Analysis
-
max time kernel
3171977s -
max time network
154s -
platform
android_x86 -
resource
android-x86-arm-20220823-en -
resource tags
androidarch:armarch:x86image:android-x86-arm-20220823-enlocale:en-usos:android-9-x86system -
submitted
27-11-2022 11:26
Static task
static1
Behavioral task
behavioral1
Sample
8b8ff64964045f57dfd28acb57d2676db095479e1fd307ab676eb83fc3bafc0e.apk
Resource
android-x86-arm-20220823-en
Behavioral task
behavioral2
Sample
8b8ff64964045f57dfd28acb57d2676db095479e1fd307ab676eb83fc3bafc0e.apk
Resource
android-x64-arm64-20220823-en
General
-
Target
8b8ff64964045f57dfd28acb57d2676db095479e1fd307ab676eb83fc3bafc0e.apk
-
Size
1.2MB
-
MD5
51db43dbd78b0670196b28a1ea66d8c2
-
SHA1
ea10c6ca0eeb560a3e19af14c8e913273bc813be
-
SHA256
8b8ff64964045f57dfd28acb57d2676db095479e1fd307ab676eb83fc3bafc0e
-
SHA512
0c1230077993127c0d652d0da9a32c4a773ef222592f49474a33bbb3f532b438c86725baedac5ae8aa70b8418889d77b967e57b9ef698286bcb090089299b9ff
-
SSDEEP
24576:oGwAVERDpXhtCUhS0e2NA0z8xx1vFfWrKVR/uFYcNYH+5B21RuxyLApCSXeI34xA:o3AaD/tnc0e2NA0z8ZvFerK3GFYhe5B9
Malware Config
Signatures
-
Requests cell location 1 IoCs
Uses Android APIs to to get current cell location.
Processes:
org.mygson.videoa.zwdescription ioc process Framework service call com.android.internal.telephony.ITelephony.getCellLocation org.mygson.videoa.zw -
Reads information about phone network operator.
-
Uses Crypto APIs (Might try to encrypt user data). 1 IoCs
Processes:
org.mygson.videoa.zwdescription ioc process Framework API call javax.crypto.Cipher.doFinal org.mygson.videoa.zw
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
/data/user/0/org.mygson.videoa.zw/databases/access.dbFilesize
4KB
MD5f2b4b0190b9f384ca885f0c8c9b14700
SHA1934ff2646757b5b6e7f20f6a0aa76c7f995d9361
SHA2560a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514
SHA512ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1
-
/data/user/0/org.mygson.videoa.zw/databases/access.db-journalFilesize
524B
MD5c5779efc5451202a8892564330a409f8
SHA1d0728ccf16ca620d6c48e1c687d475baeb1da160
SHA2567f8e0c422d7e078af584b9e991a042291f88dbc0f7231a51c5696a2defdea4cc
SHA5128a7d6f78e9565c08c77c6ffae4f8143844dff9e0dde0204abe1bd16e487538bcdd82c2d0e4bc554f719b7abd896ee11bc278d40f5d177b3f445a62de575ffdd8
-
/data/user/0/org.mygson.videoa.zw/databases/access.db-shmFilesize
8B
MD57dea362b3fac8e00956a4952a3d4f474
SHA105fe405753166f125559e7c9ac558654f107c7e9
SHA256af5570f5a1810b7af78caf4bc70a660f0df51e42baf91d4de5b2328de0e83dfc
SHA5121b7409ccf0d5a34d3a77eaabfa9fe27427655be9297127ee9522aa1bf4046d4f945983678169cb1a7348edcac47ef0d9e2c924130e5bcc5f0d94937852c42f1b
-
/data/user/0/org.mygson.videoa.zw/databases/access.db-walFilesize
32KB
MD5a427c89c87a833077999a38b4074f0b3
SHA19c9b31679b26f6e6468db5d592ba764260688003
SHA25616a50d06ec0462f003fdede5bd3f27d935b7f61f95082133c77eb3d56c258f63
SHA512e748f18a6a683e02f528ea8b1ef02d61cd9250cb2a91b9d16cc9754aa21a0ab398c619957d9d0f3f545e3226f5054631f25ccd09457647efa668035c47c3ea52
-
/data/user/0/org.mygson.videoa.zw/files/__local_stat_cache.jsonFilesize
25B
MD52d805b13f2f28dc3ca9bbcc000f49bb5
SHA19eac165b4d81258fd3967cde5cc53b53b1dabcb1
SHA256c8a6624f390568f0ddcb9841336aec6a564460fdaf6624e562b32935b8956f19
SHA5125db8c57bab36bcf9db698c1dce70318cbffc156dd1d1c1e09e5b7ba60aff07b598ebbf26c4bd8a2b03bd6e59ef2dde2d944a22a8d8a19ecc8378e83afb7c83b0
-
/storage/emulated/0/backups/.SystemConfig/.cuidFilesize
89B
MD5a43b59808d2d1c025ad057a94020a73e
SHA1a4b690d88407f008bcc476682239a1db2bd66dd9
SHA2566648e132fb26d647352bb00e0d4f7b812876a4568ed6f04f167a61042476370f
SHA512db67013881dec9b776844af9c33598aad7318e473b5cb6e865ff8b079018f4943c7ef3d49b2ab63e4923b8b111528535bb25f4c992402fa0040af6d4c656a514