Analysis
-
max time kernel
2347539s -
max time network
157s -
platform
android_x86 -
resource
android-x86-arm-20231215-en -
resource tags
androidarch:armarch:x86image:android-x86-arm-20231215-enlocale:en-usos:android-9-x86system -
submitted
20/12/2023, 00:36
Static task
static1
Behavioral task
behavioral1
Sample
758842fe3435baabc34ec6737d0c6e8252557fb1aa588ce73ae26b51baf87ae8.apk
Resource
android-x86-arm-20231215-en
Behavioral task
behavioral2
Sample
758842fe3435baabc34ec6737d0c6e8252557fb1aa588ce73ae26b51baf87ae8.apk
Resource
android-33-x64-arm64-20231215-en
General
-
Target
758842fe3435baabc34ec6737d0c6e8252557fb1aa588ce73ae26b51baf87ae8.apk
-
Size
23.0MB
-
MD5
b392b955d66ecff86da619c27c402b39
-
SHA1
9ebaa186a43c0845908e5621f041849a301b34a2
-
SHA256
758842fe3435baabc34ec6737d0c6e8252557fb1aa588ce73ae26b51baf87ae8
-
SHA512
9d45029ec3361f80bc7e6ccecddcb92f6e443700226ff8a30af5389c1ead5c099e59effdcb083163a84a523f759b6094b73512caffa192df99b57f80ba318ab8
-
SSDEEP
393216:+acFRb7R8GL8ofVmw8w9bEhos4quKYO2UrjUNlGZUc514ybOh5ZK9cGo7fAr6:6F5+KH8cIudUfUN+1b6BGw
Malware Config
Signatures
-
Requests cell location 2 IoCs
Uses Android APIs to to get current cell location.
description ioc Process Framework service call com.android.internal.telephony.ITelephony.getCellLocation com.baboons.xiaoaiwhitestrip Framework service call com.android.internal.telephony.ITelephony.getAllCellInfo com.baboons.xiaoaiwhitestrip -
Queries the unique device ID (IMEI, MEID, IMSI)
-
Reads information about phone network operator.
-
Listens for changes in the sensor environment (might be used to detect emulation) 1 IoCs
description ioc Process Framework API call android.hardware.SensorManager.registerListener com.baboons.xiaoaiwhitestrip -
Uses Crypto APIs (Might try to encrypt user data) 2 IoCs
description ioc Process Framework API call javax.crypto.Cipher.doFinal com.baboons.xiaoaiwhitestrip Framework API call javax.crypto.Cipher.doFinal com.baboons.xiaoaiwhitestrip:pushcore
Processes
-
com.baboons.xiaoaiwhitestrip1⤵
- Requests cell location
- Listens for changes in the sensor environment (might be used to detect emulation)
- Uses Crypto APIs (Might try to encrypt user data)
PID:4259 -
/system/bin/cat /sys/devices/system/cpu/cpu0/cpufreq/cpuinfo_min_freq2⤵PID:4485
-
-
com.baboons.xiaoaiwhitestrip:pushcore1⤵
- Uses Crypto APIs (Might try to encrypt user data)
PID:4322
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
512B
MD5087cc5b0c30bfac88b8eaac0b656eff8
SHA119f2af0d3ce5d084c87f8b440bcdc34cde8d7144
SHA256c357477a1f23982ec646774cda072195e262e4fc76f3bc6577280dd63c20b555
SHA512e8933e43399ac462076cdde2beac2cfd59b8e7f1049293f0e93a8314dd359b1d59a9bbdc64511d1861a20be5828055abadca642def23b989b02275fe6b48c472
-
Filesize
60KB
MD54dd98c0962e74af79ae24588383a0adb
SHA1fa1625e654e03309f0470589ce44ed5df6a1b77a
SHA256dd125ecabbc04656a6473e3e8322ca842dc0d8f8241327ab2f07ece8bbebec7c
SHA512f08ebea3a0fa4eff8c9b3d27c8ebba50b51856537996b0dac5aabe55b0bc11ab6446a7fdefa2adb28463a60a7c66a6db7f2f6136dc43035f2d1826136e91be97
-
Filesize
512B
MD59836f347bebb6d26b241b3233373123b
SHA14927763d78b44c3528625a35f6e09c9059d17b9a
SHA256bbcba4315c7ce4b64f0a48f2e012996caee3f5e33390cba89754beb8713b4d00
SHA5122e0ee9de1c8dc9f621d79641d3c3a4faa84fe9255def52c85adaf90c121536906c242b947dffb9fb51fa5e016fc8a74b4c4c836edba974e275400c8a44d7e3b8
-
Filesize
32KB
MD5bb7df04e1b0a2570657527a7e108ae23
SHA15188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA256c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
SHA512768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012
-
Filesize
16KB
MD52c7184bbf9c9ba92b13041261d8e56eb
SHA1888ff927e168d27d3cfc79a4c234318822910cdf
SHA256f2c458ccb487ff64a7244bca514462ef14d0e707255e10237b908e9990670891
SHA5129ba5d586f04aa5bb69714edfd01b79b6c94d736aa7e51293091813cd1c85c7ea0bed52a67b5b2ac2308ad61b4d72272c7d2d42b345efa22d5e1d34ad27fa5c65
-
Filesize
20KB
MD5e847a4324a4c9c6d145771c884a449d4
SHA18f9c1377a307c77b410bc27eb88b1129f83b35ff
SHA256dc3bd6ded663d83af7ed9a8f3bdd1d74bf7b53a8dbbfd72a2710759c9708c4af
SHA5128725afaf1066bfb7e1ffd3f3ac4f6b55ef313a71e4b0409315abc15acb64088f4a375a848e32ac4d23c2cd67caccca93d09ec93bfdfc007e3026b03ed7d62a0f
-
Filesize
512B
MD5f4e63f7a938fee4753054e8afea3974e
SHA1b4a0f42e4a851eeffcf4c2af64d14a07ad150646
SHA2561e513b86e7fdfef567fdaabca978a5469c0131b61d4b37b5b5b62abd0e56063c
SHA51226eb756bed4a930d9ad99a76bb86eb755deb02126b514a37da28b67b4ebcfb20a89d9770ce706839ac6c9a2af91d36b4b81690081f569a72badcbaffa665628d
-
Filesize
8KB
MD5f4162a9a51691aa4188e8bbb651cb49f
SHA1c77a5b33c59b09ea5c424d2bf698793bf0fdda17
SHA256e5ab7366e356f118ec010ea8deab227e7e5c6c6268d3a4d1482812733d53ece9
SHA512eb52b1a48e415ac66eeaa7c31c8027e914037395932cf48dd4a3732537886d56121534eadbf38405c218c43d96a00dcabfb083288f9acc847e89fe64aa4b01ce
-
Filesize
24KB
MD5d537b965ffdbf4700f54192315bafe70
SHA1988fd8c72077a780df095dbf0af3acf62c7bb6f5
SHA256de6f0a27077173564244dde595fb6efa191687502b0219694118d7d1d3b858b1
SHA5127d717f8a71968b5777d9e1cd47126031118537b05f5d91476d404ea6b7303f4ba5e525c5aae1c4490414f7cffbd061d78e9b70afb238c3193600a3c74fc799cc
-
Filesize
512B
MD532ba211d42e43786d5db81465537715d
SHA15365149c5e9bb8d893bf274518ea795652f464f3
SHA2561217c4715bfdf659f296abf00d857380345b0040ed3252696d1d807729291322
SHA512af1718fe26388366b91db646d47a763b96d7fc3cecc41023e5a52494ee5271d47b94232ce9cf166eb84039e177348f4e9fecaccc60ebe7c3d2a4136ceb86f2ce
-
Filesize
48KB
MD54228cc30b43a71acdbc62fcb72f420b1
SHA1c6ff06cf924bba1833e98c17097d565ad087c3f3
SHA256ac05bfbcf9b9b8fb1456d2bd0efcc6dbe4841bc68149bb31a4fef9fbb653221c
SHA512e3def35c36e8d672cf83e517b6358a9c82b715bf4c5abf85f6d58134ceab2a85dbbebcb3005ddc21d97e2331a68cfc006dfc05760f285de74b4dade120363d28
-
Filesize
12KB
MD533ee7495d85e7d35f5b71eae39764a03
SHA1e449ca0b2db24ad44a83b26edfefc748d2cd4cc4
SHA256d50d69253ce9e7a1c22dad523c2df83a952e9bc194555170777f76468bd02c06
SHA512bec3febb46da2536b8cfd82fbef80a004da2335cf58d77a88d175eb5cbbc3a62bf4f4f74ed9921dfe2a8bc7cd7931b1bafcd2de4e6da471dacfaef330c06c128
-
Filesize
4KB
MD5f2b4b0190b9f384ca885f0c8c9b14700
SHA1934ff2646757b5b6e7f20f6a0aa76c7f995d9361
SHA2560a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514
SHA512ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1
-
Filesize
512B
MD50d19664ea5f7ce38a76f1170dbe8ac43
SHA10c0436373467591c6007ca3c1b9dcfb76c641eec
SHA256f8b6380993271f403ed3c5ad6aa73cd84bf4968f20f5e0d8465d4fde32c8c3e5
SHA51265139d0a73dca19eed66eaf90341c83a8278882a9f2b5c0ef823ac7be8e441e0bcafd5d471b47b500e825b9cee3834c4b87491a77d7d27798d89603d81150fbb
-
Filesize
28KB
MD5cf845a781c107ec1346e849c9dd1b7e8
SHA1b44ccc7f7d519352422e59ee8b0bdbac881768a7
SHA25618619b678a5c207a971a0aa931604f48162e307c57ecdec450d5f095fe9f32c7
SHA5124802861ea06dc7fb85229a3c8f04e707a084f1ba516510c6f269821b33c8ee4ebf495258fe5bee4850668a5aac1a45f0edf51580da13b7ee160a29d067c67612
-
Filesize
44KB
MD560cf27c26122f0a998ac8b83f994c38e
SHA1eef848b272399c0fe315e355f080812ee1e9098a
SHA256370241262300a2855391156e965ce32b25e6de4a28c72fc747a6da1d94bf4997
SHA512636eb9c343369ed7bf4c1bef51557cd4aa7e663b3fc9b0f5c86818dfb9eed62c2b2d6cd9cd0f1df2fba5ef55bd6d5e6f9bd73e407509bd52e07b1d43fa91f837
-
Filesize
1KB
MD5640ad25cc2612641d4ee7fa2a6b08323
SHA1a83d8e56364f731a804c66f764df820a1a981473
SHA256c65d3a15ccc55160e2badfed51e68af0314d57f64097295240d3bbfe459ef275
SHA5121fa9d52504b0b848ba9d69f1dbec5cf029e96a56c933d59b8d05d3523f4915c1fde17d840753477c31f727f4213a24d0b29efa56f4b7bfc30546356162721415
-
Filesize
2KB
MD5f5f665530eae627463916ef0924cd040
SHA197b5ebf165a909a73065609ec056404e0281bd22
SHA256b2d96de1d4680cd20e120f075ddab46b952f08d368fc13fe5f003b7708bbbf14
SHA51218376a71d98ddf2ff8b814f684631115da46421e99a7243f69f23054cbe7aa96c61aae7f3abc8c5080859b9f3cfbbba73f9c0383d4699d54f78ae42b9edfdf60
-
Filesize
487B
MD55dfd624958d1fd24df376f7ca3be94dc
SHA1cd4f6f86ed35e5d6567a7c98e917138747b2e5dd
SHA256fe758c686ca7764ebde6c32dc1a32dec8533b7c8e35edf35f5c07b3438c31fb2
SHA512a0fe08e5e13abef1623e2404b2fca13895dc40203e44910d3e507a1d839c9594b69493c8be4bcb6b98be5d1d225e7b66edefa948a88bc6d6e906dc20dc97e7c6
-
Filesize
1017B
MD5f01f7cfd23d886108cd58733fb2719ef
SHA13410750c0c24b26911b6ba873c1e68fc45eaa575
SHA2561dde7c0861bb5ff150d5909637274876e669e53cf701c727191e581c49e28705
SHA5120bad2b94f8b1f822d3debddf35a1d6685f1afe32ca11d167edfc47b67c5f3ea4abbc7985adaeaaca0a6b85616b4ce0abd083089ae3e6d4edcbf8ab9c475ea879
-
Filesize
162B
MD5a2047cff716be7123a907c6916439919
SHA1de5250c7ac8ef2a70575a09bef3c12a9557e7d5c
SHA256d9373149ab07a6e5c8749d9bce2f39d47965f1191f59d9d1b03882750086c873
SHA51210b9b6de9083ad7b17e9295d90aa3ee73545f0240ce046d51247601bc001cb6eccda5373bbbdcdb9ded1142e06b15d030535a56c42c982e83efb25b84d50a72e
-
Filesize
567B
MD5bfce89de81c42fa654ac8a2af62452b5
SHA115e4992faa5f2bfd0fcba7c8e9ab56809699fc16
SHA25666e6a81e079b16fcaf35a77787bae543ada07fe9a1e167b570708715d3a76262
SHA512c1101afe5b09e83a6a1e230b7b4420ecf269ae8a980e7278c4dd6b91d2459ece8d21e3477e71f0052492984d6fff8ac53484adf2d65b0db9c03887533a8c6917
-
Filesize
567B
MD5aef2eb79c69a68f157fa266450e3fded
SHA11272db7e9f626e9e465f33b9b25cc39a976cfbdd
SHA25615968a9cccfc6f40bba2958b162bcfeb7856ac3d4c80fb3dfe95aa247f9c1193
SHA5128dc4b98338297242ed42a10903cadeeca6e8b17d73affdafff1478b488ac121e8911baa249dd50e0032819c031bf1dc532a045087a7b670c4f52b80a9dd20a18
-
Filesize
39B
MD5607a6e9c92a4d1b146790bb49a0eb2d7
SHA1bacceb34b65e8db3cdc6112846c42d44ed4e4d79
SHA25660c31f262afbf447138fbd0e31e6609c619d2f4c596901c542bda2a53d53ec1a
SHA512416d530ec7f3ff6a8f62d9c2e762995e91963f4100aff4c64360d9774173b21060f1cfc5d2d264ff33e27106a84ac139c96af6690b9ee62ea2ab0d76c6c64725
-
Filesize
195B
MD579b922dc6c284d0b0ffc0e32e0a3aba1
SHA18d660c89d08ec9089a7124e24468b4618c95b51f
SHA2562f41768d93d34bbfe7b70a6a5d206dd0cd3e1554452a59f4b7d8d9d5aa97e695
SHA512a792b0472aea57caad29229c9bdaf91bf95697011fdb36b73add990dab2f1e5b9bb1b6dd4e57d1ce09d76fba37bd58a397039088d672c8b9037d1d2762f1a52b
-
Filesize
31B
MD58c92de9ce46d41a22f3b20f77404cc1d
SHA18671a6dca00edb72be47363a7071be65cf270373
SHA25668bb33ddeed9200be85a71f70b377985f9ee68e91578afbde8321463396f1274
SHA51230f45fe9954215d6adafcc8f0a060a7ff41963a64f9b849a37f0d18fe045038d429ec13bf15226769c4ba78dad3c52f3d9e0dbbb4fcdea4828a1efe956e48f56
-
Filesize
32B
MD5b689c00ab8326b55775a6968bcc3cddf
SHA1a6387f865a0645a6f44ee056100f1405ede0bac3
SHA25650bdf4f5e5e65cc404355b99f2f5e1a52adf32444957074bda7fe912b008a162
SHA512c91e6bdd27a23bf5e45e8a29f41dd1f936809568514cc67c1aacfbb7c7b851f7fd7fae435b2db7cfef1b6b733340c3b5e6a8e377082956d74f334710fe7e19ee
-
Filesize
66B
MD52604a93ed6f4ad1fccf190450a1015e7
SHA115ae98d9278bd64c26bd55d3f6dbe04668f678d1
SHA2562522ca5bbbeef0fe5373348c3f06a0b92df03fc6ee72abfa98bb833abd5af4bb
SHA5127c4f79f949b17fb57d8d5c8d02093863fca222f5da4551bbee1f68a1626a79bf8d2a0718911630c1a18c6f3ab90a4c2264d110634cb99e667837db73086d4621
-
/data/data/com.baboons.xiaoaiwhitestrip/files/jpush_stat_history_pushcore/5894e812cef2c97613d9943f/active_user/nowrap/463367dc-6a59-4ca4-82c3-ea0578437c51
Filesize512B
MD5c62c89b320e78e979de5faae659f16b2
SHA1822a3128c7907c390a70f27e7572ccf3f39c6e37
SHA25647ddf237ed95e3a133c18b445e2190a1af5bf72506d198120ef0625ddf7b53b2
SHA512bc701e7b51757167a19ff16905b1f10623b3e5fd7dce2c7c2185b515692b014f11fe64bc84a1bc4f6ac871d84b05f470890953875689ffe67254a6fa32788823
-
/data/data/com.baboons.xiaoaiwhitestrip/files/jpush_stat_history_pushcore/5894e812cef2c97613d9943f/normal/nowrap/d81c1b12-1f11-4461-8410-b87cd6470ef4
Filesize28KB
MD5afdaa36bb243dff16672dec632f0352c
SHA1bfaaba94d4089cac0770ef6c52964d5855784931
SHA25604ddf32428e8326197b2e986fafb5d82ef08df923f2afd3aacfde396294e3a7b
SHA512e081d4ec514bbdd1d33a111545fa405c43b21accd1fad1eae9e017fbe09e34d70483251eee5369adccbd2485538660365f162f60d3e0916a6b46b1a1031f7366
-
/data/data/com.baboons.xiaoaiwhitestrip/files/stateless/dW1weF9pbnRlcm5hbA== /dW1weF9pbnRlcm5hbF8xNzAzMTU0NDQ2MDIw
Filesize1KB
MD53195951a1a77ac12e7409f49de62d3c7
SHA1dcae3c052c639f54a5855ac481e021865de61e69
SHA2567250267c72defd7a3f92b69f01fce50c81f2387ae4495244b4ef119ec6ab3518
SHA512e2e1b113641c7f105f228ca32d11a3ee15b1db9d18b05069b9fbb6c839019e834e63e2f1d6d79af48a919407e9c970b815475e1d7083b3fa31d4582d7d79b3a2
-
/data/data/com.baboons.xiaoaiwhitestrip/files/stateless/dW1weF9pbnRlcm5hbA== /dW1weF9pbnRlcm5hbF8xNzAzMTU0NDc3NDA0
Filesize1KB
MD542ca58b79df440a6f3afc6676a7faae9
SHA15327f480adfc0d7bcb215f4f4eab6fc495abac8d
SHA2565591dc8aa6a8e2b8289dac2aced22597aee6375879cf81e1d638f913885b9033
SHA51209d6eec3519d5480129dc049dadc9b0395e127ec6bb6a9f2c78b5dc8e658175b88e9426e7bccb53d77ce241defd01d8bf7d28ad469b4410b1a4ff9d640434840
-
Filesize
415B
MD5eb61b5799f8e5b76f314d6d209d86532
SHA171d3f3039106d0bfe48de58b424ab897749f44f7
SHA2563f109d4972bdffd80363a1774223c052d9200dc38b95989123d9d87c52b7bdaf
SHA512bda276e3af3de0f99468d8534c882678aafb4623366e9c16b0f554fa11775c5160891b906e82aba1bb3dee965123e39b69d041601327261c90584a977cfeea28
-
Filesize
211B
MD5a9223da50cd20b9a5d51aa7d8fa7b147
SHA16d1de50f3e350e80658521fead35537db0fcf464
SHA25627f96afeeab7bfbec8f747b88a679127d2576f8effbebc425cd7262e447b00c9
SHA512461a436c3a3f281e9a2964626063a359516b6b50b1e94448db8936aa076b3d1e469549a3c1df9729666b883a21c91f860be8d2467f4117a13c6c71989231146e
-
Filesize
20KB
MD5731fba9d21f23915576ea5dc2ea3ffb8
SHA1d1fdbc209db8b71d1b4e5341e75b8cc88647146a
SHA25687510194f38897a04cd1f80bd6fffc3344fa8ef21baa61de020a2e790a7268ab
SHA512b643177cf3a30543342d3a521a2dcfce70df4ec450b040e2b61d8692bbed4b3cde2f9f304cbf496869b89455e3cc6a501e8ff720edbdf0f6898e6a5f31fec25d
-
Filesize
512B
MD5c806fbf62b63bc902b1e2c174ece3d89
SHA12fc95d797286306e9fe9b1b06d960fa7bc49abaa
SHA25632f957ca13e33930f9a17117c177db5bf01aa8a166a20b8ada790ebaecce1c86
SHA5121106be190a1e48ffdd199403d1566839b109f5c406271484e9a840a3b95f5aa443cfc404c33ce33d627a95e2156c1d027f34c40ca8124dd5d60abfc97d9477b2
-
Filesize
32KB
MD5a191c74524af5443b51a33b934b05fd8
SHA12fc0c5c73af7ac1782b46d0a4d5350a9c5a5fc1e
SHA256eafd8f52c680a9572515a1b8f53fb25700d5659a58ae4686bf761a01fb1a5ae8
SHA512f3a858a14154e529ba3cc5e78a66aa552365a38418f59bd3f9a2f14960733e7edeb05686e0bc585621b8195ab73b94f9c67ed20af7f945f66fafca5c11783411
-
Filesize
512B
MD55adeb090f41962720d7aef6e0508b8f0
SHA1d5ae134c7029467b44fe343c0a071ea57052b14b
SHA2569403886a1911065bf4061ca81a8303464aae1bc8136245422a5aea1bc6c4b784
SHA512bc623e9894774dc5f4678d073661dec38cb89f754b866b88666b5e9ebbb9dbb1d5adb9492f79671c0c9987e5ef1d1aed05eba07a703c375854d78b9f8ac7e136