Overview

overview

10

Static

static

7

ElMubashir...s).apk

android-9-x86

10

ElMubashir...s).apk

android-11-x64

10

Analysis

  • max time kernel
    2658741s
  • max time network
    156s
  • platform
    android_x64
  • resource
    android-x64-arm64-20220823-en
  • resource tags

    androidarch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20220823-enlocale:en-usos:android-11-x64system
  • submitted
    11/01/2023, 01:34

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    ElMubashir(IPTV)(v6.5.1)(ADFree)(Modded By Hifi2007Reviews).apk
  • Size 11.8MB
  • Sample230111-bzdvfaab87
  • SHA256 c7ec9aa69819d69a495dda6244c1dc0714a0fecb16864552ae6577f32db36d48
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
agent_smithadwareransomware

Malware Config

Signatures

  • Agent smith

    Agent smith is a modular adware that installs malicious ADs into legitimate applications.

    adwareagent_smith
  • Requests cell location 1 IoCs

    Uses Android APIs to to get current cell location.

  • Checks known Qemu files. 1 IoCs

    Checks for known Qemu files that exist on Android virtual device images.

  • Checks known Qemu pipes. 2 IoCs

    Checks for known pipes used by the Android emulator to communicate with the host.

  • Loads dropped Dex/Jar 2 IoCs

    Runs executable file dropped to the device during analysis.

  • Queries the unique device ID (IMEI, MEID, IMSI).
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Reads information about phone network operator.
  • Uses Crypto APIs (Might try to encrypt user data). 1 IoCs
    ransomware

Processes

  • com.uv.droid.launcher.bluetv
    1⤵
    • Requests cell location
    • Checks known Qemu files.
    • Checks known Qemu pipes.
    • Loads dropped Dex/Jar
    • Uses Crypto APIs (Might try to encrypt user data).
    PID:4522
    • ls /sys/class/thermal
      2⤵
        PID:4657
      • sh -c ps -ef
        2⤵
          PID:5208
        • ps -ef
          2⤵
            PID:5208

        Network

              MITRE ATT&CK Matrix

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              ua.db
              • Path /data/data/com.uv.droid.launcher.bluetv/databases/.ua/ua.db
              • Size 128KB
              • SHA256 9d876ed71abb411a72e1d8cb7d7f0e45a98ef7168b4f7e3901184b92e4a8b22a
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              ua.db-journal
              • Path /data/data/com.uv.droid.launcher.bluetv/databases/.ua/ua.db-journal
              • Size 1KB
              • SHA256 2051727e1d6e61e82d3e9417152caf8ee61a4851c37f183c5cbb7888588dc6e1
              • MD5 SHA1 SHA512
              Submit Download

              cc.db
              • Path /data/data/com.uv.droid.launcher.bluetv/databases/cc/cc.db
              • Size 104KB
              • SHA256 fb6a176599113247beb55bdb421bea79271596093cececf5f782bec51ba40884
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              cc.db-journal
              • Path /data/data/com.uv.droid.launcher.bluetv/databases/cc/cc.db-journal
              • Size 1KB
              • SHA256 c87ecd16e00ea04bed8d3d2774dd5696b75e1087cfcb2def158a45ddab61d81b
              • MD5 SHA1 SHA512
              Submit Download

              classes.dex
              • Path /data/user/0/com.uv.droid.launcher.bluetv/.jiagu/classes.dex
              • Size 5.8MB
              • SHA256 82966b4fbc900656e0d05a0eebad3cc7b5af9b444b3fa72e0b5c6cf0735002b5
              • MD5 SHA1 SHA512 SSDEEP
              Download

              classes.dex!classes2.dex
              • Path /data/user/0/com.uv.droid.launcher.bluetv/.jiagu/classes.dex!classes2.dex
              • Size 4.2MB
              • SHA256 d4f2c281050d28345c11149ea337eca95644e21359bad88546a72dd36d141454
              • MD5 SHA1 SHA512 SSDEEP
              Download

              libjiagu.so
              • Path /data/user/0/com.uv.droid.launcher.bluetv/.jiagu/libjiagu.so
              • Size 487KB
              • SHA256 baa349e9b5a47be21b6ea00ef2e0c0c5dc203c0e4c391dac46df07ca9d333217
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              libjiagu_64.so
              • Path /data/user/0/com.uv.droid.launcher.bluetv/.jiagu/libjiagu_64.so
              • Size 525KB
              • SHA256 dc9d0faf8652513f0a1eed698b9559e0bbfaefe12c203d239f551ff557abbe5a
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              1004
              • Path /data/user/0/com.uv.droid.launcher.bluetv/app_crashrecord/1004
              • Size 237B
              • SHA256 16420572f4cf07bb6232ad84b11a4a1a9413eb68a26dcffe670f22c648230772
              • MD5 SHA1 SHA512
              Submit Download

              appstore-db
              • Path /data/user/0/com.uv.droid.launcher.bluetv/databases/appstore-db
              • Size 104KB
              • SHA256 3fb03e4d1a813149d56e679e2d34dff4a40199a2d2d8e473a9b6536f711155b4
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              appstore-db-journal
              • Path /data/user/0/com.uv.droid.launcher.bluetv/databases/appstore-db-journal
              • Size 1KB
              • SHA256 5e1899b056ed8f5cb7b3fe64b4fddb03440873af27a5bec8ee86a00715cbb9f1
              • MD5 SHA1 SHA512
              Submit Download

              bugly_db_
              • Path /data/user/0/com.uv.droid.launcher.bluetv/databases/bugly_db_
              • Size 152KB
              • SHA256 82fb80f2d5aa6d51f7a7693af53c68bc5e5ecac41d6f92e5dc962112ecebf04a
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              bugly_db_-journal
              • Path /data/user/0/com.uv.droid.launcher.bluetv/databases/bugly_db_-journal
              • Size 1KB
              • SHA256 309994438bc2fc99c85b1361e6c3d386b4c7446156bd0b9f960665245b9551af
              • MD5 SHA1 SHA512
              Submit Download

              notifications.db
              • Path /data/user/0/com.uv.droid.launcher.bluetv/databases/notifications.db
              • Size 96KB
              • SHA256 2b5e8c8d09cf9d5efae7e7e602c23bbdd18d11a41ce69e3b84b2faf4dfcbb9db
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              notifications.db-journal
              • Path /data/user/0/com.uv.droid.launcher.bluetv/databases/notifications.db-journal
              • Size 1KB
              • SHA256 94b631aa3ac79fa4f2693d3ad5afb8a3edba3d0818c7e6e1adfcf836e66b5ac2
              • MD5 SHA1 SHA512
              Submit Download

              uota.db
              • Path /data/user/0/com.uv.droid.launcher.bluetv/databases/uota.db
              • Size 80KB
              • SHA256 4871f9a757142b72e5694f73b48a72cf85a99e5ca748bd53c0c91ccade470706
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              uota.db-journal
              • Path /data/user/0/com.uv.droid.launcher.bluetv/databases/uota.db-journal
              • Size 1KB
              • SHA256 77421a2595dab22d688cb7063ae8ce99e38689c7f92b24a529e22f7d0fd2e815
              • MD5 SHA1 SHA512
              Submit Download

              .imprint
              • Path /data/user/0/com.uv.droid.launcher.bluetv/files/.imprint
              • Size 921B
              • SHA256 ef43e990048bfb41116960003a7384b520fcf08a2eb3172a1fb16b9a0891c51e
              • MD5 SHA1 SHA512
              Submit Download

              .jg.ac
              • Path /data/user/0/com.uv.droid.launcher.bluetv/files/.jglogs/.jg.ac
              • Size 72B
              • SHA256 52255a32dee2cce5115369209c98468dc68fa54001e60e4d41a3df9c5750e322
              • MD5 SHA1 SHA512
              Submit Download

              .jg.ic
              • Path /data/user/0/com.uv.droid.launcher.bluetv/files/.jglogs/.jg.ic
              • Size 32B
              • SHA256 498341967c6b537b7c1a10793566502f89352e5919028e267dbee925da48b8a9
              • MD5 SHA1 SHA512
              Submit Download

              .jg.pk
              • Path /data/user/0/com.uv.droid.launcher.bluetv/files/.jglogs/.jg.pk
              • Size 32B
              • SHA256 da4a4cf038f10b4607f7d89eb1de483f544449802db5472d9d7f9eea5628c4a1
              • MD5 SHA1 SHA512
              Submit Download

              .jg.pk
              • Path /data/user/0/com.uv.droid.launcher.bluetv/files/.jglogs/.jg.pk
              • Size 64B
              • SHA256 88ce2748e638d066ccf94ea30bee002b277703a2407cc1551bd9b8ada6f0e8b1
              • MD5 SHA1 SHA512
              Submit Download

              .jg.pk.h
              • Path /data/user/0/com.uv.droid.launcher.bluetv/files/.jglogs/.jg.pk.h
              • Size 32B
              • SHA256 da4a4cf038f10b4607f7d89eb1de483f544449802db5472d9d7f9eea5628c4a1
              • MD5 SHA1 SHA512
              Submit Download

              .jg.pk.h
              • Path /data/user/0/com.uv.droid.launcher.bluetv/files/.jglogs/.jg.pk.h
              • Size 96B
              • SHA256 c3b92324a4666390b47d8e1e4754468dd442146ad0fbb56e0bbf480a4e0cf94c
              • MD5 SHA1 SHA512
              Submit Download

              .jg.rd
              • Path /data/user/0/com.uv.droid.launcher.bluetv/files/.jglogs/.jg.rd
              • Size 32B
              • SHA256 1132720dc792e9ab4c610ad3ceca37575fc7567d05fbc255e7239040de1f4ddc
              • MD5 SHA1 SHA512
              Submit Download

              .jg.ri
              • Path /data/user/0/com.uv.droid.launcher.bluetv/files/.jglogs/.jg.ri
              • Size 646B
              • SHA256 b236c0ac9ef4f82703ee6d280e8b3c3e6884f34f8b2c56b6bae8a7bb87467bbe
              • MD5 SHA1 SHA512
              Submit Download

              .jg.store.report_cf
              • Path /data/user/0/com.uv.droid.launcher.bluetv/files/.jglogs/.jg.store.report_cf
              • Size 32B
              • SHA256 70c8172fd2d896eeaaac98dc407d4b47f8da0065c8145c3d9654525c01025def
              • MD5 SHA1 SHA512
              Submit Download

              .jg.store.report_pid
              • Path /data/user/0/com.uv.droid.launcher.bluetv/files/.jglogs/.jg.store.report_pid
              • Size 32B
              • SHA256 93b2df5b803ca55aaaae8309d0fd18e590fa9181afed2720b3788e3c106b1fe5
              • MD5 SHA1 SHA512
              Submit Download

              .jiagu.lock
              • Path /data/user/0/com.uv.droid.launcher.bluetv/files/.jiagu.lock
              • Size 38B
              • SHA256 48e3ebf032c81a84fb8180dbc3f2d5ab6596b153ea8b3de84a21d70a5ad9e030
              • MD5 SHA1 SHA512
              Submit Download

              exchangeIdentity.json
              • Path /data/user/0/com.uv.droid.launcher.bluetv/files/.umeng/exchangeIdentity.json
              • Size 162B
              • SHA256 4c969be68b088bd5f4d47d12ce1525efcdd8791b840e5d0bd41350f488825f57
              • MD5 SHA1 SHA512
              Submit Download

              exid.dat
              • Path /data/user/0/com.uv.droid.launcher.bluetv/files/exid.dat
              • Size 54B
              • SHA256 3b4dee5743291d0920332c75938fd93bcaba696b9101528d6a18d7d45b76e5b9
              • MD5 SHA1 SHA512
              Submit Download

              umeng_it.cache
              • Path /data/user/0/com.uv.droid.launcher.bluetv/files/umeng_it.cache
              • Size 350B
              • SHA256 59b3bb59b697faacef851cb128b51bb3a22e3113b1a059edb4dd8b8637ae98ca
              • MD5 SHA1 SHA512
              Submit Download

              crashrecord.xml
              • Path /data/user/0/com.uv.droid.launcher.bluetv/shared_prefs/crashrecord.xml
              • Size 140B
              • SHA256 32a904a3dd59ad63c071d4e0100cafe1f09a60b6bce4001b3666a092b16d665b
              • MD5 SHA1 SHA512
              Submit Download

              launcher.xml
              • Path /data/user/0/com.uv.droid.launcher.bluetv/shared_prefs/launcher.xml
              • Size 125B
              • SHA256 c3e98e3b3bf7795c1f3ca287bc150ea3eaacbb30556e075ac2381771a2be1041
              • MD5 SHA1 SHA512
              Submit Download

              ext13d5063ff3a12ee1de5b84a7ed39dc84.skin
              • Path /storage/emulated/0/Android/data/com.uv.droid.launcher.bluetv/cache/ext13d5063ff3a12ee1de5b84a7ed39dc84.skin
              • Size 33KB
              • SHA256 d84c8050ff7dd13619373534d094e26b1551f886ef4fe2b0d104225453ee8419
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              398972b4e24fb5b17098cabaaa5b0332fe2dee80b963a8f5cb4c9f4a3d4c05b7.0.tmp
              • Path /storage/emulated/0/Android/data/com.uv.droid.launcher.bluetv/cache/glide_cache/398972b4e24fb5b17098cabaaa5b0332fe2dee80b963a8f5cb4c9f4a3d4c05b7.0.tmp
              • Size 8KB
              • SHA256 d29a39514f832d5bb751fc15cce941d739e156c1f35f21d04a0cbe6bfde2d67d
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              bd9089b2d544221f12206e7d6741be382325b301a2fc34631f7daa7682adb9e8.0.tmp
              • Path /storage/emulated/0/Android/data/com.uv.droid.launcher.bluetv/cache/glide_cache/bd9089b2d544221f12206e7d6741be382325b301a2fc34631f7daa7682adb9e8.0.tmp
              • Size 6KB
              • SHA256 99728cd27f920a0c6ae018db28c41545cbdbafcb0435570a525e135782654092
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              journal.tmp
              • Path /storage/emulated/0/Android/data/com.uv.droid.launcher.bluetv/cache/glide_cache/journal.tmp
              • Size 31B
              • SHA256 68bb33ddeed9200be85a71f70b377985f9ee68e91578afbde8321463396f1274
              • MD5 SHA1 SHA512
              Submit Download