javax.crypto.Cipher.doFinal com.defef.dfhgh

description	ioc	process
Framework API call	javax.crypto.Cipher.doFinal	com.defef.dfhgh

com.defef.dfhgh
1⤵
- Acquires the wake lock.
- Loads dropped Dex/Jar
- Uses Crypto APIs (Might try to encrypt user data).
PID:4121

/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/storage/emulated/0/Android/data/location/locCache/app/com.defef.dfhgh/v5pl.dex --output-vdex-fd=80 --oat-fd=81 --oat-location=/storage/emulated/0/Android/data/location/locCache/app/com.defef.dfhgh/oat/x86/v5pl.odex --compiler-filter=quicken --class-loader-context=&
2⤵
- Loads dropped Dex/Jar
PID:4231

/system/bin/sh -c ps
2⤵
PID:4423

ps
2⤵
PID:4423

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.defef.dfhgh/.ulibs/libunicomsdk.so
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/com.defef.dfhgh/databases/baidu
Filesize
4KB

MD5
f2b4b0190b9f384ca885f0c8c9b14700

SHA1
934ff2646757b5b6e7f20f6a0aa76c7f995d9361

SHA256
0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514

SHA512
ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1

Download Submit
/data/user/0/com.defef.dfhgh/databases/baidu-journal
Filesize
524B

MD5
4fd723054995bb272a95a655009986f3

SHA1
4ba519f587ab76c4a51557bc7615761f99e6e543

SHA256
0c28690e587e143ed17cabb44d65400357de9f61a5f7eb99fe3486a98875065c

SHA512
85395131c30a79e1c807ff6aeac501f5ee24f6c94e1b51f587dc86fbc534a89a5edc60fd925ea49ddb2ce1a1a60b96ec5effec59188b5baf75638a676c5857cc

Download Submit
/data/user/0/com.defef.dfhgh/databases/baidu-shm
Filesize
8B

MD5
7dea362b3fac8e00956a4952a3d4f474

SHA1
05fe405753166f125559e7c9ac558654f107c7e9

SHA256
af5570f5a1810b7af78caf4bc70a660f0df51e42baf91d4de5b2328de0e83dfc

SHA512
1b7409ccf0d5a34d3a77eaabfa9fe27427655be9297127ee9522aa1bf4046d4f945983678169cb1a7348edcac47ef0d9e2c924130e5bcc5f0d94937852c42f1b

Download Submit
/data/user/0/com.defef.dfhgh/databases/baidu-wal
Filesize
92KB

MD5
c3fd77dcb1a7a7c50c34d80d993ccd06

SHA1
e7cf8f8cb1aa72dcea4c1e5d18e679175b265476

SHA256
ab79073a2ff3ebd41d94716da1dec3db48f7d56979619e3b0651b19b38e7b24c

SHA512
8a1918d459ec38154988138366f163bd1184805ea220c23304118344ccf0ec2ae63457a5b4dd8734bc7c575c67dd55b654eb878660c82e8d408e43fcc9037843

Download Submit
/data/user/0/com.defef.dfhgh/files/.imprint
Filesize
915B

MD5
1025a19b2283c8f3ba22261264809d09

SHA1
5595a94f19f7bd24831edd0c4085c87fd6cd2ea2

SHA256
1c6e03494d0da24958da2c801545ab0fbb4bc85c1fe8e8393d617febd6ac2c7f

SHA512
4ed3cdfc49520747cb35fcb2cd977e1ced18bf6e5d4f0a9e5151f6cb8ca34be5222242890030b2a5ae75ae72c5a00b6b403bdf2070a51d33c3316ff92b0446cf

Download Submit
/data/user/0/com.defef.dfhgh/files/mobclick_agent_cached_com.defef.dfhgh3
Filesize
1KB

MD5
a5dd0940bca261a0c4ae15b6ef6861a1

SHA1
378df89a92b455f49188773882ddbd1735c4a265

SHA256
a7eedf80fe02a55e8d415cc05ca636ec2d5f2a2f8e77d2f0b28c45670ca8df8b

SHA512
735c6d943b464bf90dc3827e9cf0a11e3fba6e2b53c19450795819fc30e469be673d2e69678656525d7a9eb4eac4561d9240d488cf53ebb57d46c5d720fba5bf

Download Submit
/data/user/0/com.defef.dfhgh/files/umeng_it.cache
Filesize
310B

MD5
2a2505fdc3a89c2ca21d62308a1f6515

SHA1
445c5d99d621a50497948848c828b33a463e3b5b

SHA256
c16ed2e8e23bcebfd3d63a27e41b555caf2abf773332d639359255e2711cec49

SHA512
8b833d1bae6cb9428178582f51f0b6f0bfae2627d30f746934e9330b67378cbfa11bc10abc74e2a29872bb3f00d80abe6b5295f33be9084e3c9a3ed9b1fcc7dd

Download Submit
/data/user/0/com.defef.dfhgh/files/uu_data/8SGi2j11Xi44bWqDzCUmxw==
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/com.defef.dfhgh/files/uu_data/IUzhXZvxBeEWBpe7_sDyGw==
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/com.defef.dfhgh/files/uu_data/TfwdHX6qHv0AkshSW_kmmg==/app_code/com.yt.uu.apk
Filesize
276KB

MD5
88e62d0ed3340c2917ad6058be25b497

SHA1
22f6c414fc0c6dadaf94c9891943fef1a1071de9

SHA256
8c899811d8c6aedfc38333a1b59ec12d55c171dfec4256164e053da43783052a

SHA512
3595461d58809016e26e30119e26b7c2306b9fddc393c3d7501a527fb752c35decf4ec29ae06734d45b2f4148fe9de2e0eed899631cd88eb7d4621e80c542a05

Download Submit
/data/user/0/com.defef.dfhgh/files/uu_data/TfwdHX6qHv0AkshSW_kmmg==/app_code/com.yt.uu.apk.x86.flock
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/com.defef.dfhgh/files/uu_data/TfwdHX6qHv0AkshSW_kmmg==/app_code/oat/x86/com.yt.uu.odex
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/com.defef.dfhgh/files/uu_data/TfwdHX6qHv0AkshSW_kmmg==/app_code/oat/x86/com.yt.uu.vdex
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/com.defef.dfhgh/files/uu_data/V3Ro3erFjOIwZKru947bPA==/data.dat.tmp
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/com.defef.dfhgh/files/uu_data/o_S6HoFxxEqDcmoce0N1vQ==/IvGAmCpxv64bLBwKxzNOZg==
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/com.defef.dfhgh/files/uu_data/o_S6HoFxxEqDcmoce0N1vQ==/fMwBszcpKUCQ_gjZ
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/com.defef.dfhgh/files/uu_data/o_S6HoFxxEqDcmoce0N1vQ==/proxy.apk
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/com.defef.dfhgh/shared_prefs/MvSdkJar.xml
Filesize
129B

MD5
f312b20c7439dac472f022cdf6008581

SHA1
03a4fd1da03e0fe0b23bf2083746c79b431de142

SHA256
e9639cf7762121fc1660a605fe10f6a380961d4b7ad86b0ddb43a481fef169a3

SHA512
67918412d59bfae793045069de8651be908105a2875a9b61c1fcd14cd44073c2bcc5edb317cc59bb4734ca003bbc76e4ccf0974fd77f163f2d52b77e81e3aced

Download Submit
/data/user/0/com.defef.dfhgh/shared_prefs/MvSdkJar.xml
Filesize
185B

MD5
b3e189b273106b2b3c7080092ee9629b

SHA1
eb2a63ca3d37a296feaf7c808cafaf2b3e750a60

SHA256
2e0f3205a41421af1e999ec3ac778bb9f6fa05ed17a77f50104fd2d059fde904

SHA512
d2ea31364329099e7adfca21b8bc5b37abf9c51737cc91c20ba0a414be544f470846dcbf0accbb278739a2901b8015b42c05514ef6cdcfa1b8e2e65def8c54f3

Download Submit
/data/user/0/com.defef.dfhgh/shared_prefs/MvSdkJar.xml
Filesize
230B

MD5
f9ad8112f219fc0091023a2283434fdb

SHA1
17718a2aa36a4e1d8c23df07df3d69a41ba2a644

SHA256
2d6bd55a4e933597c93edace4bc32f4a13e3539bed93774e5f35365200ff705a

SHA512
8c7d8d0c32b243d25c328862730b68604e2b44de7a4672812507f54e6b680cdfeb08bae30555997022d574a8de567502615f0e52bba6ed37f7f90c018e04127f

Download Submit
/data/user/0/com.defef.dfhgh/shared_prefs/SMS_Listen_Manager.xml
Filesize
147B

MD5
9d8f3b0634e3ca1cd7d4b46eda114d9a

SHA1
d3ab9b2b2a96e4777f08936dda9d866035065d04

SHA256
03066e60f9f9ff2ec1da43e2a46a535fc64cd7dfa5761f86373c7ce9e35a19cd

SHA512
4d227069f4318e120446605866e05eb515e9f4d1f7d142bab541c52d5c6050a17a7a72276d34af80d9d14c0bf275ccddb469681f6d52a7229efb3ecb192a049a

Download Submit
/data/user/0/com.defef.dfhgh/shared_prefs/SMS_Listen_Manager.xml
Filesize
178B

MD5
cbed9e4ce3ab9caf275ae10051530bb8

SHA1
311ef07543cfdfed700fc23e2278cd654ae1d4ea

SHA256
fd39d8a933d467664590cbc56745df9d8c6cd814704cf1fc3fcb129b3dfdb02d

SHA512
7b6bcb3e485b0ed6c351f9c39839512f041fbbbdc171b805ccb5b178df5b59fe818b97761c88853b2cc541b3ceca740cb5ad6ba58d65b6e3ecfee5d936e131e1

Download Submit
/storage/emulated/0/Android/data/com.defef.dfhgh/cache/imgbackup/journal.tmp
Filesize
44B

MD5
9d6d58e6136e80d95b7076ef196d40ff

SHA1
8cbe6a846d4468bab26eaf21308fecc0c648b217

SHA256
2d116812987bc0817133f5d03f00065f87f613c2d45b00f799f477741e50631e

SHA512
2455c75cd8ddd258d95a9dc855054d2b5912733c94c9108726e52856a81c2736f89217e6df2a0a540bf368cb737f7f80952b9f91e18c34450a859f94d0ba13c5

Download Submit
/storage/emulated/0/Android/data/location/locCache/app/com.defef.dfhgh/oat/x86/v5pl.odex
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/storage/emulated/0/Android/data/location/locCache/app/com.defef.dfhgh/oat/x86/v5pl.vdex
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/storage/emulated/0/Android/data/location/locCache/app/com.defef.dfhgh/v5pl.dex
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/storage/emulated/0/Android/data/location/locCache/app/com.defef.dfhgh/v5pl.dex
Filesize
223KB

MD5
2f5a0831182b3b89d59150c5b5c647e1

SHA1
783377889a70d20b74b31365f968b7a0403a049e

SHA256
ce1a23d24c6b5a21506b2597a6430f493b3c97c75c12fba6764154aaf782e612

SHA512
d5c87c9627542f561ce6efeb623c747414a8dfdeb5fd0b2e5da1fb5a29a6e912c9e62fb9d9fd24e5b32d781b423cdcd1e1a3e5d627b7080661c4776469042c40

Download Submit
/storage/emulated/0/Android/data/location/locCache/app/com.defef.dfhgh/v5pl.dex
Filesize
223KB

MD5
b8147c52acafe1706be66e9d5515fbfe

SHA1
5227fd6ddc358a02588862982358d71ad6372b80

SHA256
3b722ec026c3048abf02bb5aedf43d5bdca0e0c1c2ddf7a232ca0fa561ce75c0

SHA512
82a167adbd887184149eec8a8252b8d145b6606c22895441251b33f5e80ab11387ebdb797295a931b4a8296737b9ad34abe88603e1313925082dc39c02444d96

Download Submit
/storage/emulated/0/Android/data/location/locCache/app/com.defef.dfhgh/v5pl.dex
Filesize
223KB

MD5
2f5a0831182b3b89d59150c5b5c647e1

SHA1
783377889a70d20b74b31365f968b7a0403a049e

SHA256
ce1a23d24c6b5a21506b2597a6430f493b3c97c75c12fba6764154aaf782e612

SHA512
d5c87c9627542f561ce6efeb623c747414a8dfdeb5fd0b2e5da1fb5a29a6e912c9e62fb9d9fd24e5b32d781b423cdcd1e1a3e5d627b7080661c4776469042c40

Download Submit
/storage/emulated/0/Android/data/location/locCache/app/com.defef.dfhgh/v5pl.dex.x86.flock
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit