3a4fb283eaae60ad37c6d6bbcb78a357868d9a59c251ecda20e8e693ac1291e7

Analysis

max time kernel
3193934s
max time network
156s
platform
android_x86
resource
android-x86-arm-20220823-en
resource tags

androidarch:armarch:x86image:android-x86-arm-20220823-enlocale:en-usos:android-9-x86system
submitted
27/11/2022, 16:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3a4fb283eaae60ad37c6d6bbcb78a357868d9a59c251ecda20e8e693ac1291e7.apk
Size

1.5MB
MD5

14aada83df31f01c17fc57c153df2adb
SHA1

f878bd665fe580f61f673322fa78a7b5eb507f4c
SHA256

3a4fb283eaae60ad37c6d6bbcb78a357868d9a59c251ecda20e8e693ac1291e7
SHA512

2cb39ab36d52e9637a3223d4e6ed3830a59391fa66a99eb1e2dd9a6f21ede8c10e9b5f80563536acd106f9b3be0cfa463133aa06d383d279f8890a0a163d1d2a
SSDEEP

24576:y8JyY06ECJwYOSOt3CfnCvzWqQgNnanYUyMNkLGx/BU5ybLzMHHdl8HTBNwwDQME:yHiwYOSOgnCvzGgAYUy6kLGx/BU56Lzu

Score

8^/10

evasion

Malware Config

Signatures

Requests cell location 1 IoCs

Uses Android APIs to to get current cell location.

description	ioc	Process
Framework service call	com.android.internal.telephony.ITelephony.getCellLocation	com.glrd.lxss.ljdp

Loads dropped Dex/Jar 2 IoCs

Runs executable file dropped to the device during analysis.

ioc	pid	Process
/data/user/0/com.glrd.lxss.ljdp/files/wljdp.jar	4535	/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.glrd.lxss.ljdp/files/wljdp.jar --output-vdex-fd=95 --oat-fd=96 --oat-location=/data/user/0/com.glrd.lxss.ljdp/files/oat/x86/wljdp.odex --compiler-filter=quicken --class-loader-context=&
/data/user/0/com.glrd.lxss.ljdp/files/wljdp.jar	4105	com.glrd.lxss.ljdp

Reads information about phone network operator.

Removes a system notification. 1 IoCs

evasion

description	ioc	Process
Framework service call	android.app.INotificationManager.cancelNotificationWithTag	com.glrd.lxss.ljdp

com.glrd.lxss.ljdp
1⤵
- Requests cell location
- Loads dropped Dex/Jar
- Removes a system notification.
PID:4105
- /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.glrd.lxss.ljdp/files/wljdp.jar --output-vdex-fd=95 --oat-fd=96 --oat-location=/data/user/0/com.glrd.lxss.ljdp/files/oat/x86/wljdp.odex --compiler-filter=quicken --class-loader-context=&
  2⤵
  - Loads dropped Dex/Jar
  PID:4535

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

/data/user/0/com.glrd.lxss.ljdp/app_webview/Web Data

Filesize
104KB

MD5
dc79f9ce5f3ab5270b33e61119dfc959

SHA1
1844bf222a5144b513dcf2fb50a18c011701c647

SHA256
47e65f4de08deabfd52ecdb8b0a29c61c482188b92c36182e2112ca0a8f4ff65

SHA512
18b8894a7f35df516f423bbdebf1e05ce09eaf4345b139e59e603cadb81f8d1fa20f793438c28e8fd9a64e64f0684223d90ce6f10d3f93cb0c781049a8cff03e

Download Submit
/data/user/0/com.glrd.lxss.ljdp/app_webview/Web Data-journal

Filesize
1KB

MD5
bb46ac4bf06e39b0c4dd8a8ccb5f3b7a

SHA1
baa1e1a43734e63b7a138c9a4136ff6a64fd5ed5

SHA256
cca37a9794732cea004ad7fabab3a24d5241223cc0885600ae1bfb05ace54733

SHA512
9fcc41c811f12fc535ad9061793e36d70ee50dc8202a2e6674c2dc7a0c58b525b7fa7f372c6b3d07cd13cd3c6cb3253d13e24e03740ffb1536776360a8bb76b1

Download Submit
/data/user/0/com.glrd.lxss.ljdp/app_webview/metrics_guid

Filesize
36B

MD5
1767e34ddfd3dbf668c7f74a35ffc8d9

SHA1
3dfa54245b7deb2187a27d7da078a93beba892e5

SHA256
feb252e2d276bc3d61dc5d137954a87fb0f221583f0f328486cfbbebad5e6051

SHA512
f08d372cb0380d2316f2e37ff141dda472d22f000d5fa2c874844e51571ca3ed6669b0b9ca864da4a567b3c797303b0ea0e4fe02edf14fb9ad364b2f305a4a59

Download Submit
/data/user/0/com.glrd.lxss.ljdp/files/wljdp.jar

Filesize
442KB

MD5
87a5452fa4d3ffe09955c59620c4de6d

SHA1
aa06113e92b75b8f1efe4e3cd12c459e814854ee

SHA256
e9114883f7e1a5be447795e923824063db57585033e8b0ffb109f8a6155b5658

SHA512
37aa85ce4951732ffe7552e53b18601b5f6f4b9d05fba0381fa5cce1af2b8a5866e5518e298e8d57dd4b2a645a8ad0f3d66f951688f2900f633a05b1b7542a1c

Download Submit
/data/user/0/com.glrd.lxss.ljdp/files/wljdp.jar

Filesize
442KB

MD5
e15339369d3cef17ec578fd788fd0dab

SHA1
1158169054b6875af7daab81c860b22b5fb1990e

SHA256
ef15eb76eeeb9f39f5357f8416f2dd7fe89808253d2657987c2273937d72a4de

SHA512
99dd24844eb8437d0af9419c3e05b5fc5dcada8de5e79c400361267fd8b32f4b6d679a09fb9b02b1c4510af91c3cb4069e344c661239e687dffa6d25fb58c756

Download Submit
/data/user/0/com.glrd.lxss.ljdp/shared_prefs/WebViewChromiumPrefs.xml

Filesize
127B

MD5
21223e9184445fe043476484cd8cb1f9

SHA1
2b4813f849121d60ba35eb0889080668bb62c778

SHA256
bb61b7c087c2ae2de93a7740ff75707342940557146366e92b840284cd9446af

SHA512
be21408de0cc643650e5d9ab9057a8f9de88e37fbdc6417cfeba160402ec4cd14fccbc82cbbfd941ecfc0bb3d4056ee61ac199efdc99d647d53e65818835fd48

Download Submit
/data/user/0/com.glrd.lxss.ljdp/shared_prefs/jifei_like.xml

Filesize
108B

MD5
38d2ea215307376870aef6e8f7821ede

SHA1
d67577bcbaafe10dcb27491595866e3f3c65b469

SHA256
2267d8d3ce5f6d9b263d2cb355c5080ebb114f2956a0920b1747e6a13dcbc4d5

SHA512
07107d04d482ee6240f89e46cdbfb68f967b2e5d3a8a1ec3e86b7fdd079c3178359d95e1ff4ee613f02dc9aeb755619b80ba099df3ed3fcf96a548c35037b0d0

Download Submit
/data/user/0/com.glrd.lxss.ljdp/shared_prefs/yunchao_sp.xml

Filesize
126B

MD5
5857a6045b4f36bb01d42c463757f729

SHA1
28bc1fdb8f16d0354156d75e30d8d721195871c2

SHA256
cfee5d010b856d006d44a8f8782f4e03d5e4100ddc9b3b218771507589b6442b

SHA512
16a6b143615088f51bb070cd800260ba85429111ff93bfa446e8f0fbbc6ea52e03119216c9f4ff57bf976a40bb5567166b3747bfdfc6252837ad49a931b2f2c6

Download Submit
/data/user/0/com.glrd.lxss.ljdp/shared_prefs/yunchao_sp.xml

Filesize
168B

MD5
199ea55a0cf5950b3df92598b46311ee

SHA1
b2d6ce214b763857efe1ac1311e04c8374ce2392

SHA256
ff0ddefc3626e6562b024690ed15728dfc4faa42b7c2b410acfbfd5ed7eb1977

SHA512
ae3728e84cd43597c48323ae2d3204b59f0d6f1e7ab30fef3e61d3c2ca2adae66daf0b5867b4b39b14169b68b654aa586355c6ab86dbc024a6cb1391353c1e27

Download Submit
/data/user/0/com.glrd.lxss.ljdp/shared_prefs/yunchao_sp.xml

Filesize
231B

MD5
fa8f8722b87e4748fbec05e2676d1176

SHA1
998a5082ec45110c41fd37bc37ffcddf07bfb966

SHA256
5324d2ed0ce49039bbccaabf42e199d2129ce0bc3b27bb52a8e8085e6a71df9f

SHA512
f5e910506070f39b2ed68b2c5062c9a96f530d725e00848fd2fc4b7b5ad9778527a627138d5c113fe53cdd1cb88a320611750f1ba3953996bfa3d6cf559928af

Download Submit