Analysis

  • max time kernel
    2259794s
  • max time network
    159s
  • platform
    android_x86
  • resource
    android-x86-arm-20231215-en
  • resource tags

    androidarch:armarch:x86image:android-x86-arm-20231215-enlocale:en-usos:android-9-x86system
  • submitted
    19-12-2023 23:45

General

  • Target

    6e4cf111869a9ca95b3038bdae86da706475fad0b0c96b1d55651a0e03b827cd.apk

  • Size

    5.8MB

  • MD5

    c26b0c4b55b93a61f409ec3d54218972

  • SHA1

    335abbc0207096137bd588e51872ac56f902bec7

  • SHA256

    6e4cf111869a9ca95b3038bdae86da706475fad0b0c96b1d55651a0e03b827cd

  • SHA512

    e7d61c7480d44ef44af6273f3ea422bdb90c529636ec7440a3bd702771ebd4129f200e4574dc913f0d9384e238a610f499b362937cd54b416f076d947af8d1ed

  • SSDEEP

    98304:IA21LyemNIW1/BCGNyYGjT+beiyiJfRqjcc1STKzDD1w1twpHTOw1twpHHa:I18JfCkyY2TViyi/qjcoS+JCtiiCti6

Score
8/10

Malware Config

Signatures

  • Requests cell location 1 IoCs

    Uses Android APIs to to get current cell location.

  • Reads information about phone network operator.
  • Uses Crypto APIs (Might try to encrypt user data) 1 IoCs

Processes

  • com.sanyue.jianzhi
    1⤵
    • Uses Crypto APIs (Might try to encrypt user data)
    PID:4242
  • com.sanyue.jianzhi:remote
    1⤵
    • Requests cell location
    PID:4286

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/data/com.sanyue.jianzhi/databases/banner.db

    Filesize

    4KB

    MD5

    f2b4b0190b9f384ca885f0c8c9b14700

    SHA1

    934ff2646757b5b6e7f20f6a0aa76c7f995d9361

    SHA256

    0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514

    SHA512

    ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1

  • /data/data/com.sanyue.jianzhi/databases/banner.db-journal

    Filesize

    512B

    MD5

    b40d973ef931202af53296047371a1ed

    SHA1

    cd05f7c0ebd6e8640089f2c1e368119830a7ae05

    SHA256

    24fff9d0269942c51fe00f76453b83853a621fca29473558ae53346b37c1229e

    SHA512

    3ee0f2e4c97bf611fee3a56e19bc312d32a2dc306fc8793e8834136ca703170d651cb74cfb3cc8772b02d5080676c3ee040377493b5e9d317de17504e4b7b061

  • /data/data/com.sanyue.jianzhi/databases/banner.db-wal

    Filesize

    36KB

    MD5

    308eac6fff52ea60338406471d65d3f7

    SHA1

    0e3c293669f5b2f2ed57a44c8edc825da6c289ee

    SHA256

    b9205076c9c5654de16962633af000f6ba489f8a7da2f59b16bb10c43b1768c7

    SHA512

    aa25c1650771d71cdf8a6ff6bbb08a21b202b4b7b35c9b571ba2b84c2d5f4df64de8dfe50869b7218b06de254f86470ecdc07c6053dac3fbf46ae0cf72f5b7de

  • /data/data/com.sanyue.jianzhi/files/CMRequire.dat

    Filesize

    1KB

    MD5

    25e57636aee83606d202f04f26c2913b

    SHA1

    1ef0ade456ba38aa31584d0fbce647d0ba74b399

    SHA256

    89c56da41f0046c9e733fed330d2636d623510c217f72c2d025df3343dc66783

    SHA512

    3a8d294b8be98abe4d18116cbf7c16d44a541d1d20dd4dfbbbf3bbd8cb7997abcbaf51790bbc1978135d888c4e89868a9a2575d9cfed65a331969de77ba07326

  • /data/data/com.sanyue.jianzhi/files/VerDatset.dat

    Filesize

    172B

    MD5

    caaa975d7bf4952bd5dd695ade33f1da

    SHA1

    119373fbb2db036712df72ec9b26c0c2840dfbb1

    SHA256

    d0f94264a6b5c355dbf5c0516202c732bcae471a2401542b2ca43307727a0d02

    SHA512

    db2acdecd236eab67cb67151032f53e51c9c04e754f3c21d74e05cacb1ea5edecbbccbd66ee760624b9cac97b8dd77f568324e8abc2b9c16aa73131db81c8b06

  • /data/data/com.sanyue.jianzhi/files/cfg/a/ResPack.rs

    Filesize

    525KB

    MD5

    0357e8edde36315c0e0a4f5385de625f

    SHA1

    2e6c6f15010e88dac5078f34e31a8ddf5e032f2f

    SHA256

    44764ad74b21113fb17b21899bd0d4c81740544e868eaad680553b3bd0cb016d

    SHA512

    497385b4e3b512f6a4365486d40bf1ed298422087f23a352ed2cec96331b9b012814ffba9c3ba83af5f777df16b53bbe1bf3ab8313902db49011f01a3024cf93

  • /data/data/com.sanyue.jianzhi/files/cfg/a/mapstyle.sty

    Filesize

    248KB

    MD5

    46a9f9a5221dbe4ff71bfcd2ee045c5c

    SHA1

    915cb3bc2f0096dede38afc1cd7f09c8782360a9

    SHA256

    ad3067eb308a9420b727b4f24dc5134bc75b36bdda7a7a7c5651090698dd10a9

    SHA512

    185530752b639d743f99e28369f75626900420dccf598a639065ecb08c562ff98c4a1f6abbec9724d1684ed053774d60402cd2f20e3586a534c8715e7cec2ac2

  • /data/data/com.sanyue.jianzhi/files/cfg/a/satellitestyle.sty

    Filesize

    166KB

    MD5

    3f1348cd6165c9a66a9892565c917ca1

    SHA1

    96f0c939438c494cf3fd89246d458e92c0c7203b

    SHA256

    5fbe3817e4047e14c40b567be4955d7579c8bf7b7824bf8370f5e194ebf9767a

    SHA512

    405c3d1d5f4899cf723509f8e293f2ca1d95a79f7892e93401309372335a6a286f2eae9ee9312f69af10c5bcabd091cd90608898a129542b0abe0617c500d023

  • /data/data/com.sanyue.jianzhi/files/cfg/a/trafficstyle.sty

    Filesize

    4KB

    MD5

    6a86f30539dfc9332cd235fc48fcb62c

    SHA1

    5c202003f6346edb85175b8df7c460793f5512c6

    SHA256

    34bfd1e28c3625f50a23240c4b08ac50a90fd35c5e5f88aed1cf36fa8fe5e18f

    SHA512

    f63edb8270e6cd35e5c6896e2b9153144af0d29303e367a4fa81941b1b2bb0de57fa484badb7ec7f05ebdfa67d77b00c3651572c5f05e9314389887f5546d235

  • /data/data/com.sanyue.jianzhi/files/cfg/h/DVDirectory.cfg

    Filesize

    69KB

    MD5

    4e9eab735928758b860e48b2f9befd7b

    SHA1

    7223dfdd00f8059d3b83c28c6f7d78d2dcaa0569

    SHA256

    1a5650bc57e525ff23c7f0cd058d4574142e772c51a89867a13f89e13b93d6b4

    SHA512

    c7465fab9518be687ee63cbe044f28a4d5c60f1c043fab0ec66a856b2b542c9d99d9ef5812c7eb2033f797805ba37b821572b83eeeebdaac4854a4bf53977599

  • /data/data/com.sanyue.jianzhi/files/cfg/h/DVHotMap.cfg

    Filesize

    10KB

    MD5

    c16f5ca1517683c46e02a6b71aab3c00

    SHA1

    2d09a048d1b8d556d89d4d723947e9e234b5e59b

    SHA256

    13d4fbc0d1cb7c2761641a3632c440f6f1d919dce731b8c32cb35e652b0b39f9

    SHA512

    a692b79382747548fd8be8ed94c06198b143c167be1e96f60d8ea7ee9432a0eb1a0cd73d0704523e487d59443bf7ad13eb36e47b67864e227917d33225e3e62b

  • /data/data/com.sanyue.jianzhi/files/cfg/h/DVHotcity.cfg

    Filesize

    1KB

    MD5

    883c30365d5d377966125dd0c079debd

    SHA1

    d296ec1e3f4badb6e3e6166c1473fb55d4265761

    SHA256

    50112e7ed210b33224fbe1cce568c8e95a14fb47f7d39ec905369e2feb9668aa

    SHA512

    00b1604e206a5d929071aa1cac99d83320eacdbb064d517973a5a36757a8a9eb8a103452c98f24e7c8d29adb4b2843e804bfdcb32902da7e364a0c30f8609b7f

  • /data/data/com.sanyue.jianzhi/files/cfg/h/DVVersion.cfg

    Filesize

    86B

    MD5

    298924848d2517a508f43ff0cc51bd3b

    SHA1

    b9fcde7b86653ead6deb57280a6049cf87745710

    SHA256

    0b6eb1f518059d8c472bab90091bb26d9ab877f6c70fac375412ff1582b8ca3b

    SHA512

    63b88c5b9b971ec52a5f724485d9998bfedb073e84ed63bcf0337e726923510d97a8ddf87371b5620f89ba788af01db58300638fff5031856c77dec8e18b4342

  • /data/data/com.sanyue.jianzhi/files/cfg/l/DVDirectory.cfg

    Filesize

    69KB

    MD5

    65685a117c72fe8fbf5a92b07073c99e

    SHA1

    b115b527f74e4c291edcaab19b316a446aca8f5b

    SHA256

    19bcea79613a5c3bb71dfe6b311241fcbf3534b538f0b147c7e849b58b24b2b8

    SHA512

    e5821a5212f0790db33ec7274f018b08f499557ff7f2f118021a7905573e8dd66e716fb02144919d96eeec7da9db921c756a88cf0a050f65a9f8de3894dcc253

  • /data/data/com.sanyue.jianzhi/files/cfg/l/DVHotMap.cfg

    Filesize

    10KB

    MD5

    cc3fad9057e0940ad4d4c7ad27922023

    SHA1

    403cbbcd7b819733b5caf49ed2a58d654441e99d

    SHA256

    f6d90bd8621889ab994374b4f51a1c3f9b028aab1a2129b8b3b0e1d7c5c37864

    SHA512

    ebaf2b8c56bc15826ef38b36e72ae41765fc723470c6dcc40bf9f31118f252777072ad39a535a79f53b6aa29811b4b21cebbc9810c47e34ef9400246d789ab21

  • /data/data/com.sanyue.jianzhi/files/cfg/l/DVHotcity.cfg

    Filesize

    1KB

    MD5

    1c6abcbbd253448057930ad1cc59ac75

    SHA1

    a5845d1c4bc87b8b4785b456d76edcb8309eda4e

    SHA256

    a46b498ba6586aaa2f246bb34e47f4290ac60273cb86ff662475b0def7172136

    SHA512

    71aba5b2a1020d1925b3844c861cbe595de3b21d665eedb13f1ef0d80477fc091663e0625b09c5f49d4f9d0770970dd0d188b84635e9c75c1bdba9f2a7171631

  • /data/data/com.sanyue.jianzhi/files/cfg/l/DVVersion.cfg

    Filesize

    127B

    MD5

    d54b7b380a5ff46c78283013a07d8e0f

    SHA1

    f697c5f7028ba2679a96d6bc5291c38ff96d7982

    SHA256

    c7ad837b097687d92e0d944815fc70adcb0e1cdc82db28f728d13e8a48d7532c

    SHA512

    ade792589c33179c51305f201bfb6db28c05b2ea098d12bfefc1a5cf9bd3014d53830ce2e71f027719ee1b83b2394c7654b5ddf4fdc7f678840869d2a2787ef4

  • /data/data/com.sanyue.jianzhi/files/lldt/firll.dat

    Filesize

    56B

    MD5

    215ca29bbab5227a2618b88c8a985e36

    SHA1

    8d47454e509dbd60914231441974edd3764916f8

    SHA256

    144c474db22d81602afabef3865185734440adc6bce20356f23cd0e2f4fafdf6

    SHA512

    e4c291a0ac79503eee92b54857dabb3790a7bd70194edc7a4dd4e47276ffb01392f5a806488a094570e62c6059e60b07e0d5b75081eeb996dc1e8482bd6902e5

  • /data/data/com.sanyue.jianzhi/files/umeng_it.cache

    Filesize

    310B

    MD5

    5e5a5cfa12ea8211fb8c5ee060ffb5df

    SHA1

    5d288d0e57e38084adde244d1a174d9de7e018ca

    SHA256

    8064092bfd07780dcd3a6eb9759575b8cf3b7004727444821a6082f722ad1fc8

    SHA512

    3c0af7ebabbd9ed49af428736d24d1e904952e3c6d08d64a5939cf339e7a7b211709c04b3d1d8830a154e0f743ff90134df2ce91ee4c5bbb54a2c1d829502bc3

  • /data/data/com.sanyue.jianzhi/files/ver.dat

    Filesize

    6B

    MD5

    8e31aa8d6b61e8b044ac3346e87098d6

    SHA1

    70e4050667039f00eb5231bd731b9f3cb5daf00b

    SHA256

    d2a616114953901b1bbbb79a9be694acc0aafdabc1df94f46002bcd6b75b3a4b

    SHA512

    2935b5e37639b7c631aac8d5073a200d56471b1a06858c0e3dac03e03a89758743b023cedd1ad703e8f775114b39ee0ca808165188c74359d6b1e47fa7e171d6

  • /storage/emulated/0/baidu/.cuid

    Filesize

    89B

    MD5

    20be0467d51efb2a34a41a0e7da1629d

    SHA1

    386ee2bc6e57392c7b378416778af4f5c2464dfd

    SHA256

    5cd23217ba38d75abf273998df517149c68e9e7f905d92a46132f40c6de55f96

    SHA512

    922a467e11f27438d2d9d4abee5c514fab80a7b1cea5e247b34c4e91a48742c2f9a8986a39086a1a82434440b1fc5f4b974c082caaaa8bb6e989aa7add7dfd74

  • /storage/emulated/0/baidu/tempdata/conlts.dat

    Filesize

    12B

    MD5

    8d80bc8ea90e9cac010d3ddf97bda5f5

    SHA1

    f063bc0d356e6ba9ab1eb9a851131ffbefd8fa07

    SHA256

    f52db31332534833414abd5e870f78c810b8ebbe5b134bbf599506beecfd1b93

    SHA512

    9ea732dd572a9a4ba91b70891972230a09576687ca1bc19e62d5a98b5b84e0f2ae11985108008bc9fbccf357219b8bd3dbf146bb70752f618f70dc5d0c46a7c7

  • /storage/emulated/0/baidu/tempdata/conlts.dat

    Filesize

    1KB

    MD5

    672d53ec8736f5f766378375ccfaeef7

    SHA1

    bba81986745689058253b587f538870d0e720a88

    SHA256

    88e4a0590ae8e0c5a16056aaa7f1b25707c4d858150defccd0b29112edfd7996

    SHA512

    85498b847f6a51e3f2f3dc56f677e43d44c6ffe0a8b2bbda00ac737c816ccd1b62cff6864e0fdb1ec081be57e01fc970010bf63ec89576ea6df11c36fffb7316

  • /storage/emulated/0/baidu/tempdata/lcvif.dat

    Filesize

    96B

    MD5

    71a351ce4b747da622fd8d832eac62db

    SHA1

    f8636be5df1e15bd4208a6c8f1e66245b9a28762

    SHA256

    769cfae635e8e6dc31d0a6988e55208e7744944f096e63577e837ce787dfb82f

    SHA512

    a88f99d0024a9598cb56a32d2e5206663ea8dfceedd11a4a40222b4b7a4888065a18c46217c55095a06de8d40d8308cff63b1d1d4ff9a0729c6cb0f724498f49

  • /storage/emulated/0/baidu/tempdata/ls.db

    Filesize

    28KB

    MD5

    0d3e99204c6401ea499fe9e6d9855497

    SHA1

    09829f00ca458eab7374d5079393a2cd69a2348a

    SHA256

    63ad014cb50908591939d6a1536f85eece807425af4f4e8a1f9b9eeab13cc5ca

    SHA512

    8d9a50aa9abd17e508ed3ac35a3033e8f9e550d1088baa951f53e6c4697c5ac026d22b90e36e27341d64baa3f0202bd89ca97583e99feb25f8c26b5776c59c68

  • /storage/emulated/0/baidu/tempdata/ls.db-journal

    Filesize

    512B

    MD5

    c81ca74f14e9427d33c4cfcd60f24297

    SHA1

    aa7affd9a72d748a01bb75c6c065cf28cb26bc57

    SHA256

    9d55f55a57bc95309452a54d0a09a4f04181863baa2b861b8c29435075eec53c

    SHA512

    8c8aa93f73bf75b30061981b4a04f1fd803b4a487d5fd0f617aa5528b65c709eed9862b62ed267f33251bae943a01626c6ece57462a1a04cfe231a203a433698

  • /storage/emulated/0/baidu/tempdata/ls.db-shm

    Filesize

    28KB

    MD5

    24adc63324883b3c2a0780a19a13f88a

    SHA1

    93d6efec766e0d823cea8fb84cd6ea8064265fcc

    SHA256

    639cd686d36425d45eaff37770df65794b4072aab0921f22d4b72c3f9291d9fe

    SHA512

    58bc4ec601c9fa47fa85309766778472fcc9ef75a908b19e60d71d04f78a03f0974a74fa59902f854056cdd5156e08fed13df22abce97ce20c386158ffa93623

  • /storage/emulated/0/baidu/tempdata/ls.db-wal

    Filesize

    52KB

    MD5

    94330f9522a210c51a4516638c00490e

    SHA1

    94b77fca2fa6ccd0043264a6f8f576215d647469

    SHA256

    b3b67f10f629f0d5a0c5f76fda2fd383df02ebe68c0a9433a6f2811425650e96

    SHA512

    7f6b885a6f20be6576499aff42204f9fd0f250a13566abf19ec3d5a43e2ab08d48a2b5feff358a706186a2cbf3b6c4dd724550e71f6d48b451e31219c8befd0b