013e055f0ec914af467c43adb767635890b9d18dc6b03bd5c48cc094de3255b8

Analysis

max time kernel
3094643s
max time network
14s
platform
android_x86
resource
android-x86-arm-20220823-en
resource tags

androidarch:armarch:x86image:android-x86-arm-20220823-enlocale:en-usos:android-9-x86system
submitted
27-11-2022 10:38

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

013e055f0ec914af467c43adb767635890b9d18dc6b03bd5c48cc094de3255b8.apk
Size

2.0MB
MD5

0d135cb286e9cd608263b7ec5ed84139
SHA1

e9ff24f575246518e35a9ae318fbba3f0628d647
SHA256

013e055f0ec914af467c43adb767635890b9d18dc6b03bd5c48cc094de3255b8
SHA512

a32cc25700733e6be52cf42357c0c0bb5bb385d87297c8d993e80501cd3e09c0b86d33decc1c9c7b342944ac94a47d03be851a393cf96d23ce376a992ce44773
SSDEEP

49152:WktsacUhmPGQhWNAavHXFUxSwCWZDTEeYRRYXxn:W6sMhuGQhWuav3FUxnCqTEeYRRYXxn

Score

7^/10

ransomware

Malware Config

Signatures

Loads dropped Dex/Jar 4 IoCs

Runs executable file dropped to the device during analysis.

Processes:

/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/storage/emulated/0/Android/data/com.skymobi.pay.app/plugins/com.skymobi.pay.opplugin_v2021.apk --output-vdex-fd=48 --oat-fd=49 --oat-location=/storage/emulated/0/Android/data/com.skymobi.pay.app/plugins/oat/x86/com.skymobi.pay.opplugin_v2021.odex --compiler-filter=quicken --class-loader-context=&com.sffa.medi/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.sffa.medi/files/com.skymobi.appui.sole_v1001.apk --output-vdex-fd=51 --oat-fd=52 --oat-location=/data/user/0/com.sffa.medi/files/oat/x86/com.skymobi.appui.sole_v1001.odex --compiler-filter=quicken --class-loader-context=&

ioc	pid	process
/storage/emulated/0/Android/data/com.skymobi.pay.app/plugins/com.skymobi.pay.opplugin_v2021.apk	4167	/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/storage/emulated/0/Android/data/com.skymobi.pay.app/plugins/com.skymobi.pay.opplugin_v2021.apk --output-vdex-fd=48 --oat-fd=49 --oat-location=/storage/emulated/0/Android/data/com.skymobi.pay.app/plugins/oat/x86/com.skymobi.pay.opplugin_v2021.odex --compiler-filter=quicken --class-loader-context=&
/storage/emulated/0/Android/data/com.skymobi.pay.app/plugins/com.skymobi.pay.opplugin_v2021.apk	4068	com.sffa.medi
/data/user/0/com.sffa.medi/files/com.skymobi.appui.sole_v1001.apk	4213	/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.sffa.medi/files/com.skymobi.appui.sole_v1001.apk --output-vdex-fd=51 --oat-fd=52 --oat-location=/data/user/0/com.sffa.medi/files/oat/x86/com.skymobi.appui.sole_v1001.odex --compiler-filter=quicken --class-loader-context=&
/data/user/0/com.sffa.medi/files/com.skymobi.appui.sole_v1001.apk	4068	com.sffa.medi

Uses Crypto APIs (Might try to encrypt user data). 1 IoCs
ransomware

Processes:

com.sffa.medi

description ioc process

Framework API call javax.crypto.Cipher.doFinal com.sffa.medi

description	ioc	process
Framework API call	javax.crypto.Cipher.doFinal	com.sffa.medi

com.sffa.medi
1⤵
- Loads dropped Dex/Jar
- Uses Crypto APIs (Might try to encrypt user data).
PID:4068

/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/storage/emulated/0/Android/data/com.skymobi.pay.app/plugins/com.skymobi.pay.opplugin_v2021.apk --output-vdex-fd=48 --oat-fd=49 --oat-location=/storage/emulated/0/Android/data/com.skymobi.pay.app/plugins/oat/x86/com.skymobi.pay.opplugin_v2021.odex --compiler-filter=quicken --class-loader-context=&
2⤵
- Loads dropped Dex/Jar
PID:4167

/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.sffa.medi/files/com.skymobi.appui.sole_v1001.apk --output-vdex-fd=51 --oat-fd=52 --oat-location=/data/user/0/com.sffa.medi/files/oat/x86/com.skymobi.appui.sole_v1001.odex --compiler-filter=quicken --class-loader-context=&
2⤵
- Loads dropped Dex/Jar
PID:4213

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

/data/user/0/com.sffa.medi/databases/app_download_record
Filesize
4KB

MD5
f2b4b0190b9f384ca885f0c8c9b14700

SHA1
934ff2646757b5b6e7f20f6a0aa76c7f995d9361

SHA256
0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514

SHA512
ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1

Download Submit
/data/user/0/com.sffa.medi/databases/app_download_record-journal
Filesize
524B

MD5
45c6281c836b1168b719569eadef62b2

SHA1
89bd6078bef779d8fe1e9e46dcaefafbfacf62e6

SHA256
e96cc371d743d6d2d4637d41635a525d051c05b65134ffafb0bcb8191c328c22

SHA512
d29043667673c41385273e7b47cff38d83c34efc99e9d8c831b12779d9cd889cfab4ed503c2a3d14cd1a8a0876d2b11828fa9d53979983dc8e2008d163dd8d6b

Download Submit
/data/user/0/com.sffa.medi/databases/app_download_record-shm
Filesize
8B

MD5
7dea362b3fac8e00956a4952a3d4f474

SHA1
05fe405753166f125559e7c9ac558654f107c7e9

SHA256
af5570f5a1810b7af78caf4bc70a660f0df51e42baf91d4de5b2328de0e83dfc

SHA512
1b7409ccf0d5a34d3a77eaabfa9fe27427655be9297127ee9522aa1bf4046d4f945983678169cb1a7348edcac47ef0d9e2c924130e5bcc5f0d94937852c42f1b

Download Submit
/data/user/0/com.sffa.medi/databases/app_download_record-wal
Filesize
44KB

MD5
653cdd7b36b14011c7527f65f6290736

SHA1
3f289c98a1ea8b34a022baf420bce66652d32ec3

SHA256
f75c91bd8db2cd6b04dd1081aedb80708f60b5e40990dd8a1dbb67e5142516bb

SHA512
ab0f5e06e3ea1b393a649b4043a905f0c6dfd1f83ae454f7d1c3c541060e7354984ee8c423a904a5c9f386221ff95b730140a2fb513ae58960787c32e1ee7f42

Download Submit
/data/user/0/com.sffa.medi/databases/sy_pay_record
Filesize
40KB

MD5
f33e40dc44dddf9886c560576fe30a70

SHA1
58df836a00a47eba37ba479a7aee95bcf404b2b5

SHA256
4438043ecb3f2ce4c482f5312042c439437aeb896181069dd6e8966f40bd3de2

SHA512
af1162e2b3802bbc9e4bfc43bfd1258bb40b49a601e361076c58f7dbc8f7e8b5d4e3003183dffba1c00810ac34a59fa595d8908ef9b2652578522b8c014327d9

Download Submit
/data/user/0/com.sffa.medi/databases/sy_pay_record-journal
Filesize
524B

MD5
cc9c34ba6007892ad7a9e2a2fac6a088

SHA1
405c5ad786b443d42d30be35e9fa9e2abfb8363d

SHA256
17003082261b9104abe65e58d9c29bdd8a48122b0cd9944c6a8eb3536c3f479b

SHA512
f16b1b5057e9c9118e483d1ab2397ad15687c7ad7899caa35c48601bda71248115140b28b8c3527bbe73a9c3b6ba36463af59fb24035e947fbec99b9b8d2dc86

Download Submit
/data/user/0/com.sffa.medi/databases/sy_pay_record-shm
Filesize
8B

MD5
7dea362b3fac8e00956a4952a3d4f474

SHA1
05fe405753166f125559e7c9ac558654f107c7e9

SHA256
af5570f5a1810b7af78caf4bc70a660f0df51e42baf91d4de5b2328de0e83dfc

SHA512
1b7409ccf0d5a34d3a77eaabfa9fe27427655be9297127ee9522aa1bf4046d4f945983678169cb1a7348edcac47ef0d9e2c924130e5bcc5f0d94937852c42f1b

Download Submit
/data/user/0/com.sffa.medi/databases/sy_pay_record-wal
Filesize
48KB

MD5
10ca8e00eb2cb32de5b8bd60298ed99b

SHA1
0bf574b271faaf7492e36817a1f758a25c0d6bf7

SHA256
07171c3cf9aa04885f7994d343184b76fff0153d6b51a8f25f3cb8002353d7d5

SHA512
6064a0b4e3c51d992dfc563a8998ef47b60d8790e653c742f7fcea5219813743c6045478a8871d87a23f6bd125f1c8719f79e6bf3c4247f43be7e8f17a22b0ac

Download Submit
/data/user/0/com.sffa.medi/databases/video_record
Filesize
100KB

MD5
38853230b4b72f8fd89f8b6864d0d2d4

SHA1
c9420e3f4f4e7d1cd57662e72298e3fb3b70e1c2

SHA256
aa21d95a82ce47248e0951e384844a61181b79db379f56b37c4a36b47be1c10e

SHA512
d4c514a006413ce1a596368863ed9f260199570ce86fbf2651776dfa7fadbbf86df9bd9f15eb2a4ec90d89b136ad25dc1432440ad33ad31ad4608eb3816d70fb

Download Submit
/data/user/0/com.sffa.medi/databases/video_record-journal
Filesize
524B

MD5
1ae7b9a8c5f98c7b7bbabe5376e1cb14

SHA1
82c9adcfee61c1b0a20283d7d0e6a49e65b72446

SHA256
65b2816e2e26cdfeaf747b8a12da96c8efd4a1cbbb2de2455f119ab2cb254b94

SHA512
f75c540b67ade9f3ee74dab423981c9842414b56c065ef27ba49c05f9662ac018e7326f46d2a7524210d8992c4e62cecd65da5117e3730816cf8fba41835e2f1

Download Submit
/data/user/0/com.sffa.medi/databases/video_record-shm
Filesize
8B

MD5
7dea362b3fac8e00956a4952a3d4f474

SHA1
05fe405753166f125559e7c9ac558654f107c7e9

SHA256
af5570f5a1810b7af78caf4bc70a660f0df51e42baf91d4de5b2328de0e83dfc

SHA512
1b7409ccf0d5a34d3a77eaabfa9fe27427655be9297127ee9522aa1bf4046d4f945983678169cb1a7348edcac47ef0d9e2c924130e5bcc5f0d94937852c42f1b

Download Submit
/data/user/0/com.sffa.medi/databases/video_record-wal
Filesize
108KB

MD5
bcb48b75975e1492a89875453368230a

SHA1
ff12bbe43fb69ce5d73c31e16610eeb4240c22e7

SHA256
6d3ef9ace602f25ff4aa85e3032718891daa6f7c45d423ee5695cc5c7db3ea22

SHA512
16fc5bc0e4565f450a16fc4e24e4c9272652a81afea3439af10c753c599b4390ae84b2204bd0f0b6d88bc80b424d9c79058fa6723d0a5bfde706fb73dd97827d

Download Submit
/data/user/0/com.sffa.medi/files/classes.dex
Filesize
1.1MB

MD5
1132edc283927210f144ec598214f590

SHA1
1a8ba6b1556586cb08c057ecb541fc81e985ab9c

SHA256
ac02633dabe22e820234f20b974a8af1c821fa677753c4c963d0bb3efd3f54d4

SHA512
4b9fa70e9487cd31a2d9b21d8280b2175cb70d08aeb1460b7dec044c4eb1088520b915c7665203dcd8078c9598ba09fd91f14c31cc4814444b84319c0f3a97b1

Download Submit
/data/user/0/com.sffa.medi/files/com.skymobi.appui.sole_v1001.apk
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/com.sffa.medi/files/com.skymobi.appui.sole_v1001.apk
Filesize
23KB

MD5
c329bcce93cf3229392695a38ffcb0d0

SHA1
cd186442a4767ab28d52c994a383648ccd4898b1

SHA256
96648d662a616132e65ea2761b6cc6bf3f508f51790d388c0614353951df72e7

SHA512
83d07fae5d4419b59b63fd87193a1762f408e3253c2640dd5c392bd55474c1606b68a6144c9c7210685fc0a7fd5f9efb3f88378fb48fcd35f26b7ff61e6c10bb

Download Submit
/data/user/0/com.sffa.medi/files/com.skymobi.appui.sole_v1001.apk
Filesize
23KB

MD5
808542f3b4ca8d93a41baeb198103190

SHA1
fa212bdc8a3290bdcf04c273a9e412e4cb0b5a7d

SHA256
0859f7cc94dc14b6a2cf53b6aa1c3a0e4fcecb8295ca50532cecc5dfe6f45b24

SHA512
2160b916435b96c0dcb0056a23a8d397382e7b9e60f9b81fe9cc7cc7629d2d71bd96fabb127a8c871dede5cbefe9a5e40ed550c52d799cd6ac93f20fb379aeab

Download Submit
/data/user/0/com.sffa.medi/files/com.skymobi.appui.sole_v1001.apk.x86.flock
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/com.sffa.medi/files/oat/com.skymobi.appui.sole_v1001.apk.cur.prof
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/com.sffa.medi/files/oat/x86/com.skymobi.appui.sole_v1001.odex
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/com.sffa.medi/files/oat/x86/com.skymobi.appui.sole_v1001.vdex
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/com.sffa.medi/shared_prefs/APP_START_TIMER_INFO.xml
Filesize
117B

MD5
5dc5c99879d4cad22a3e6fabad05f42f

SHA1
4c4e2c33f4acfd52212a36c48fd0ecd99eb52ff9

SHA256
69b762de62aea1b06065a3ace0c6fd95ad4d8880a4dfdfecb56a64ef662d6b3e

SHA512
16fddbadc013888a99f05b2e5f4f037126785a2387b09dff0c189ec74703889fb91f884c0a2605beb532a7449e3699b9378d3867162f107f8865d0b7e5cb9a59

Download Submit
/storage/emulated/0/Android/data/com.skymobi.pay.app/plugins/com.skymobi.pay.opplugin_v2021.apk
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/storage/emulated/0/Android/data/com.skymobi.pay.app/plugins/com.skymobi.pay.opplugin_v2021.apk
Filesize
386KB

MD5
4a1fb248e672d39457f2cf9088c17880

SHA1
b500b2528ed6cee5929603b862b14a18655ac06d

SHA256
b2831dae43d2dc8daffc919456c244b17f15f5453dca097d665979e7254f8c23

SHA512
b434ee9348e7e2717b35c4f64bc71aa58aca634741045b91ec61eea5bdb536ece7449fe8d376f724bb0006cd2bc7976c9695bc3aa47a59a26ab6c6c09096279e

Download Submit
/storage/emulated/0/Android/data/com.skymobi.pay.app/plugins/com.skymobi.pay.opplugin_v2021.apk
Filesize
386KB

MD5
4a1fb248e672d39457f2cf9088c17880

SHA1
b500b2528ed6cee5929603b862b14a18655ac06d

SHA256
b2831dae43d2dc8daffc919456c244b17f15f5453dca097d665979e7254f8c23

SHA512
b434ee9348e7e2717b35c4f64bc71aa58aca634741045b91ec61eea5bdb536ece7449fe8d376f724bb0006cd2bc7976c9695bc3aa47a59a26ab6c6c09096279e

Download Submit
/storage/emulated/0/Android/data/com.skymobi.pay.app/plugins/com.skymobi.pay.opplugin_v2021.apk.x86.flock
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/storage/emulated/0/Android/data/com.skymobi.pay.app/plugins/oat/x86/com.skymobi.pay.opplugin_v2021.odex
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/storage/emulated/0/Android/data/com.skymobi.pay.app/plugins/oat/x86/com.skymobi.pay.opplugin_v2021.vdex
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit