84e675c027bb88d96f25b51c6de7190d1bd16d1bca16a294659f2834b4935535

Analysis

max time kernel
3164046s
max time network
14s
platform
android_x64
resource
android-x64-20220823-en
resource tags

androidarch:x64arch:x86image:android-x64-20220823-enlocale:en-usos:android-10-x64system
submitted
15-06-2023 01:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2b0bd5645bbbb9d18937d6e3a58abd0b.apk
Size

3.7MB
MD5

2b0bd5645bbbb9d18937d6e3a58abd0b
SHA1

c95ad429c4e6c9c36257d5930234b9983dc3b76c
SHA256

84e675c027bb88d96f25b51c6de7190d1bd16d1bca16a294659f2834b4935535
SHA512

84f01bcb24774dd8a3ec794585feb4f8e66cfee3c8ef0d1403ebab0291548a7daa3a1a080d6f812c757eadb9b0cbe470cf3683ed31620e42b66b48eb59a263f4
SSDEEP

98304:HUhOgetr6PbLVr6AKyNtzoosE3ruFVUjCoq53N48BgKg:0sSbLTcosE3rsSjCo4N4Ug

Score

7^/10

ransomware

Malware Config

Signatures

Checks known Qemu files. 1 IoCs
Checks for known Qemu files that exist on Android virtual device images.

Processes:

net.zyxd.lxzs

description ioc process

File opened for read /sys/qemu_trace net.zyxd.lxzs
Checks known Qemu pipes. 2 IoCs
Checks for known pipes used by the Android emulator to communicate with the host.

Processes:

net.zyxd.lxzs

description ioc process

File opened for read /dev/qemu_pipe net.zyxd.lxzs
File opened for read /dev/socket/qemud net.zyxd.lxzs
Loads dropped Dex/Jar 2 IoCs
Runs executable file dropped to the device during analysis.

Processes:

net.zyxd.lxzs

ioc pid process

/data/data/net.zyxd.lxzs/.jiagu/classes.dex 4764 net.zyxd.lxzs
/data/data/net.zyxd.lxzs/.jiagu/classes.dex!classes2.dex 4764 net.zyxd.lxzs
Uses Crypto APIs (Might try to encrypt user data). 1 IoCs
ransomware

Processes:

net.zyxd.lxzs

description ioc process

Framework API call javax.crypto.Cipher.doFinal net.zyxd.lxzs

description	ioc	process
File opened for read	/sys/qemu_trace	net.zyxd.lxzs

description	ioc	process
File opened for read	/dev/qemu_pipe	net.zyxd.lxzs
File opened for read	/dev/socket/qemud	net.zyxd.lxzs

ioc	pid	process
/data/data/net.zyxd.lxzs/.jiagu/classes.dex	4764	net.zyxd.lxzs
/data/data/net.zyxd.lxzs/.jiagu/classes.dex!classes2.dex	4764	net.zyxd.lxzs

description	ioc	process
Framework API call	javax.crypto.Cipher.doFinal	net.zyxd.lxzs

net.zyxd.lxzs
1⤵
- Checks known Qemu files.
- Checks known Qemu pipes.
- Loads dropped Dex/Jar
- Uses Crypto APIs (Might try to encrypt user data).
PID:4764

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/net.zyxd.lxzs/.jiagu/classes.dex
Filesize
1.6MB

MD5
433d79b2743460c1a7921ecd06bca0dd

SHA1
c63ed5010cebe6bb5c46e0594e901620e7a80eab

SHA256
c76e3e1d4e52b7e128f0117edd13d374827f64901b03f4771c4a3331ba2ccfb6

SHA512
9a1da9248f7b8f8c8be07dc7a9f7f4c2e70d817cd4426196532b9217a07936bbcb2f17b0630ae37ada3938a8937e5c77fed39088592d0a43cd23159e2b5b6d54

Download Submit
/data/data/net.zyxd.lxzs/.jiagu/classes.dex!classes2.dex
Filesize
94KB

MD5
8482b8389f0f08b2d5ff37c92b11cf3d

SHA1
1e5cdcf31b854f4f852f8bf5d5cb8b453e9e5973

SHA256
b583bcc39bca625faf0326c78eb5f76d647cfb015cdba80cebb95c3e82805202

SHA512
ab73864d40972c3e87d12790a9785844ea11424b2cb358ef7f2bc176ca99fb1c5e69912b3d272cb92742d5f5b8155799e44394ea530a79f22648e076bf87bb05

Download Submit
/data/data/net.zyxd.lxzs/.jiagu/libjiagu.so
Filesize
691KB

MD5
76b2f6b381970b80972ae2a06215878c

SHA1
ff77d42fb94dc60c2c9964c98c5def28a63dba0c

SHA256
9b161eac88832b6f54645b39f9a650f27db3aff3a5001ed67b6198676351663d

SHA512
488d21056bd85518277f8d5ac216d2f1c5265e97c5119701321478d3bb850cbfc98358bf08049e318606e4b95a46fd981036b438f9fdaa4b66e160e6598f3381

Download Submit
/data/data/net.zyxd.lxzs/.jiagu/libjiagu_64.so
Filesize
808KB

MD5
401bba8db0c025aa56a524c010b43f48

SHA1
eac073332c43a5f37453164b624061a1e4d14e26

SHA256
0d6f9cb8c06e008a80c72480ef11c40316c6f1741bec3b91ba5fbac300b3727a

SHA512
12042abd5d9308f4c76ee32417bd469c9e4c974f3962b899e1cc97656b7197de247b27ca47b81da08ea6b6903df121311d212587ec57220faf9c500c3e1e118d

Download Submit
/data/data/net.zyxd.lxzs/.oabugaij/.fsgkea
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/data/net.zyxd.lxzs/files/.jglogs/.jg.ac
Filesize
72B

MD5
1f1f418332f0f23be74fab0dda556974

SHA1
12e31cc753ce3200bea9949ff51427befd1f8fc5

SHA256
3b282e5b88f174b73f254226f22a262f71dbac57c102ce50262fbaf261a70802

SHA512
4c7b1d8145f59f90da9c4e18952c58c16d04e359e59020613b5ef1f479d79302f9ddbb943077228661c6b5882c90e9ad9ac404c96dbad101415bdae9e9a760d4

Download Submit
/data/data/net.zyxd.lxzs/files/.jglogs/.jg.ri
Filesize
646B

MD5
0469dddaadc509296672fc9749956931

SHA1
2d099f0ed22e6cf4a9cc39f1054f36a7e62f32ea

SHA256
700fac160c7c957bd711320e0e5acd80cfe02929ff1bad96e345f5d68aa4f912

SHA512
87735237bd79457bc2eca75081c49fb2e03e27cdb440c739f1745a5bff3a55763f930476a5cdb22c7c066b12ea654687a865c37747d55e2bdd7f1a4c7b1873a0

Download Submit
/data/data/net.zyxd.lxzs/files/.jglogs/.jg.store.report_cf
Filesize
32B

MD5
ed4a34058f58860f854fd283857d83d9

SHA1
97989bbb2d086361e04435df2513cb55402ef13b

SHA256
673e32ba206e69f82c58b6365d4d911a1aef04c3a9377ddbe08a4119fb53298b

SHA512
b42827eec04b9fdc5811e9412b4e8222562bc9911a31f98ed70e4a6d64e633e60a320a2030bafc75252caa109d78fb0fd73ac99f6fd5acd75370209a353f3f18

Download Submit
/data/data/net.zyxd.lxzs/files/.jglogs/.jg.store.report_pid
Filesize
32B

MD5
5e34cd766ea1b25eb0ff24160cf5f6eb

SHA1
e0b59298ac9f458c05777adaf10e953b7be94563

SHA256
7e9b2cf8eaf25466c174076fb2882e4ddef217ac45f26e99c3dc38934dd1f101

SHA512
a7938783df703b9fff051f9ac52d63e6e7c83e03850d44d59da0b0a17cb6d0c4585232aee46a68165a1175112f45c9eef43d1a9d91f5cbce73f82017a16a1c56

Download Submit
/data/user/0/net.zyxd.lxzs/app_webview/GPUCache/index
Filesize
48B

MD5
6d7d499960179766cd4261d12dacc411

SHA1
e6f8553b0015e12b23cc551afe98763f3b1c9bed

SHA256
c96ac03cfdbc6f4c1bdcdf764f1a6573f852e7aae5ef405969516b93ed271182

SHA512
6526c668477a01a850b8757b77dd3e7be27ad1991f5cf777685efcb03a21f31b71f6eae00f326931599baae4b16360e33e3d0f2894f1b2c1753391df02a14547

Download Submit
/data/user/0/net.zyxd.lxzs/app_webview/GPUCache/index-dir/temp-index
Filesize
96B

MD5
f9ef90364512ea97e48a976c71940e9a

SHA1
14a7bacb792ddb3302aad35fc37b3d2c7946c66e

SHA256
b3a053229d1fa7bd948edf8fe85302dc039ee31a79a01651e7f24c2e99401ce9

SHA512
b914db3b81b3ee3bbf92107d3bd123cc8341094f3825080645079550cc7bcb09d93f9069d0e8f877784f87e4669e27165e62ba912fdc7a5687daeb8620bc68ed

Download Submit
/data/user/0/net.zyxd.lxzs/app_webview/Web Data
Filesize
112KB

MD5
b663831f8cc130493476d94f2d7a5330

SHA1
043a1956ab8e40821d67043f8a9110a8eb36fb93

SHA256
c109aa8bfc364d5fd0756f1c9d35ee3d6df31325061ac70d8469f28cfc882ab7

SHA512
e8ee923192cdf16318febdc23362f3eeaf5c914b923f80cd3a91a2e83e94bced54460d4ef1e54accc26a7d54b89e2e10c00097e60002cf6427298dc5f18fed16

Download Submit
/data/user/0/net.zyxd.lxzs/app_webview/Web Data-journal
Filesize
1KB

MD5
59f98f8736fc2fd7157457a8ceeaf176

SHA1
5879b39e4a522ed624c5e8460722405d44d0ea42

SHA256
23f472ab2c746084b884fa72cb5fed02321425c226369e8e2de847234e2488e8

SHA512
0652965382634fe614fbf95bb97ce18eeafe3b5bceca943b2208e6aeea05a4fee7be982b923395ba1ff858b81404d270a8c0491e36b1bb1563d35af104e5ec49

Download Submit
/data/user/0/net.zyxd.lxzs/app_webview/metrics_guid
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/net.zyxd.lxzs/app_webview/metrics_guid
Filesize
36B

MD5
5abaf733ce420a3bac3ca50b5adfa870

SHA1
77f7cf4ced297876ad38bf530bc0bb78917cfdec

SHA256
8d4d910acca5359347be7b1dccd05915254cb4ee9fd955f14373e6c565e05015

SHA512
7102dedf0cb32e8288dc903ebb560c10959e600ff0726dc4866e5533736df033fb116ebcedb71529ef8430c1c0a5ca264515b441aee43de807f6121512a9dcf5

Download Submit
/data/user/0/net.zyxd.lxzs/app_webview/variations_seed_new
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/net.zyxd.lxzs/app_webview/variations_stamp
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/net.zyxd.lxzs/app_webview/webview_data.lock
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/net.zyxd.lxzs/cache/org.chromium.android_webview/Code Cache/js/index
Filesize
48B

MD5
6d7d499960179766cd4261d12dacc411

SHA1
e6f8553b0015e12b23cc551afe98763f3b1c9bed

SHA256
c96ac03cfdbc6f4c1bdcdf764f1a6573f852e7aae5ef405969516b93ed271182

SHA512
6526c668477a01a850b8757b77dd3e7be27ad1991f5cf777685efcb03a21f31b71f6eae00f326931599baae4b16360e33e3d0f2894f1b2c1753391df02a14547

Download Submit
/data/user/0/net.zyxd.lxzs/cache/org.chromium.android_webview/Code Cache/js/index-dir/temp-index
Filesize
96B

MD5
d0eebbb45c278121d2646c5bb2a4e869

SHA1
6c5c5c37825a13a708cbb1d8cfb026a69dcb5723

SHA256
910603a96bd7dcab2c1ebf5b9755cbd953baf5862be7ec8367f6f7060f0bc554

SHA512
881fa9d19b3b2bb63bd3e5b6d1818170e508927238216f91bc4123eafde0021355c7ea01519a17c73a04208f6bce41a57c507b2c5b921f83df330ec65f472825

Download Submit
/data/user/0/net.zyxd.lxzs/shared_prefs/WebViewChromiumPrefs.xml
Filesize
127B

MD5
6ef709b8536878951e87c29a1518fc2b

SHA1
24376c70b00152501b3d98df61fa7db435339172

SHA256
10b13d894f36d4391fcc31313a244d5f6cd89c8e8c03347282e281c4af13c0a6

SHA512
96547eff6779251a5c4941e812ec56ed273e9270265005723e1f2864688b04f3b852a90145fba4ea0ddf1e02b39d99e33d28f761b07a04d46e0e4257d8909ff9

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads