84e675c027bb88d96f25b51c6de7190d1bd16d1bca16a294659f2834b4935535

Analysis

max time kernel
3164049s
max time network
15s
platform
android_x64
resource
android-x64-arm64-20220823-en
resource tags

androidarch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20220823-enlocale:en-usos:android-11-x64system
submitted
15-06-2023 01:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2b0bd5645bbbb9d18937d6e3a58abd0b.apk
Size

3.7MB
MD5

2b0bd5645bbbb9d18937d6e3a58abd0b
SHA1

c95ad429c4e6c9c36257d5930234b9983dc3b76c
SHA256

84e675c027bb88d96f25b51c6de7190d1bd16d1bca16a294659f2834b4935535
SHA512

84f01bcb24774dd8a3ec794585feb4f8e66cfee3c8ef0d1403ebab0291548a7daa3a1a080d6f812c757eadb9b0cbe470cf3683ed31620e42b66b48eb59a263f4
SSDEEP

98304:HUhOgetr6PbLVr6AKyNtzoosE3ruFVUjCoq53N48BgKg:0sSbLTcosE3rsSjCo4N4Ug

Score

7^/10

ransomware

Malware Config

Signatures

Checks known Qemu files. 1 IoCs
Checks for known Qemu files that exist on Android virtual device images.

Processes:

net.zyxd.lxzs

description ioc process

File opened for read /sys/qemu_trace net.zyxd.lxzs
Checks known Qemu pipes. 2 IoCs
Checks for known pipes used by the Android emulator to communicate with the host.

Processes:

net.zyxd.lxzs

description ioc process

File opened for read /dev/socket/qemud net.zyxd.lxzs
File opened for read /dev/qemu_pipe net.zyxd.lxzs

description	ioc	process
File opened for read	/sys/qemu_trace	net.zyxd.lxzs

description	ioc	process
File opened for read	/dev/socket/qemud	net.zyxd.lxzs
File opened for read	/dev/qemu_pipe	net.zyxd.lxzs

Loads dropped Dex/Jar 2 IoCs

Runs executable file dropped to the device during analysis.

Processes:

net.zyxd.lxzs

ioc	pid	process
/data/user/0/net.zyxd.lxzs/.jiagu/classes.dex	4390	net.zyxd.lxzs
/data/user/0/net.zyxd.lxzs/.jiagu/classes.dex!classes2.dex	4390	net.zyxd.lxzs

Uses Crypto APIs (Might try to encrypt user data). 1 IoCs
ransomware

Processes:

net.zyxd.lxzs

description ioc process

Framework API call javax.crypto.Cipher.doFinal net.zyxd.lxzs

description	ioc	process
Framework API call	javax.crypto.Cipher.doFinal	net.zyxd.lxzs

net.zyxd.lxzs
1⤵
- Checks known Qemu files.
- Checks known Qemu pipes.
- Loads dropped Dex/Jar
- Uses Crypto APIs (Might try to encrypt user data).
PID:4390

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/net.zyxd.lxzs/.oabugaij/.fsgkea
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/net.zyxd.lxzs/.jiagu/classes.dex
Filesize
1.6MB

MD5
433d79b2743460c1a7921ecd06bca0dd

SHA1
c63ed5010cebe6bb5c46e0594e901620e7a80eab

SHA256
c76e3e1d4e52b7e128f0117edd13d374827f64901b03f4771c4a3331ba2ccfb6

SHA512
9a1da9248f7b8f8c8be07dc7a9f7f4c2e70d817cd4426196532b9217a07936bbcb2f17b0630ae37ada3938a8937e5c77fed39088592d0a43cd23159e2b5b6d54

Download Submit
/data/user/0/net.zyxd.lxzs/.jiagu/classes.dex!classes2.dex
Filesize
94KB

MD5
8482b8389f0f08b2d5ff37c92b11cf3d

SHA1
1e5cdcf31b854f4f852f8bf5d5cb8b453e9e5973

SHA256
b583bcc39bca625faf0326c78eb5f76d647cfb015cdba80cebb95c3e82805202

SHA512
ab73864d40972c3e87d12790a9785844ea11424b2cb358ef7f2bc176ca99fb1c5e69912b3d272cb92742d5f5b8155799e44394ea530a79f22648e076bf87bb05

Download Submit
/data/user/0/net.zyxd.lxzs/.jiagu/libjiagu.so
Filesize
691KB

MD5
76b2f6b381970b80972ae2a06215878c

SHA1
ff77d42fb94dc60c2c9964c98c5def28a63dba0c

SHA256
9b161eac88832b6f54645b39f9a650f27db3aff3a5001ed67b6198676351663d

SHA512
488d21056bd85518277f8d5ac216d2f1c5265e97c5119701321478d3bb850cbfc98358bf08049e318606e4b95a46fd981036b438f9fdaa4b66e160e6598f3381

Download Submit
/data/user/0/net.zyxd.lxzs/.jiagu/libjiagu_64.so
Filesize
808KB

MD5
401bba8db0c025aa56a524c010b43f48

SHA1
eac073332c43a5f37453164b624061a1e4d14e26

SHA256
0d6f9cb8c06e008a80c72480ef11c40316c6f1741bec3b91ba5fbac300b3727a

SHA512
12042abd5d9308f4c76ee32417bd469c9e4c974f3962b899e1cc97656b7197de247b27ca47b81da08ea6b6903df121311d212587ec57220faf9c500c3e1e118d

Download Submit
/data/user/0/net.zyxd.lxzs/app_webview/Default/GPUCache/index
Filesize
48B

MD5
6d7d499960179766cd4261d12dacc411

SHA1
e6f8553b0015e12b23cc551afe98763f3b1c9bed

SHA256
c96ac03cfdbc6f4c1bdcdf764f1a6573f852e7aae5ef405969516b93ed271182

SHA512
6526c668477a01a850b8757b77dd3e7be27ad1991f5cf777685efcb03a21f31b71f6eae00f326931599baae4b16360e33e3d0f2894f1b2c1753391df02a14547

Download Submit
/data/user/0/net.zyxd.lxzs/app_webview/Default/GPUCache/index-dir/temp-index
Filesize
96B

MD5
2d322e0ff7395a42eb8cb4f723a4e128

SHA1
4d47f24c7c63a87761921be9d696d1c23d27fdf8

SHA256
18429fca3e58242020d59ec994b64e8bebf68fc18ed01bdc92d924fdd9406f9c

SHA512
abdf817ed55e6036f6b398da0a422f8763feaf1dbbff2c6f2097edff5d6e8e20848c6f89af0e3ea3c9e9cc6af07f4f1032d532108eae63f1dfb3ddcee3631fa8

Download Submit
/data/user/0/net.zyxd.lxzs/app_webview/Default/Web Data
Filesize
120KB

MD5
a48cd9324b1f8754b07f00d863b840f3

SHA1
11c6614775b35a58f440971dfc87c8aaac6d6173

SHA256
8859a216183793485d4699bf69d7ed96904679834188d07b9a70424d47eb1420

SHA512
35fa712f0af4a5eeed7e00e4e59ed5027dc6609d268462fe79d92043be9ae0c5961ce9e1d2f64b1a196c9b6aa6242b8b83817b3ee4c1058596c58a99c45478b1

Download Submit
/data/user/0/net.zyxd.lxzs/app_webview/Default/Web Data-journal
Filesize
2KB

MD5
b921e126096fa964676b67554188575b

SHA1
e0274d3643ef3775cc011431dbf4ecf5f1d73922

SHA256
48f7de72f97e26b1ebd4dd0a4de611b09d7cea553392d8af9dc80a72e1d3cc4d

SHA512
0386163bdccce5e17d619966081850d13f80848ce65f68aa2d447ef5555d927337bceaaf076632d84be4a7c808da80ef20f5416ab11771f35b1045ad002d5fa0

Download Submit
/data/user/0/net.zyxd.lxzs/app_webview/variations_seed_new
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/net.zyxd.lxzs/app_webview/variations_stamp
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/net.zyxd.lxzs/app_webview/webview_data.lock
Filesize
19B

MD5
4b95d09bcd1e7d6180d3280b55be0cc9

SHA1
df8df9cf91422b5244c34938e858e2dd953dcd0f

SHA256
6e57673c78f05bb9b88a4a5fafc096ab6db1a2973aacbc689efa840dc9d01b1c

SHA512
c10469c2e18db43f1781b2a825104cd3a5c47a8eee04e42ccf3a971cffa24b2e627dd8198eb190d185f71ff80c2197b49f9ff479d5ee49faea7dbd155fd470df

Download Submit
/data/user/0/net.zyxd.lxzs/cache/WebView/Default/HTTP Cache/Code Cache/js/index
Filesize
48B

MD5
6d7d499960179766cd4261d12dacc411

SHA1
e6f8553b0015e12b23cc551afe98763f3b1c9bed

SHA256
c96ac03cfdbc6f4c1bdcdf764f1a6573f852e7aae5ef405969516b93ed271182

SHA512
6526c668477a01a850b8757b77dd3e7be27ad1991f5cf777685efcb03a21f31b71f6eae00f326931599baae4b16360e33e3d0f2894f1b2c1753391df02a14547

Download Submit
/data/user/0/net.zyxd.lxzs/cache/WebView/Default/HTTP Cache/Code Cache/js/index-dir/temp-index
Filesize
96B

MD5
374406098d03a529ecdf2f264216c014

SHA1
e21f759091e445f8a118c6e40e14d071ef1ae68c

SHA256
6bdacbd31676ce155d2abe8343dbee50b023b70079bfae53a26c516e97282b9e

SHA512
fc780e47599260fbd0e6fc1a1d5c9047f590ce311229bb08b0a84d1120be9fe6f6ebace2f242f2a2d0b5a32c4f471c5d98220ff7d4fa4da58bc2d51ca9a74c75

Download Submit
/data/user/0/net.zyxd.lxzs/cache/WebView/Default/HTTP Cache/Code Cache/wasm/index
Filesize
48B

MD5
6d7d499960179766cd4261d12dacc411

SHA1
e6f8553b0015e12b23cc551afe98763f3b1c9bed

SHA256
c96ac03cfdbc6f4c1bdcdf764f1a6573f852e7aae5ef405969516b93ed271182

SHA512
6526c668477a01a850b8757b77dd3e7be27ad1991f5cf777685efcb03a21f31b71f6eae00f326931599baae4b16360e33e3d0f2894f1b2c1753391df02a14547

Download Submit
/data/user/0/net.zyxd.lxzs/cache/WebView/Default/HTTP Cache/Code Cache/wasm/index-dir/temp-index
Filesize
96B

MD5
707293a3d680d2024361ad120419eba8

SHA1
55b759596af27b2b8dbca6bacfd9b0f35c9b1f13

SHA256
6cd1e48b955dd7df47cc8e4fd2652cb166a420b0fbfea626c0e8307e8c565d5a

SHA512
2f6ee8a8aa514d0e8b98a250dac9566a777c5a62e8ee81636fd4ff9322e9053cb8f781eb4a0995dc26984e04798fef07ba491e9b0159079474103ff5a321c746

Download Submit
/data/user/0/net.zyxd.lxzs/cache/WebView/font_unique_name_table.pb
Filesize
57KB

MD5
f080fa2a56ab5479d58063e5ea871447

SHA1
4b3fd57a98916fa5784305b76ba30af26b5253d9

SHA256
0aa374bc456330fd1b5daf18d25b4bb8e2df1998dfa85466f2c31843ff56e815

SHA512
8aee3186a95b389d39882620b7c4199a29aa50580aa98a381b2931a934de6406943c89d4d00ebeabff21e2b03b4a4adcc01e37e32a2335c4838be24bdbf61936

Download Submit
/data/user/0/net.zyxd.lxzs/files/.jglogs/.jg.ac
Filesize
72B

MD5
1f1f418332f0f23be74fab0dda556974

SHA1
12e31cc753ce3200bea9949ff51427befd1f8fc5

SHA256
3b282e5b88f174b73f254226f22a262f71dbac57c102ce50262fbaf261a70802

SHA512
4c7b1d8145f59f90da9c4e18952c58c16d04e359e59020613b5ef1f479d79302f9ddbb943077228661c6b5882c90e9ad9ac404c96dbad101415bdae9e9a760d4

Download Submit
/data/user/0/net.zyxd.lxzs/files/.jglogs/.jg.ri
Filesize
646B

MD5
04bef2a36015e1310666708f6c9bae37

SHA1
a164fa665cf5751c50feb10547d79947bd6241aa

SHA256
1988bb1facd597644392bfc88ae0258474817f868703da6981401d3b2463a6f6

SHA512
87655ccf3743ce08ffacb75787f30eb29bf81b7d91d6182bcef24b3fb5a9f3b1633088ef6453fffa41e1451a5b192cdb3119a295966f3aee46ebe44c06c5fc9e

Download Submit
/data/user/0/net.zyxd.lxzs/files/.jglogs/.jg.store.report_cf
Filesize
32B

MD5
ed4a34058f58860f854fd283857d83d9

SHA1
97989bbb2d086361e04435df2513cb55402ef13b

SHA256
673e32ba206e69f82c58b6365d4d911a1aef04c3a9377ddbe08a4119fb53298b

SHA512
b42827eec04b9fdc5811e9412b4e8222562bc9911a31f98ed70e4a6d64e633e60a320a2030bafc75252caa109d78fb0fd73ac99f6fd5acd75370209a353f3f18

Download Submit
/data/user/0/net.zyxd.lxzs/files/.jglogs/.jg.store.report_pid
Filesize
32B

MD5
5e34cd766ea1b25eb0ff24160cf5f6eb

SHA1
e0b59298ac9f458c05777adaf10e953b7be94563

SHA256
7e9b2cf8eaf25466c174076fb2882e4ddef217ac45f26e99c3dc38934dd1f101

SHA512
a7938783df703b9fff051f9ac52d63e6e7c83e03850d44d59da0b0a17cb6d0c4585232aee46a68165a1175112f45c9eef43d1a9d91f5cbce73f82017a16a1c56

Download Submit
/data/user/0/net.zyxd.lxzs/shared_prefs/WebViewChromiumPrefs.xml
Filesize
127B

MD5
97ccd9a2b2063143df56b6937f961ca4

SHA1
5e78a91ae5df289ce83443cb7d5589dd3504fb5d

SHA256
248ff7928128015b1cfe3e6517c8f9b8c9511bfb8c8baf44fc1370640eac61fd

SHA512
86c05a5bb3d7eedea390664796966e9e5a5bf846c85808da54407788a76b3ee25b91428242a1e76d8765bfe51e1ba3636617fbab6e7dbb39fcc433e07c3fcd3b

Download Submit