Overview

overview

7

Static

static

6

6e9eae6733...e0.apk

android-9-x86

7

gdtadv2.apk

android-9-x86

Analysis

  • max time kernel
    2262519s
  • max time network
    130s
  • platform
    android_x86
  • resource
    android-x86-arm-20231215-en
  • resource tags

    androidarch:armarch:x86image:android-x86-arm-20231215-enlocale:en-usos:android-9-x86system
  • submitted
    19/12/2023, 23:49

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target

    6e9eae6733f84b0bc99ea6b961f0c73fc9c2ade6fa168d8c1162a00449caefe0.apk

  • Size

    11.5MB

  • MD5

    8f78b43f7021b379c7bd218edf30ae61

  • SHA1

    54b5a89f93a7719b24ba268f4e898159bdd3994a

  • SHA256

    6e9eae6733f84b0bc99ea6b961f0c73fc9c2ade6fa168d8c1162a00449caefe0

  • SHA512

    efae41155979eb3710675e211acc1527b2c7a736f9a5af50a166c409dc2d317afd6807fea0099cb0df3cd527dbbc97e3417c9e3b05d221ebb3f9c3b73254a140

  • SSDEEP

    196608:ChTlPUn7FqvnPntTZ0uOcAYxk2MriVlYDHnbiLjSfHwUKwV22IT+S5F1DqVennAp:mpPuAfPt6JtkkZsc7wjsHwogqgTVnnAp

Score
7/10

Malware Config

Signatures

  • Checks known Qemu files. 3 IoCs

    Checks for known Qemu files that exist on Android virtual device images.

  • Checks known Qemu pipes. 2 IoCs

    Checks for known pipes used by the Android emulator to communicate with the host.

  • Uses Crypto APIs (Might try to encrypt user data) 1 IoCs

Processes

  • com.mandg.photocut
    1⤵
    • Checks known Qemu files.
    • Checks known Qemu pipes.
    • Uses Crypto APIs (Might try to encrypt user data)
    PID:4252
    • /system/bin/sh -c getprop
      2⤵
        PID:4293
      • getprop
        2⤵
          PID:4293

      Network

            MITRE ATT&CK Matrix

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            • /data/data/com.mandg.photocut/app_crashrecord/1004
              Filesize

              58B

              MD5

              0d210bfb2a0e1f1b4c082a6a0f79de07

              SHA1

              bb8ed9e364db79d1d9f2fcde3f15091893222faa

              SHA256

              988722c23d78a46021d0e7ca9deee7aa8bb83288269174ffacb7316f381cca1d

              SHA512

              536e9867b0df29b15b789f8949be6ab37fcdeccb9d39ded981da7dc2052c9533d0ec0e6f9a5444132977605d372e1463d91bdde41b528ff2ca3f65ab152325c1

              Download Submit

            • /data/data/com.mandg.photocut/app_crashrecord/1004
              Filesize

              234B

              MD5

              991bf3913b998f48092caee64ac74136

              SHA1

              be499e64e5c615c53f44e441b300cad336c5115d

              SHA256

              b4715b766ef42dbc15c012173fa1b0dd1c74cee12c21d12227cf5adee0cfbb05

              SHA512

              99b5286d314be07aea857b64c51f5dff2e5721b8a4fcb348dce92b6f39cc1080498bde216a6f7dc5187772e16a8bd047f4bf486a49ad621f5f220d198cf87e8e

              Download Submit

            • /data/data/com.mandg.photocut/databases/bugly_db_yaq
              Filesize

              4KB

              MD5

              f2b4b0190b9f384ca885f0c8c9b14700

              SHA1

              934ff2646757b5b6e7f20f6a0aa76c7f995d9361

              SHA256

              0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514

              SHA512

              ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1

              Download Submit

            • /data/data/com.mandg.photocut/databases/bugly_db_yaq-journal
              Filesize

              512B

              MD5

              221e831827afc24e1567c58bd4ada568

              SHA1

              369741036b5bf5bb5015baa84938fa59adda3e54

              SHA256

              3dbfdc58dc6a6f14580b5e16e5191a2ea58fa4e412fc8936ea9ef9c4ec7c90a9

              SHA512

              22e3d56aba16efd5a7bb7d7e7913cbe2ae06c7b392e528d900943441b350e88e9189140eb26503d9edfc230e4d044234ab650ce75acaa4a39b14d3674adaaee2

              Download Submit

            • /data/data/com.mandg.photocut/databases/bugly_db_yaq-shm
              Filesize

              28KB

              MD5

              cf845a781c107ec1346e849c9dd1b7e8

              SHA1

              b44ccc7f7d519352422e59ee8b0bdbac881768a7

              SHA256

              18619b678a5c207a971a0aa931604f48162e307c57ecdec450d5f095fe9f32c7

              SHA512

              4802861ea06dc7fb85229a3c8f04e707a084f1ba516510c6f269821b33c8ee4ebf495258fe5bee4850668a5aac1a45f0edf51580da13b7ee160a29d067c67612

              Download Submit

            • /data/data/com.mandg.photocut/databases/bugly_db_yaq-wal
              Filesize

              68KB

              MD5

              54c4b2545d75a428870e61e6825c5119

              SHA1

              34301b151d5ebcff96ebbbaa2e51df4118db9779

              SHA256

              720cd50499c712c636de5b21a3ab845ed94d5b2574f095afe44c7d900f9552ac

              SHA512

              c649973844ed7fa240e7e246152fade7e8acae43e942fc5e31f76a0e27d0e3ad7ccdc82a3645c0c617c8e9a36ff81ee754b8099af9ac4a0f92ba4a07e1847fb9

              Download Submit