Analysis
-
max time kernel
219432s -
max time network
173s -
platform
android_x86 -
resource
android-x86-arm-20230831-en -
resource tags
androidarch:armarch:x86image:android-x86-arm-20230831-enlocale:en-usos:android-9-x86system -
submitted
07/10/2023, 23:46
Static task
static1
Behavioral task
behavioral1
Sample
5f5c5f80b96558a973bf2dd48df2e684de9d2cbf3d3885493fd284e3a27911d8.apk
Resource
android-x86-arm-20230831-en
Behavioral task
behavioral2
Sample
WeChatMusicDts.apk
Resource
android-x86-arm-20230831-en
General
-
Target
5f5c5f80b96558a973bf2dd48df2e684de9d2cbf3d3885493fd284e3a27911d8.apk
-
Size
94.4MB
-
MD5
a6febdbc9bf6ad1d9e498ddc36ac9a4a
-
SHA1
e133b7ced11b1875d7ed08bdcdddb80d132ff1f2
-
SHA256
5f5c5f80b96558a973bf2dd48df2e684de9d2cbf3d3885493fd284e3a27911d8
-
SHA512
21d234ccd225da5835339545428868158494c44c4ecc4a74419c88efb4750e55bc031b1ccf439c1bdb6fca7ee7c58e18c9b942287652dba1b12c41faf1cd9237
-
SSDEEP
1572864:+YTAcu7n3T+qF3SxqYPuSNg90TJYm97yU244RLpCDB5eOujXEDpwvSg3nR:9/UF3yqcvi0um97rv4RL0DBXIFK8nR
Malware Config
Signatures
-
Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps). 1 IoCs
description ioc Process Framework service call android.content.pm.IPackageManager.getInstalledApplications com.tencent.ibg.joox -
Checks known Qemu files. 3 IoCs
Checks for known Qemu files that exist on Android virtual device images.
ioc Process /system/lib/libc_malloc_debug_qemu.so com.tencent.ibg.joox /sys/qemu_trace com.tencent.ibg.joox /system/bin/qemu-props com.tencent.ibg.joox -
Checks known Qemu pipes. 2 IoCs
Checks for known pipes used by the Android emulator to communicate with the host.
ioc Process /dev/socket/qemud com.tencent.ibg.joox /dev/qemu_pipe com.tencent.ibg.joox -
Reads information about phone network operator.
-
Removes a system notification. 1 IoCs
description ioc Process Framework service call android.app.INotificationManager.cancelNotificationWithTag com.tencent.ibg.joox -
Uses Crypto APIs (Might try to encrypt user data). 1 IoCs
description ioc Process Framework API call javax.crypto.Cipher.doFinal com.tencent.ibg.joox -
Listens for changes in the sensor environment (might be used to detect emulation). 1 IoCs
description ioc Process Framework API call android.hardware.SensorManager.registerListener com.tencent.ibg.joox
Processes
-
com.tencent.ibg.joox1⤵
- Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps).
- Checks known Qemu files.
- Checks known Qemu pipes.
- Removes a system notification.
- Uses Crypto APIs (Might try to encrypt user data).
- Listens for changes in the sensor environment (might be used to detect emulation).
PID:4217 -
/system/bin/sh -c getprop2⤵PID:4255
-
-
getprop2⤵PID:4255
-
-
com.tencent.ibg.joox:network1⤵PID:4319
-
com.tencent.ibg.joox:p2p1⤵PID:4345
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
58B
MD50d210bfb2a0e1f1b4c082a6a0f79de07
SHA1bb8ed9e364db79d1d9f2fcde3f15091893222faa
SHA256988722c23d78a46021d0e7ca9deee7aa8bb83288269174ffacb7316f381cca1d
SHA512536e9867b0df29b15b789f8949be6ab37fcdeccb9d39ded981da7dc2052c9533d0ec0e6f9a5444132977605d372e1463d91bdde41b528ff2ca3f65ab152325c1
-
Filesize
4KB
MD5aa99281ce0cd69a9302f8b64b918ad75
SHA1ccafc0e5fb16198e466b209a888301f4100fafe8
SHA256a3cde8388c50e78c7b3c8dab1d0c46c64c375248031adbb6a5802e3da65bb431
SHA512a8b80f09a555652d3e4b9775b6aa58341dad7fb120509e128df417533ba361353b19530306e8691f1ce5fc0c69f1a89d29bd2eb176291a5e85b945d14c9eb085
-
Filesize
4KB
MD5aa99281ce0cd69a9302f8b64b918ad75
SHA1ccafc0e5fb16198e466b209a888301f4100fafe8
SHA256a3cde8388c50e78c7b3c8dab1d0c46c64c375248031adbb6a5802e3da65bb431
SHA512a8b80f09a555652d3e4b9775b6aa58341dad7fb120509e128df417533ba361353b19530306e8691f1ce5fc0c69f1a89d29bd2eb176291a5e85b945d14c9eb085
-
Filesize
267B
MD5a16b0a7e8c386d9c8a1bcc8b362be31e
SHA1123908e7b445f35fd6e374ca12430c7eba439586
SHA2561ac05df90c736bd4100bf4e905a8c37feffe26b4529f52e1d3f3687d785d3f18
SHA5120a85a98515782516f7d2d71a9ba3d3bbd67d48e43b6d95b0f43916f562e63ab303da2a9435a47439f7146238ab9a6ee00030857e75f74ba2c4dfb36eaedef222
-
Filesize
267B
MD5a16b0a7e8c386d9c8a1bcc8b362be31e
SHA1123908e7b445f35fd6e374ca12430c7eba439586
SHA2561ac05df90c736bd4100bf4e905a8c37feffe26b4529f52e1d3f3687d785d3f18
SHA5120a85a98515782516f7d2d71a9ba3d3bbd67d48e43b6d95b0f43916f562e63ab303da2a9435a47439f7146238ab9a6ee00030857e75f74ba2c4dfb36eaedef222
-
Filesize
104KB
MD5aea419036470026fc0ddffbf3ef185a6
SHA1ac67253077e6a7d8f410b7f2df373b612da575ea
SHA256c823099d0548f65ddeac394ff6defb403e337429ed49ae899d26ab83c2353e04
SHA512827ad273baa6ba5082647744f358faf83e6f507db083d1f924168ef87a38e56145e05eb73dd3fabc293befca563bf61b5219f68e51f3d3bba5794ffcb75de948
-
Filesize
32KB
MD5c168572889d9a24a44e6885fc4e6e2bb
SHA15a0c16baf85e6c9c9acc3d2bb4a536d5055a0d57
SHA256ff6586b4788008eb0125bf30f7e6b138d3048bd1858ca842c55380ed4cc7393c
SHA5128ce5a7818ab7b239b0ce567fe26de8959133eea2e171c262f7f5c7b78f9e2e6a4d6b0a3349545eaf1053ad4d471ba79912634242c09f029908ef810ce3c96d06
-
Filesize
58B
MD50d210bfb2a0e1f1b4c082a6a0f79de07
SHA1bb8ed9e364db79d1d9f2fcde3f15091893222faa
SHA256988722c23d78a46021d0e7ca9deee7aa8bb83288269174ffacb7316f381cca1d
SHA512536e9867b0df29b15b789f8949be6ab37fcdeccb9d39ded981da7dc2052c9533d0ec0e6f9a5444132977605d372e1463d91bdde41b528ff2ca3f65ab152325c1
-
Filesize
4KB
MD5f2b4b0190b9f384ca885f0c8c9b14700
SHA1934ff2646757b5b6e7f20f6a0aa76c7f995d9361
SHA2560a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514
SHA512ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1
-
Filesize
512B
MD559e4fff45e684a0932ec4d3f680d37d8
SHA1c192a2f4ce5e4c3f732b3b0610ddac762b47783d
SHA2569d0e93beed0c92404a924ba1f5c5423bbf491a886a9a6626bb548184f4322c76
SHA512b243da0286b0e40e8d2bf19eb6f9aa4a71c953163a8684e238f8f512527e6ea810afaa7ea100268546ee2e8d7c7a8393f723cc5c7224241e0c560363b81a5eac
-
Filesize
32KB
MD5bb7df04e1b0a2570657527a7e108ae23
SHA15188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA256c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
SHA512768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012
-
Filesize
329KB
MD5499b74de4f754eb7d9cf20f77ca07ad9
SHA1ec9e49bfc1fe2bb5e8e27981d1b43348b4a4dbc7
SHA2565d555dc2fae25547731557d2ed26bdbdfc08f05fbf7e1248bc1afe33b74feb4f
SHA5126eeb18d5d14fda400bc657f644b74e7d3b2bc553c9bea433239eccbcb3a29391bc6fa42bf4983648ad44fec548130c91b6a16ef8c2ae69f3ff7d34e713ad710c
-
Filesize
4KB
MD5aa99281ce0cd69a9302f8b64b918ad75
SHA1ccafc0e5fb16198e466b209a888301f4100fafe8
SHA256a3cde8388c50e78c7b3c8dab1d0c46c64c375248031adbb6a5802e3da65bb431
SHA512a8b80f09a555652d3e4b9775b6aa58341dad7fb120509e128df417533ba361353b19530306e8691f1ce5fc0c69f1a89d29bd2eb176291a5e85b945d14c9eb085
-
Filesize
512B
MD5d0897e92b6d8a701082ae943226b1484
SHA1a9c541016d38484236ae648ad09f6ebdae898e1a
SHA2567a30337d3a927a30c7f79b696aae6dfaa37092a38cff41958b71234463830821
SHA51295d9f9a33306479b84f5db9a42644876fb70a99364ccc97061079b17b813c4e21b0c4bd2fc0eccf3c6d7740a6111f177df2cf30e3c59d756c8cf4728a191d9a6
-
Filesize
32KB
MD5c168572889d9a24a44e6885fc4e6e2bb
SHA15a0c16baf85e6c9c9acc3d2bb4a536d5055a0d57
SHA256ff6586b4788008eb0125bf30f7e6b138d3048bd1858ca842c55380ed4cc7393c
SHA5128ce5a7818ab7b239b0ce567fe26de8959133eea2e171c262f7f5c7b78f9e2e6a4d6b0a3349545eaf1053ad4d471ba79912634242c09f029908ef810ce3c96d06
-
Filesize
104KB
MD5aea419036470026fc0ddffbf3ef185a6
SHA1ac67253077e6a7d8f410b7f2df373b612da575ea
SHA256c823099d0548f65ddeac394ff6defb403e337429ed49ae899d26ab83c2353e04
SHA512827ad273baa6ba5082647744f358faf83e6f507db083d1f924168ef87a38e56145e05eb73dd3fabc293befca563bf61b5219f68e51f3d3bba5794ffcb75de948
-
Filesize
4KB
MD5aa99281ce0cd69a9302f8b64b918ad75
SHA1ccafc0e5fb16198e466b209a888301f4100fafe8
SHA256a3cde8388c50e78c7b3c8dab1d0c46c64c375248031adbb6a5802e3da65bb431
SHA512a8b80f09a555652d3e4b9775b6aa58341dad7fb120509e128df417533ba361353b19530306e8691f1ce5fc0c69f1a89d29bd2eb176291a5e85b945d14c9eb085
-
Filesize
512B
MD5d39f371633aa6d7f499e95728eaf98af
SHA11235fe83f756ef50c96ffeeed89e76a67d7fc10e
SHA256ee4a1c4ac1b1d2ddb93aacd44107e306e0c8eb35eebfa46438ecb13354633689
SHA5129189f1a2e5539f4a963dbd6c923424d0606fb37c9bc234fd9f7cd33b95c4e6045ec9bd9c93c54485c30a7669bd55c809babbae09aa6980bdc30994111e3dfc4c
-
Filesize
32KB
MD5bb7df04e1b0a2570657527a7e108ae23
SHA15188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA256c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
SHA512768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012
-
Filesize
342KB
MD5d6a9ba00bf3e9b3932d1a91ad162f817
SHA16ed184c121f80771d7c169bf00a8bdeb46f05dec
SHA25652be08bee6acbdb3ac32840847ac05ed347a081aa6bc4845c63b88744725f4a8
SHA5129ccdc214790e61b3a9d4dc381764ad19fd3d490051437649d1162dfea58980955088e6aa07ec2c6b888a638cd09dae2a0085bdaa7e7f00906872c0e0d079b845
-
Filesize
402B
MD53f1f3fb6ff2641caa93452d2e24d0bbc
SHA11358b7c67e1176dbc1bbc14848805d42a659cdad
SHA256a6d585b6117e3c863a3a4e5448f94f8bd5656f8c22b599978019cd460684577d
SHA5129bdfa83ced25fa08c70be653621235cdb662623e708142ae6eaa69dd8b8158ebdc3a53419e0c1056a0500fff30dd012380c21f9b8f8d8eaac6e6d9a9085828f0
-
Filesize
402B
MD5dfebe0c34c07549b02e56b0cf9d8c50c
SHA1f3f589b759836a5de06e611c69c405a9895979cf
SHA256836ff9f06787051d2531650c156fa9fbaec27b4457c853ba6dcfa2a61b768e11
SHA512fe7de17d92db6fd4967bc7f1e18c3cf50c5dd95160fed149e2ef3ca1a2881f98241548438c86b611193a891cbbfef12041731a7c402116d093ff84b976d85917
-
Filesize
150KB
MD506ae8a01d80da962c7987c264af64cec
SHA163a497994321f254b535a846ce89f076d4e378ee
SHA2560c5cc90b079d0d9c1ded1376357d23a9782a704a83e01731f50ccd162e246492
SHA5128720928fbe7cf8351c9dc45cb1a9c8243939c7e3c9c6957d24dbe18c0819d05ea7475e3953018f0365461fb2987ad68d8ec9f59b03aef3adbd3e4ae8ebbd0427
-
Filesize
150KB
MD506ae8a01d80da962c7987c264af64cec
SHA163a497994321f254b535a846ce89f076d4e378ee
SHA2560c5cc90b079d0d9c1ded1376357d23a9782a704a83e01731f50ccd162e246492
SHA5128720928fbe7cf8351c9dc45cb1a9c8243939c7e3c9c6957d24dbe18c0819d05ea7475e3953018f0365461fb2987ad68d8ec9f59b03aef3adbd3e4ae8ebbd0427
-
Filesize
150KB
MD506ae8a01d80da962c7987c264af64cec
SHA163a497994321f254b535a846ce89f076d4e378ee
SHA2560c5cc90b079d0d9c1ded1376357d23a9782a704a83e01731f50ccd162e246492
SHA5128720928fbe7cf8351c9dc45cb1a9c8243939c7e3c9c6957d24dbe18c0819d05ea7475e3953018f0365461fb2987ad68d8ec9f59b03aef3adbd3e4ae8ebbd0427
-
Filesize
775B
MD5d9e46cf6758ca008ea1828034066eb0e
SHA10fb8b41fbcf16d77fdd6fbc2543b74bb38ea2197
SHA2564a75ebcb4033115ad595bb92930e3e21f630dd93157df6c2f8b9346e3b58bef2
SHA51223ad2cacdece59c36309ebd110572bf5fe39e204f2aa48690716adcd117f07d5ca8fd709ca4b97c034aed06c6ede8023e2f5a485cdd47f31479b056ae2ca8485
-
Filesize
1KB
MD567a7c62506ef1a844f8d6445f4743a76
SHA12f3a8d39e18071b00348ac9f28b36b310a4c4a0c
SHA2569e8d0ef2c3aad4cc27f43cd893114ac4a6ed2d2eb08c5f218e5191ebf6da713a
SHA51258e7292baa41f902c4ae1cabcffe74c25455f664b4365edb5267ac5ab068b43f96bdad2363ca6a5862896e277e4fb98019fe19074af3a95134431c7bffd2daf1
-
Filesize
1KB
MD5b2e65e3086d1747ac9c5a7457b74dd9d
SHA1d602d4fc10cfeeb38d5da12780e20e2a3b649551
SHA256c461b7fb1636ad60c60122c2bf9acfa68dfae4802fbd4e30c2c88b19ec3ce859
SHA512e84788d2254b5d83db5214499b26656dd096ea6db81e003420ec1b858bacc0dadd91300a1a7dab4530d0ced51843fbbd7400b01ab9b5e6d0fa289c92420fde74
-
Filesize
2KB
MD53603f5fb5c42f02286ce93ea167dffbe
SHA13ca38a29a0d2c3f4f5a1dd4ac22a7f20315c144b
SHA2567f2a16082ac94a562b68deaa67921b47b432db492846f669f3b03bc71b649fde
SHA512cfa4fb2b43207b5c72170b3a63be91eb393488a7e1c15cedc07140f504345b9733430edcc02e84cbb2192468b279816c84b080b97b80346c4ee7e996a8ebfe32
-
Filesize
357B
MD500c6d5b99aa6c01fd248e4ca0f035164
SHA14301525c887128f796309e5c29d5fa7acaf34a47
SHA256d20eb962835fd0a52817cedc28cacf0b744e8a6029c4af8cb0cf0bce0d7c959e
SHA512a3a940b5f3ca477ccca21913af74c051451fbaa8ac3d9dee69a5eeb4a6e03385d146691c0489d5116aeccab3de2177549182f6cac38f41a33ce79b4d2e1c8d32
-
/storage/emulated/0/JOOX/glideImagePath/glideForMainProcess/1c2d68a8a475f4ae280cb1a50d72d37ab1d8996f16b314507c208ba44acf066a.0.tmp
Filesize47KB
MD5296448d84ad8dea6964e1d607c0b3c3f
SHA1137fe23ec000445231b2a54adaa7f868458690e6
SHA2566c642eb4941b0a53c6b10579538365a4ff920a15bcb6ab2f03ff7b3bf86c3bf7
SHA512df2bfa5e37fd400d876b39763113f20bdd730841220374a81ff639c1a233bb4e981a9bf2e9f95b233593fb2450b057d45ef8be7144b5deb983b6786c2a408d48
-
/storage/emulated/0/JOOX/glideImagePath/glideForMainProcess/8e8fc86f585958d32205fbf670526f590bf3d6f503411fa7fcea157d88005a3e.0.tmp
Filesize21KB
MD5680642bf17ff95331eb0e88c134f3605
SHA1cd440f7fae151600eb149121808da9be165d1d5f
SHA2568ea126af3a5bcac43392c3388bb8d4cbf3838e7d1a851b0c039e035671759c9a
SHA51212a70326b0ec11371d27a27541f1eed3931acf4cc7209f9d6efc28193a033bb5cd4df60ac5fb88b9fa054fd298edf1aef7e5705a69c11e0d4b305096be1e3851
-
/storage/emulated/0/JOOX/glideImagePath/glideForMainProcess/e77e56d6afd16bbacb9ddf5d8a1a9302b19d5244efe04faae0aae41905d05dbe.0.tmp
Filesize34KB
MD5e1e9365f36c53ce9b71037a3928ea4d2
SHA116dfa808498127ded5a3d4c976debc62d1477b76
SHA256db26bb6fb77eb32eb34424fa4f929bd4ca01eb56ea2586753adf952059e21ba0
SHA512317dcc7e9ebb2f162b1110b8f7a15ea7f2f6a5ab9ce9e15f947d8d01428f8a60d7aa6c8e96b13b8ac06e302ef25af3c70ec139fb43f1c928c4f4238eb625126a
-
Filesize
475B
MD524ce41fa55f838932e82e30b62a47134
SHA1fc7b667ef9e4ae382bf92dc49e183ef0b3a9b883
SHA2561a9f6ebbb8ba07aedeb4a36a8795e82459954199d3d8da676c9c31e2ac0c2714
SHA5129041c11ce8ca40c661ac04965ff22db7a2a6184a0063fb42f38aaa013274e55c8df8a62c465f990bff6a3d57a637b3c65a02e7e45013ef9d648d5eb88edad3a9
-
Filesize
31B
MD58c92de9ce46d41a22f3b20f77404cc1d
SHA18671a6dca00edb72be47363a7071be65cf270373
SHA25668bb33ddeed9200be85a71f70b377985f9ee68e91578afbde8321463396f1274
SHA51230f45fe9954215d6adafcc8f0a060a7ff41963a64f9b849a37f0d18fe045038d429ec13bf15226769c4ba78dad3c52f3d9e0dbbb4fcdea4828a1efe956e48f56
-
Filesize
2KB
MD5a0700cab52d4072c17a5589a71412fc6
SHA1533bada9baa2e459c0f93e159f420f2f75371fa2
SHA25698feda81a8c8e3331f85965edfe3afabb30c08464411ac06b77025134122cb0e
SHA51211de8aeea913a1b77b81fefeff381b17941b43d22d8d2760f15f709c19d257b3218c1e5b2ff8e0ef955f647f51347c67bff4a7a047b73a25b94cdedcd3120c10
-
Filesize
7B
MD5a05836db956895f06950d64f1ea23254
SHA150a4b8120a2cb51047f2d80029b109268c7c4fe7
SHA256eecf994c41c8292c890946455df9698230c58a74271c407cfd67b043bbd73392
SHA51287aa616d003514f597f0934b52bade9d3ab5755c116189083cc8bea96bea0cba65c41b8f75eded480d7738b3d6020cdb16d4f8ce5a4aed2d01274c9773b5e60d