Overview

overview

7

Static

static

7

studyinchina.apk

android-11-x64

7

index.html

android-11-x64

libjiagu.so

android-11-x64

libjiagu_a64.so

android-11-x64

libjiagu_x64.so

android-11-x64

libjiagu_x86.so

android-11-x64

Resubmissions

13-06-2023 21:47

230613-1nfbkacc5t 7

13-06-2023 21:45

230613-1mgs1acc5s 7

Analysis

  • max time kernel
    3065722s
  • max time network
    25s
  • platform
    android_x64
  • resource
    android-x64-arm64-20220823-en
  • resource tags

    androidarch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20220823-enlocale:en-usos:android-11-x64system
  • submitted
    13-06-2023 21:47

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    studyinchina.apk

  • Size

    3.7MB

  • MD5

    2b0bd5645bbbb9d18937d6e3a58abd0b

  • SHA1

    c95ad429c4e6c9c36257d5930234b9983dc3b76c

  • SHA256

    84e675c027bb88d96f25b51c6de7190d1bd16d1bca16a294659f2834b4935535

  • SHA512

    84f01bcb24774dd8a3ec794585feb4f8e66cfee3c8ef0d1403ebab0291548a7daa3a1a080d6f812c757eadb9b0cbe470cf3683ed31620e42b66b48eb59a263f4

  • SSDEEP

    98304:HUhOgetr6PbLVr6AKyNtzoosE3ruFVUjCoq53N48BgKg:0sSbLTcosE3rsSjCo4N4Ug

Score
7/10
ransomware

Malware Config

Signatures

  • Checks known Qemu files. 1 IoCs

    Checks for known Qemu files that exist on Android virtual device images.

  • Checks known Qemu pipes. 2 IoCs

    Checks for known pipes used by the Android emulator to communicate with the host.

  • Loads dropped Dex/Jar 2 IoCs

    Runs executable file dropped to the device during analysis.

  • Uses Crypto APIs (Might try to encrypt user data). 1 IoCs
    ransomware

Processes

  • net.zyxd.lxzs
    1⤵
    • Checks known Qemu files.
    • Checks known Qemu pipes.
    • Loads dropped Dex/Jar
    • Uses Crypto APIs (Might try to encrypt user data).
    PID:4568

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/data/net.zyxd.lxzs/.oabugaij/.fsgkea
    MD5

    d41d8cd98f00b204e9800998ecf8427e

    SHA1

    da39a3ee5e6b4b0d3255bfef95601890afd80709

    SHA256

    e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

    SHA512

    cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

    Download Submit

  • /data/user/0/net.zyxd.lxzs/.jiagu/classes.dex
    Filesize

    1.6MB

    MD5

    433d79b2743460c1a7921ecd06bca0dd

    SHA1

    c63ed5010cebe6bb5c46e0594e901620e7a80eab

    SHA256

    c76e3e1d4e52b7e128f0117edd13d374827f64901b03f4771c4a3331ba2ccfb6

    SHA512

    9a1da9248f7b8f8c8be07dc7a9f7f4c2e70d817cd4426196532b9217a07936bbcb2f17b0630ae37ada3938a8937e5c77fed39088592d0a43cd23159e2b5b6d54

    Download Submit

  • /data/user/0/net.zyxd.lxzs/.jiagu/classes.dex!classes2.dex
    Filesize

    94KB

    MD5

    8482b8389f0f08b2d5ff37c92b11cf3d

    SHA1

    1e5cdcf31b854f4f852f8bf5d5cb8b453e9e5973

    SHA256

    b583bcc39bca625faf0326c78eb5f76d647cfb015cdba80cebb95c3e82805202

    SHA512

    ab73864d40972c3e87d12790a9785844ea11424b2cb358ef7f2bc176ca99fb1c5e69912b3d272cb92742d5f5b8155799e44394ea530a79f22648e076bf87bb05

    Download Submit

  • /data/user/0/net.zyxd.lxzs/.jiagu/libjiagu.so
    Filesize

    691KB

    MD5

    76b2f6b381970b80972ae2a06215878c

    SHA1

    ff77d42fb94dc60c2c9964c98c5def28a63dba0c

    SHA256

    9b161eac88832b6f54645b39f9a650f27db3aff3a5001ed67b6198676351663d

    SHA512

    488d21056bd85518277f8d5ac216d2f1c5265e97c5119701321478d3bb850cbfc98358bf08049e318606e4b95a46fd981036b438f9fdaa4b66e160e6598f3381

    Download Submit

  • /data/user/0/net.zyxd.lxzs/.jiagu/libjiagu_64.so
    Filesize

    808KB

    MD5

    401bba8db0c025aa56a524c010b43f48

    SHA1

    eac073332c43a5f37453164b624061a1e4d14e26

    SHA256

    0d6f9cb8c06e008a80c72480ef11c40316c6f1741bec3b91ba5fbac300b3727a

    SHA512

    12042abd5d9308f4c76ee32417bd469c9e4c974f3962b899e1cc97656b7197de247b27ca47b81da08ea6b6903df121311d212587ec57220faf9c500c3e1e118d

    Download Submit

  • /data/user/0/net.zyxd.lxzs/app_webview/Default/GPUCache/index
    Filesize

    48B

    MD5

    6d7d499960179766cd4261d12dacc411

    SHA1

    e6f8553b0015e12b23cc551afe98763f3b1c9bed

    SHA256

    c96ac03cfdbc6f4c1bdcdf764f1a6573f852e7aae5ef405969516b93ed271182

    SHA512

    6526c668477a01a850b8757b77dd3e7be27ad1991f5cf777685efcb03a21f31b71f6eae00f326931599baae4b16360e33e3d0f2894f1b2c1753391df02a14547

    Download Submit

  • /data/user/0/net.zyxd.lxzs/app_webview/Default/GPUCache/index-dir/temp-index
    Filesize

    96B

    MD5

    4b6ccff3988c98bafaf7ea2feadd7897

    SHA1

    0d3e87acf204b2b1b91c7e61f5b6b95329faf9ed

    SHA256

    09c1adf9f38758012ceda23a871838428fc5a8b25c8e11e7f7bf75efd1a1c6f7

    SHA512

    9b870d305147de399c3a3d94e3a65533c93310abb8c61cd33a0443b274bd2d4f25f577b07e2c6910fb97d1e57cf44833eddc4af6c68d511566d8ce9856896ef9

    Download Submit

  • /data/user/0/net.zyxd.lxzs/app_webview/Default/Web Data
    Filesize

    120KB

    MD5

    a48cd9324b1f8754b07f00d863b840f3

    SHA1

    11c6614775b35a58f440971dfc87c8aaac6d6173

    SHA256

    8859a216183793485d4699bf69d7ed96904679834188d07b9a70424d47eb1420

    SHA512

    35fa712f0af4a5eeed7e00e4e59ed5027dc6609d268462fe79d92043be9ae0c5961ce9e1d2f64b1a196c9b6aa6242b8b83817b3ee4c1058596c58a99c45478b1

    Download Submit

  • /data/user/0/net.zyxd.lxzs/app_webview/Default/Web Data-journal
    Filesize

    2KB

    MD5

    9d89db475caec9ad73e1d5e6594cd19f

    SHA1

    dbfb8b10cda7b7f9e6a58b2418f8bb42b4ff258f

    SHA256

    749bec172762626f7e0fce316e76a681028ff79d99188da1656b47c338b25805

    SHA512

    1a1075498baa97d73c4047292995b6e6138352906085afcf291136c56fc9352b0c832b40e99ea20d14964c45d04dfae16d1c8ed92d25d5b7db41bd7c6ead3ad8

    Download Submit

  • /data/user/0/net.zyxd.lxzs/app_webview/variations_seed_new
    MD5

    d41d8cd98f00b204e9800998ecf8427e

    SHA1

    da39a3ee5e6b4b0d3255bfef95601890afd80709

    SHA256

    e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

    SHA512

    cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

    Download Submit

  • /data/user/0/net.zyxd.lxzs/app_webview/variations_stamp
    MD5

    d41d8cd98f00b204e9800998ecf8427e

    SHA1

    da39a3ee5e6b4b0d3255bfef95601890afd80709

    SHA256

    e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

    SHA512

    cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

    Download Submit

  • /data/user/0/net.zyxd.lxzs/app_webview/webview_data.lock
    Filesize

    19B

    MD5

    3b829d1e439ef94a6628dc357a568193

    SHA1

    2df6f6bf064a7b840e56ff8f308fe24b4ae7a64e

    SHA256

    3f783922a357aaf7368939463dd68ed75a21e39a7230d020f8dae40a3cc03046

    SHA512

    4631b91ad2435cfc9c3d5f6dd52a3ff4426c27643aebeb3fe4b501328a00773dc87bcbae8bdf51ce6118506220cda84e5da3f47f1a70cdb3d3980c58836d7985

    Download Submit

  • /data/user/0/net.zyxd.lxzs/cache/WebView/Default/HTTP Cache/Code Cache/js/index
    Filesize

    48B

    MD5

    6d7d499960179766cd4261d12dacc411

    SHA1

    e6f8553b0015e12b23cc551afe98763f3b1c9bed

    SHA256

    c96ac03cfdbc6f4c1bdcdf764f1a6573f852e7aae5ef405969516b93ed271182

    SHA512

    6526c668477a01a850b8757b77dd3e7be27ad1991f5cf777685efcb03a21f31b71f6eae00f326931599baae4b16360e33e3d0f2894f1b2c1753391df02a14547

    Download Submit

  • /data/user/0/net.zyxd.lxzs/cache/WebView/Default/HTTP Cache/Code Cache/js/index-dir/temp-index
    Filesize

    96B

    MD5

    82e1123a70c31847365adaa7e12ab8e0

    SHA1

    654e42f3bf0f61d8279d5a91d0048540c75389d6

    SHA256

    d30a4c2abc9a75690e9b64d192299c4ccd076bdc18eef4882c8a2f349d60e969

    SHA512

    577ace30e364ff0655030a4b156d82141ed3aaecf714444c0314d1f6edd8e32b13e6cf42bdd7602ab1bb8f67936231e8b13d35f04406bf7b4c3a28babca2f841

    Download Submit

  • /data/user/0/net.zyxd.lxzs/cache/WebView/Default/HTTP Cache/Code Cache/wasm/index
    Filesize

    48B

    MD5

    6d7d499960179766cd4261d12dacc411

    SHA1

    e6f8553b0015e12b23cc551afe98763f3b1c9bed

    SHA256

    c96ac03cfdbc6f4c1bdcdf764f1a6573f852e7aae5ef405969516b93ed271182

    SHA512

    6526c668477a01a850b8757b77dd3e7be27ad1991f5cf777685efcb03a21f31b71f6eae00f326931599baae4b16360e33e3d0f2894f1b2c1753391df02a14547

    Download Submit

  • /data/user/0/net.zyxd.lxzs/cache/WebView/Default/HTTP Cache/Code Cache/wasm/index-dir/temp-index
    Filesize

    96B

    MD5

    e0969ede02c72ba7ccec0e93f9dea1dc

    SHA1

    e3cf4dbb8b71ba1e16de466ae1c595d8532b2844

    SHA256

    bf6a537d9dd120209e11e69546dea39c310bda1b532c9dc46da43ad4a840b540

    SHA512

    aa0a983495dda108e6b168da54b687bffca6b130b1fa82d7148f7da6840174887dd44591327f70bac122a7e38c5e21f965414a12218fb559a33cbe98ebde4de2

    Download Submit

  • /data/user/0/net.zyxd.lxzs/cache/WebView/font_unique_name_table.pb
    Filesize

    57KB

    MD5

    f080fa2a56ab5479d58063e5ea871447

    SHA1

    4b3fd57a98916fa5784305b76ba30af26b5253d9

    SHA256

    0aa374bc456330fd1b5daf18d25b4bb8e2df1998dfa85466f2c31843ff56e815

    SHA512

    8aee3186a95b389d39882620b7c4199a29aa50580aa98a381b2931a934de6406943c89d4d00ebeabff21e2b03b4a4adcc01e37e32a2335c4838be24bdbf61936

    Download Submit

  • /data/user/0/net.zyxd.lxzs/files/.jglogs/.jg.ac
    Filesize

    72B

    MD5

    1f1f418332f0f23be74fab0dda556974

    SHA1

    12e31cc753ce3200bea9949ff51427befd1f8fc5

    SHA256

    3b282e5b88f174b73f254226f22a262f71dbac57c102ce50262fbaf261a70802

    SHA512

    4c7b1d8145f59f90da9c4e18952c58c16d04e359e59020613b5ef1f479d79302f9ddbb943077228661c6b5882c90e9ad9ac404c96dbad101415bdae9e9a760d4

    Download Submit

  • /data/user/0/net.zyxd.lxzs/files/.jglogs/.jg.ri
    Filesize

    646B

    MD5

    935f0a99e853746e3b79ece87440ee56

    SHA1

    a9b789484366b024ddb3973b919c4f8da9012c5e

    SHA256

    ae7d2af99723ee4fd08e1fe2ea7ddabad43203c0a88c2cd18ef8763237765092

    SHA512

    c7076141f574dd11a92ea86c1945fbad62c36efe3ae10f7f129e38a1efbb06bf1480d0f4b12bc4c80f74ed3854ef8cb64807d951d0ab5261943f7b79da6ccee0

    Download Submit

  • /data/user/0/net.zyxd.lxzs/files/.jglogs/.jg.store.report_cf
    Filesize

    32B

    MD5

    ed4a34058f58860f854fd283857d83d9

    SHA1

    97989bbb2d086361e04435df2513cb55402ef13b

    SHA256

    673e32ba206e69f82c58b6365d4d911a1aef04c3a9377ddbe08a4119fb53298b

    SHA512

    b42827eec04b9fdc5811e9412b4e8222562bc9911a31f98ed70e4a6d64e633e60a320a2030bafc75252caa109d78fb0fd73ac99f6fd5acd75370209a353f3f18

    Download Submit

  • /data/user/0/net.zyxd.lxzs/files/.jglogs/.jg.store.report_pid
    Filesize

    32B

    MD5

    5e34cd766ea1b25eb0ff24160cf5f6eb

    SHA1

    e0b59298ac9f458c05777adaf10e953b7be94563

    SHA256

    7e9b2cf8eaf25466c174076fb2882e4ddef217ac45f26e99c3dc38934dd1f101

    SHA512

    a7938783df703b9fff051f9ac52d63e6e7c83e03850d44d59da0b0a17cb6d0c4585232aee46a68165a1175112f45c9eef43d1a9d91f5cbce73f82017a16a1c56

    Download Submit

  • /data/user/0/net.zyxd.lxzs/files/push_stat_cache.json
    MD5

    d41d8cd98f00b204e9800998ecf8427e

    SHA1

    da39a3ee5e6b4b0d3255bfef95601890afd80709

    SHA256

    e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

    SHA512

    cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

    Download Submit

  • /data/user/0/net.zyxd.lxzs/shared_prefs/WebViewChromiumPrefs.xml
    Filesize

    127B

    MD5

    97ccd9a2b2063143df56b6937f961ca4

    SHA1

    5e78a91ae5df289ce83443cb7d5589dd3504fb5d

    SHA256

    248ff7928128015b1cfe3e6517c8f9b8c9511bfb8c8baf44fc1370640eac61fd

    SHA512

    86c05a5bb3d7eedea390664796966e9e5a5bf846c85808da54407788a76b3ee25b91428242a1e76d8765bfe51e1ba3636617fbab6e7dbb39fcc433e07c3fcd3b

    Download Submit