bd23bdfa621b8cb1a9af3fecc0137fe4e2a428b711b28e4ca2e49c4fc91ec5a4

Analysis

max time kernel
305720s
max time network
157s
platform
android_x86
resource
android-x86-arm-20220823-en
resource tags

androidarch:armarch:x86image:android-x86-arm-20220823-enlocale:en-usos:android-9-x86system
submitted
02-02-2023 13:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f39a8aae1c30f1aff5866156803e349c73d94dda.apk
Size

1.5MB
MD5

1a7e9bf2c807dc4635b1386cfa9babe9
SHA1

f39a8aae1c30f1aff5866156803e349c73d94dda
SHA256

bd23bdfa621b8cb1a9af3fecc0137fe4e2a428b711b28e4ca2e49c4fc91ec5a4
SHA512

6afe42cc9c022433f9aeb19d7d5938ddbfc1bfd253d964c8b2e3341615112f7f2335ac3ce38d90b7874a9453aab3fef1e7f6991b364dcf4fd8b5eff79d43a00d
SSDEEP

24576:9SraLHW34NckctO9be4VskC65x9+N9hLGuQVqgNY3Q6T+tHGgYkbk1ZfvUYbk1Zt:VHWIBKohsm5xm9hy1VDaZT0Jk1eIk1e0

Score

7^/10

evasion ransomware

Malware Config

Signatures

Loads dropped Dex/Jar 3 IoCs

Runs executable file dropped to the device during analysis.

Processes:

/system/bin/dex2oat --debuggable --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --debuggable --generate-mini-debug-info --dex-file=/storage/emulated/0/dm_push/com.lkkl.ysaaj00111851.video/info/dmpush_lbx_local.jar --output-vdex-fd=120 --oat-fd=121 --oat-location=/storage/emulated/0/dm_push/com.lkkl.ysaaj00111851.video/info/oat/x86/dmpush_lbx_local.odex --compiler-filter=quicken --class-loader-context=&com.lkkl.ysaaj00111851.videocom.lkkl.ysaaj00111851.video:nk_v1

ioc	pid	process
/storage/emulated/0/dm_push/com.lkkl.ysaaj00111851.video/info/dmpush_lbx_local.jar	4254	/system/bin/dex2oat --debuggable --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --debuggable --generate-mini-debug-info --dex-file=/storage/emulated/0/dm_push/com.lkkl.ysaaj00111851.video/info/dmpush_lbx_local.jar --output-vdex-fd=120 --oat-fd=121 --oat-location=/storage/emulated/0/dm_push/com.lkkl.ysaaj00111851.video/info/oat/x86/dmpush_lbx_local.odex --compiler-filter=quicken --class-loader-context=&
/storage/emulated/0/dm_push/com.lkkl.ysaaj00111851.video/info/dmpush_lbx_local.jar	4051	com.lkkl.ysaaj00111851.video
/storage/emulated/0/dm_push/com.lkkl.ysaaj00111851.video/info/dmpush_lbx_local.jar	4433	com.lkkl.ysaaj00111851.video:nk_v1

Reads information about phone network operator.
Removes a system notification. 1 IoCs
evasion

Processes:

com.lkkl.ysaaj00111851.video

description ioc process

Framework service call android.app.INotificationManager.cancelNotificationWithTag com.lkkl.ysaaj00111851.video
Uses Crypto APIs (Might try to encrypt user data). 1 IoCs
ransomware

Processes:

com.lkkl.ysaaj00111851.video

description ioc process

Framework API call javax.crypto.Cipher.doFinal com.lkkl.ysaaj00111851.video
Checks the presence of a debugger.
evasion

description	ioc	process
Framework service call	android.app.INotificationManager.cancelNotificationWithTag	com.lkkl.ysaaj00111851.video

description	ioc	process
Framework API call	javax.crypto.Cipher.doFinal	com.lkkl.ysaaj00111851.video

com.lkkl.ysaaj00111851.video
1⤵
- Loads dropped Dex/Jar
- Removes a system notification.
- Uses Crypto APIs (Might try to encrypt user data).
PID:4051

/system/bin/dex2oat --debuggable --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --debuggable --generate-mini-debug-info --dex-file=/storage/emulated/0/dm_push/com.lkkl.ysaaj00111851.video/info/dmpush_lbx_local.jar --output-vdex-fd=120 --oat-fd=121 --oat-location=/storage/emulated/0/dm_push/com.lkkl.ysaaj00111851.video/info/oat/x86/dmpush_lbx_local.odex --compiler-filter=quicken --class-loader-context=&
2⤵
- Loads dropped Dex/Jar
PID:4254

getprop apps.customerservice.device
2⤵
PID:4306

getprop apps.customerservice.device
2⤵
PID:4341

ping -c 1 -w 100 www.tianyantopush.com
2⤵
PID:4354

ping -c 1 -w 100 www.tianyantoads.com
2⤵
PID:4518

com.lkkl.ysaaj00111851.video:nk_v1
1⤵
- Loads dropped Dex/Jar
PID:4433

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

/data/user/0/com.lkkl.ysaaj00111851.video/app_webview/Cookies
Filesize
64KB

MD5
cb7543c4df600f2af58097cce0e334ba

SHA1
83cc92f38c27fdb4fa519b1ce2f37912f24af1f0

SHA256
64c022ae708f94ffde986e105d88f708884de325720bfb9925c4160a6d417233

SHA512
ad51cad0472327bd68aa2d791341cfafed58971752352537bb603ed18b15a3f9185e9150983a28ecd09606e8dcaef6d1c9d93213dd246ef7720f39842eb3d980

Download Submit
/data/user/0/com.lkkl.ysaaj00111851.video/app_webview/Cookies-journal
Filesize
1KB

MD5
5607d6603fe797c5de1fec7a471705af

SHA1
73fec800e5b890c4867325ac720cbc1e23ccddca

SHA256
41f5a10422922a9c19a2325dd61f4b2610d8d232cdca88abfcc568574a2f3b46

SHA512
cfdda119b835b5b9807f333e30230721a7dc8bf522234131ec233854a3f9306ddd824a3d4ad930c21785dd3dd0321e51f84dd7651981c37fe958ba9795f63892

Download Submit
/data/user/0/com.lkkl.ysaaj00111851.video/app_webview/GPUCache/index
Filesize
20B

MD5
93027d42b314432c4216e6cfca48b384

SHA1
43448dd8102979c3926828182579691945eedd4e

SHA256
3cda72e67c62e52a342309c44f2cb3b6c1019c7b11822e2f628e48e254e2b41c

SHA512
a52d13cf7f5be196d1e2f135b8a010f80558c5d35e90e7792441d1c976517d55cf1c9587949db69ebef294cc6ef79529a65e7d779964793016efecacd152f70e

Download Submit
/data/user/0/com.lkkl.ysaaj00111851.video/app_webview/GPUCache/index-dir/temp-index
Filesize
48B

MD5
20ae0ec16599ace90e7640452c3c3f6d

SHA1
41e7f24f98fa3475a8a3af46eac0df327399a6b2

SHA256
b29dabc8af4faaa9bbe9542e9d97c839cf259ab2609cc4b99fafe72ff7dac154

SHA512
6df3958cded8e70f2e1266bff72815f16eca0073cd99b0e7e0c820821a12806bed7492e9e08e294d09636bc1038b7c1729f97c8161f49bfc78b6abfc0b82a461

Download Submit
/data/user/0/com.lkkl.ysaaj00111851.video/app_webview/Local Storage/leveldb/000001.dbtmp
Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
/data/user/0/com.lkkl.ysaaj00111851.video/app_webview/Local Storage/leveldb/000003.log
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/com.lkkl.ysaaj00111851.video/app_webview/Local Storage/leveldb/LOCK
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/com.lkkl.ysaaj00111851.video/app_webview/Local Storage/leveldb/LOG
Filesize
70B

MD5
f6e9aa25b36fa146dce0b2780ce206f9

SHA1
4061abdb87fe4e2e9b14b2166a16cf8f636d1eed

SHA256
7da65d1529a9da85ce4be6bd0dd706069a5279124f658dd1fe0087ca698911c5

SHA512
401d1f778e6dda213af224abdf116b08ee5414f58173f4271599f7c67a5eab10941fd8278c03fb54c891cfff6960138bf85e66713d1264185699eba55e73ef0e

Download Submit
/data/user/0/com.lkkl.ysaaj00111851.video/app_webview/Local Storage/leveldb/MANIFEST-000001
Filesize
41B

MD5
5af87dfd673ba2115e2fcf5cfdb727ab

SHA1
d5b5bbf396dc291274584ef71f444f420b6056f1

SHA256
f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

SHA512
de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

Download Submit
/data/user/0/com.lkkl.ysaaj00111851.video/app_webview/Web Data
Filesize
104KB

MD5
dc79f9ce5f3ab5270b33e61119dfc959

SHA1
1844bf222a5144b513dcf2fb50a18c011701c647

SHA256
47e65f4de08deabfd52ecdb8b0a29c61c482188b92c36182e2112ca0a8f4ff65

SHA512
18b8894a7f35df516f423bbdebf1e05ce09eaf4345b139e59e603cadb81f8d1fa20f793438c28e8fd9a64e64f0684223d90ce6f10d3f93cb0c781049a8cff03e

Download Submit
/data/user/0/com.lkkl.ysaaj00111851.video/app_webview/Web Data-journal
Filesize
1KB

MD5
2b494db93e5469c9944a03bbbeba4723

SHA1
3b8e976f28a2e7172005c4bdd98bdf4028321643

SHA256
eb12c9c0d0e4c80de3738fe7a7cb2f1500a511cfa875d0a58510189c24bec96f

SHA512
208f74de97d101d25c4729946ccbafd14b36102a13b9d78ff0ebb132dd4cf09624cd94f8d82a20b821de4d8a08ee41609f1aa871c054f6560e615cba2f86b542

Download Submit
/data/user/0/com.lkkl.ysaaj00111851.video/app_webview/metrics_guid
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/com.lkkl.ysaaj00111851.video/app_webview/metrics_guid
Filesize
36B

MD5
e1d319509a2d51113cb69eed75c0b5e9

SHA1
9a2353791dc8d9e763f3453827990ccb20eac4b0

SHA256
90434b75c090242781b43c489b8dd404a0d0a1c23b8296380d41946ece5961ca

SHA512
6abb96db834931d9cf36e97a186cd2cdf45c9181abf394ec860dfe971df19c6f70b6f075e68b9ec37cb41ee3f60f74b2b19a8ec33e19738bfca39e3fec2d09ad

Download Submit
/data/user/0/com.lkkl.ysaaj00111851.video/app_webview/variations_seed_new
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/com.lkkl.ysaaj00111851.video/app_webview/variations_stamp
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/com.lkkl.ysaaj00111851.video/app_webview/webview_data.lock
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/com.lkkl.ysaaj00111851.video/cache/org.chromium.android_webview/3510196b1cb0143c_0
Filesize
610B

MD5
64f79a9578a72916f8e67e62bc1eb479

SHA1
d061039dfe0cc5216bec05dc8915c77a1557a715

SHA256
d771aaaea450390ce451639a2970cf48d05835668b63d64f11ba087ea2398378

SHA512
927d2e6f36e16e4b34952a9eff32638479ecbef85ffacec27a0add321e2394496b3e0ac108c16ada41c2c2eb0aa80b9dbf41479e6546b8c581dca66ad2332c00

Download Submit
/data/user/0/com.lkkl.ysaaj00111851.video/cache/org.chromium.android_webview/index
Filesize
20B

MD5
93027d42b314432c4216e6cfca48b384

SHA1
43448dd8102979c3926828182579691945eedd4e

SHA256
3cda72e67c62e52a342309c44f2cb3b6c1019c7b11822e2f628e48e254e2b41c

SHA512
a52d13cf7f5be196d1e2f135b8a010f80558c5d35e90e7792441d1c976517d55cf1c9587949db69ebef294cc6ef79529a65e7d779964793016efecacd152f70e

Download Submit
/data/user/0/com.lkkl.ysaaj00111851.video/cache/org.chromium.android_webview/index-dir/temp-index
Filesize
48B

MD5
f0d6c038f783b79bd85e4f8d9b93b627

SHA1
c54017bee410603d6b26f24978a8a33803c67243

SHA256
7955246dc4e3b22fb25ad59e75b46e6cde552159618751a567982d151dbbbdad

SHA512
b85d45bf3745b92c3997ce425503fc8bf084c2aeb1cc0165a3c6914a82cd6b19dd1abe42fd4835319f1615d7f7ffd0a3c543ec18fa6f655bb458cf5f0264c0ad

Download Submit
/data/user/0/com.lkkl.ysaaj00111851.video/cache/org.chromium.android_webview/index-dir/temp-index
Filesize
72B

MD5
35746c316fa87f852f4e9c2158451996

SHA1
9cf5e58a88bd8ac2f09551cf748d2a549a1f6cd1

SHA256
e8529cc1603c1d76fa14cb33f494ee8f685d844390c8cc983536c6b0cc159dcd

SHA512
1f1365b90a8dd4951d180b42e3c6b200906530837503f436aee6857fde7929d76f426bfad44c0f47d743637aa4127d594a7ce4af51e7eb889b80beb7ebd5061d

Download Submit
/data/user/0/com.lkkl.ysaaj00111851.video/shared_prefs/WebViewChromiumPrefs.xml
Filesize
127B

MD5
21223e9184445fe043476484cd8cb1f9

SHA1
2b4813f849121d60ba35eb0889080668bb62c778

SHA256
bb61b7c087c2ae2de93a7740ff75707342940557146366e92b840284cd9446af

SHA512
be21408de0cc643650e5d9ab9057a8f9de88e37fbdc6417cfeba160402ec4cd14fccbc82cbbfd941ecfc0bb3d4056ee61ac199efdc99d647d53e65818835fd48

Download Submit
/storage/emulated/0/dm_push/com.lkkl.ysaaj00111851.video/info/dmpush_lbx_local.jar
Filesize
48KB

MD5
46d1de526e2138a571a650af58554064

SHA1
9727bb847fb57fb748a31064cf19885a3c162b01

SHA256
78b6239a10c1e1532f843735ed5b4c3c27ea3252411b71d0d2fbb90afbc75333

SHA512
9127756eb5e894bd95de4c78a0276f4b3ac3dfabb0040512f5117fabd6ca5dd050b1f574709158150476c9e2c2c09773b98b7ebca51374f57fb623bc12c53603

Download Submit
/storage/emulated/0/dm_push/com.lkkl.ysaaj00111851.video/info/dmpush_lbx_local.jar
Filesize
108KB

MD5
9222af96150123d299e12740de9869e5

SHA1
38c6e10b3c78c75258c971966dc3964e51b60cd3

SHA256
6e5c94d5d1f0163f418a1a25e553c65cf5ec9e62856d937a42fcfd1f51136287

SHA512
e05e857a3b92119e8bd495c8916815489aae54b49496be6a53638fb281da3b7d9f695971b302a03464058cf0550ece54faf5180aea71ff81a593266a2add2689

Download Submit
/storage/emulated/0/dm_push/com.lkkl.ysaaj00111851.video/info/dmpush_lbx_local.jar
Filesize
108KB

MD5
9222af96150123d299e12740de9869e5

SHA1
38c6e10b3c78c75258c971966dc3964e51b60cd3

SHA256
6e5c94d5d1f0163f418a1a25e553c65cf5ec9e62856d937a42fcfd1f51136287

SHA512
e05e857a3b92119e8bd495c8916815489aae54b49496be6a53638fb281da3b7d9f695971b302a03464058cf0550ece54faf5180aea71ff81a593266a2add2689

Download Submit
/storage/emulated/0/dm_push/com.lkkl.ysaaj00111851.video/info/dmpush_lbx_local.jar
Filesize
108KB

MD5
9222af96150123d299e12740de9869e5

SHA1
38c6e10b3c78c75258c971966dc3964e51b60cd3

SHA256
6e5c94d5d1f0163f418a1a25e553c65cf5ec9e62856d937a42fcfd1f51136287

SHA512
e05e857a3b92119e8bd495c8916815489aae54b49496be6a53638fb281da3b7d9f695971b302a03464058cf0550ece54faf5180aea71ff81a593266a2add2689

Download Submit
/storage/emulated/0/dm_push/com.lkkl.ysaaj00111851.video/info/dmpush_lbx_local.jar.x86.flock
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/storage/emulated/0/dm_push/com.lkkl.ysaaj00111851.video/info/dmpush_lbx_local.jar.x86.flock
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/storage/emulated/0/dm_push/com.lkkl.ysaaj00111851.video/info/oat/x86/dmpush_lbx_local.odex
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/storage/emulated/0/dm_push/com.lkkl.ysaaj00111851.video/info/oat/x86/dmpush_lbx_local.vdex
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit