Analysis

  • max time kernel
    2921678s
  • max time network
    146s
  • platform
    android_x86
  • resource
    android-x86-arm-20230831-en
  • resource tags

    androidarch:armarch:x86image:android-x86-arm-20230831-enlocale:en-usos:android-9-x86system
  • submitted
    19/09/2023, 15:52

General

  • Target

    4c52e6a16bf9df19fa77455a7c87eaba81fcd094d547004306122d83dda36bdd_JC.apk

  • Size

    3.5MB

  • MD5

    2bf79ecbf3a9cf2b7e8e4d99087a74a5

  • SHA1

    2456291fc376aad939c5673029440876fd59e45e

  • SHA256

    4c52e6a16bf9df19fa77455a7c87eaba81fcd094d547004306122d83dda36bdd

  • SHA512

    b3db8899ecc4a24e78dc37cb4e5d9fdafc209770cd60060c0eab781a15ed4bde4f535cba18860eb2015b03efab1320e52ad0986a53d412145cdb1ffd2c52423a

  • SSDEEP

    98304:lSPL6efffnRcj7jGPJqQdG8BMSqVauu3kKSz4hz7:lSjXcXgOVaj3tG4hz7

Score
7/10

Malware Config

Signatures

  • Acquires the wake lock. 1 IoCs
  • Reads information about phone network operator.

Processes

  • ir.shz.shzkisi
    1⤵
    • Acquires the wake lock.
    PID:4135
    • ping -c 2 -W 10 -v google.com
      2⤵
        PID:4185

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • /data/data/ir.shz.shzkisi/cache/~test.test

      Filesize

      4B

      MD5

      098f6bcd4621d373cade4e832627b4f6

      SHA1

      a94a8fe5ccb19ba61c4c0873d391e987982fbbd3

      SHA256

      9f86d081884c7d659a2feaa0c55ad015a3bf4f1b2b0b822cd15d6c15b0f00a08

      SHA512

      ee26b0dd4af7e749aa1a8ee3c10ae9923f618980772e473f8819a5d4940e0db27ac185f8a0e1d5f84f88bc887fd67b143732c304cc5fa9ad8e6f57f50028a8ff

    • /data/data/ir.shz.shzkisi/databases/google_app_measurement_local.db

      Filesize

      16KB

      MD5

      a57ca81f017e5497193089ed8fe35622

      SHA1

      84b8bb24f9bb9d44e882e925605010302643f25f

      SHA256

      3fb3d6dc5116dafa3ea68fee9537b19d2de58fc524c88ee6958e85a3fc737952

      SHA512

      d0b7e929a64ac9b8c7ce1c9559184a0d74579cc706786090118b531e8e6d215f7831f64ffae3574df32cbb133230a1b5d2d39d4d231e8833b1958b149a207436

    • /data/data/ir.shz.shzkisi/databases/google_app_measurement_local.db

      Filesize

      16KB

      MD5

      763472a4e1fe2ac518856b2edb58d1ea

      SHA1

      14c2bca43686f2d81cfc7cafdc8853f1ff381a45

      SHA256

      8195c456065acc21d1646f306db2f3c04f1680c24e1acd3e3600676fbf79011b

      SHA512

      a066fb1ffe97eb960b0ec7735543b8fd8b6f5f21885be8c5832d5e3818688474a3c8e78a24552bc6e3419ca4ee92fff16a1bedc451362ff9853c5b3d5075080b

    • /data/data/ir.shz.shzkisi/databases/google_app_measurement_local.db

      Filesize

      16KB

      MD5

      5e7c01dfa78212c3a277005427ff3c70

      SHA1

      bf696e6769732cc746157e10cdb9b157a18280e0

      SHA256

      26ff088e9d20c2020efb02e622c1061bf39c3405e1c09a914d8a787e1a0d8205

      SHA512

      a679ede4c61eb44dc279d05e439a43275df63ac7acdf1ba38919b7ad3d01af3f1fb939ce54aa8935a2d243261aa2da5ddc1259324ca14c7e3147ef357572ecf8

    • /data/data/ir.shz.shzkisi/databases/google_app_measurement_local.db

      Filesize

      16KB

      MD5

      4b503bdbabe4d61bdea65a35a57be7f1

      SHA1

      148220ddebb0e34d9a4bd42464795a61551b503e

      SHA256

      e9d8b9ac9d48db20640a07601c3f36f9c7fddf8ec4dbc3b40d6d9b6537e4c36f

      SHA512

      6246e990fc496d0c66292c952c628099a71037fa8da61c8e0ba78c5363a3897aaee555ee88df8814dc88e07ba0cd5d08b29cbc444d24fb585366ebb6f684b37b

    • /data/data/ir.shz.shzkisi/databases/google_app_measurement_local.db

      Filesize

      16KB

      MD5

      3e881d9a01ca707bed38018ac69f4518

      SHA1

      5820f9351d7cc8082de6e5686eb9f8fedf6fb830

      SHA256

      4a5bf9bfe9b032546f886dd5fe6717de78716734aaadab620c0444ed6df5151c

      SHA512

      8f0395c94b3a449f3c61e7117f400c7b8a12c23d3655be6772bce2c8aa0ec8d8be8000c5cd2c6e10b334ef54a4add5583717393c3239da80c334c45b8b392db8

    • /data/data/ir.shz.shzkisi/databases/google_app_measurement_local.db

      Filesize

      16KB

      MD5

      7237409e0640cfab7bdbd429bf821a3b

      SHA1

      4c3da934842f8d4835dfe2a9c275a300e5123309

      SHA256

      5c8e1b63d187efafe1e09bfadd83fd360176d689b57b5a0cc40e6854c12449fa

      SHA512

      c8afaf6a8ee43ce3601feff417bfaec563c01bcff0aae24577054034112b2020967f25b0b1a919c3c9e5e81d62a21a87e908b782c4d5cb8bba8ac259108e9c1f

    • /data/data/ir.shz.shzkisi/databases/google_app_measurement_local.db-journal

      Filesize

      512B

      MD5

      fad51efbf7faf2c11ceb436b443c2f12

      SHA1

      ba89a5be1b1b8fa858b9afb648306f874143d48c

      SHA256

      0155422189d572fc7af98fc434192a51d48af04f9b971ba7cc1b4b62253b7e3a

      SHA512

      b7f70b0da19331529b3e55c618e7a1cbd291e8e1de0ba0ebf51fb1bcf73ce6e948941d105f741404fa539f7011292dd1b042f23e21f83ab5d587529931f3c083

    • /data/data/ir.shz.shzkisi/databases/google_app_measurement_local.db-shm

      Filesize

      28KB

      MD5

      cf845a781c107ec1346e849c9dd1b7e8

      SHA1

      b44ccc7f7d519352422e59ee8b0bdbac881768a7

      SHA256

      18619b678a5c207a971a0aa931604f48162e307c57ecdec450d5f095fe9f32c7

      SHA512

      4802861ea06dc7fb85229a3c8f04e707a084f1ba516510c6f269821b33c8ee4ebf495258fe5bee4850668a5aac1a45f0edf51580da13b7ee160a29d067c67612

    • /data/data/ir.shz.shzkisi/databases/google_app_measurement_local.db-wal

      Filesize

      4KB

      MD5

      49b16a8c866f3bf3b6871af2c38ac6ec

      SHA1

      5919f693d7e2f6ea9a053c4a7f1ea3defc00baff

      SHA256

      1a6ec7f60cf5b595ee210a27ec23aacd54241544a8863d4c9c8caa6799edd795

      SHA512

      1588cff1329f9cda89e7d4c62cbcfdaaabf29e3d47d4266f90b1a5fcbb01db32f885a3fe92086b85038e3685545c9f4d4912def9cf8836baf7b87ebae6c5f781

    • /data/data/ir.shz.shzkisi/databases/google_app_measurement_local.db-wal

      Filesize

      4KB

      MD5

      e4c1cfd22524d46cf3e7f0c37d6c5c64

      SHA1

      d725f9263f9b315d74d5b636ecf1b702ab58ddf2

      SHA256

      ffde5b7710763b6bac5bc238ca39590dd8b929564025ef79efd8166d34c66a6c

      SHA512

      ca0c06df2ff9d65a613d2cab9efe74c9bbb9c22ae6f5229b68b8536ef2767c0552cffbbf25fb24e9bb45707b81323a68d77012347ee201a6b6ffca43133f536d

    • /data/data/ir.shz.shzkisi/databases/google_app_measurement_local.db-wal

      Filesize

      4KB

      MD5

      bf6f56c4a0dc470daa0f1f5e111f69f3

      SHA1

      7c804ff89c2966b70e50bead2bd34eeb9dcf8554

      SHA256

      90b7b4618b48a8eb879ce2838d4a19b45dc4220f7f1d48282ccf365a4e08a0b6

      SHA512

      0b9ec9ac20b042138c55e6918cd3f837cb82143bf68ace8909043c9390740661fa75e5f19a70b81dbb8a421f2059341f770f2badae51e18d788d252d9411e152

    • /data/data/ir.shz.shzkisi/databases/google_app_measurement_local.db-wal

      Filesize

      4KB

      MD5

      ff3f07f1d81f869b6f40d7ee1bc0891d

      SHA1

      db532177e791faf6ce60ba3b60fac399690a2e3e

      SHA256

      721820bb9c85dcbb1a4d64c814e39deb668abf1314475e133c2d38c546998d21

      SHA512

      866a1507c5db7e445ee4e08af7b3098b3ff7746922d18f27b457b29f660f97574c71aabbf39fd7e171c475bf7cfc1f504a8b62860c50265d29ad95f7c87138aa

    • /data/data/ir.shz.shzkisi/databases/google_app_measurement_local.db-wal

      Filesize

      4KB

      MD5

      66fba1181d6314967b00f3de517d43a4

      SHA1

      0cad3a0f5402233fa867b7571c97185263702892

      SHA256

      66503213686f5cdd622b1e898defdb8f219aa29f2b694f932d09821838acdbde

      SHA512

      189122f6154a39b3105748b49fc65ecb61c2adcb845fe37cf591e13af328ac5fa8f00a41519945c7eb25eb79551f481f82322bfaf566330d01479d72821d744d

    • /data/data/ir.shz.shzkisi/databases/google_app_measurement_local.db-wal

      Filesize

      36KB

      MD5

      885bc108f4c423b5c4af016a2cb74a3a

      SHA1

      34751c92b3055d8f3885131a7678c1b6802f2683

      SHA256

      daba7f7aae3d190fddd3029958d5c777f2e750f60b68022193a801887a659adc

      SHA512

      46fe9456e7303c79d72f8df71d4e321e4d6b29ca370fe9f11050f80b8e75b551d79c025cf89331b25960db9cf8046eb18c8843d92b28361c259e7f1ec7b82638

    • /data/data/ir.shz.shzkisi/files/PersistedInstallation4498697740521548933tmp

      Filesize

      569B

      MD5

      7f34fafa5ea96b49af8e03571f325a4c

      SHA1

      a7ff713f6c4bfed7017d9a9db5f596057f63e2b7

      SHA256

      6b77855a4fd6dd1e40b7d019fa5567040a3082b01b28ec3cc4a299f713e63944

      SHA512

      693b879ca0e5223077a2ebc09b1cdec827a964b2072ae018dea9ba4c3f78d6de2afa2bba3c418faf1d39bcb97ce53788be6011b304ac5f9c9927ba1b5cba90af

    • /data/data/ir.shz.shzkisi/files/PersistedInstallation5665831580269416539tmp

      Filesize

      90B

      MD5

      23a56a454ff5dd68e344e8ad6cb88d8e

      SHA1

      d51536807ddfaaf84711f7fa54771af2e301f5d3

      SHA256

      38a1e110d45b00678f1f911bca616a94b086e8083f181b663d660c60081a9712

      SHA512

      6f2a7f6b68b7e4c3463f456bc7d61587b1cd5a55e67a7a7b4946bb74a983a0056e1671b1d02bc72fec2c54e42951c52a4a918828e5c57d8630c3c545761b4c10