8eb5801ba7545e76ac2165718923a67ad2f0c2a1e59bc9de68a0db5365c455fb

Analysis

max time kernel
2502838s
max time network
159s
platform
android_x86
resource
android-x86-arm-20231215-en
resource tags

androidarch:armarch:x86image:android-x86-arm-20231215-enlocale:en-usos:android-9-x86system
submitted
20/12/2023, 07:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8eb5801ba7545e76ac2165718923a67ad2f0c2a1e59bc9de68a0db5365c455fb.apk
Size

10.6MB
MD5

52656c8956a212a2e1735611c2da08de
SHA1

4097427c905ba61f773fc4b946c571b32fd01e00
SHA256

8eb5801ba7545e76ac2165718923a67ad2f0c2a1e59bc9de68a0db5365c455fb
SHA512

1ec1626b8ff221e2b6a4ca1e4aad56aa123f12ef9c5a50887d047dcecf5604194c7c43b9cc9dca0a94528ab3fe58a9b06834bd87f215093c73f40fa8239c7016
SSDEEP

196608:UihsQ2/sSP0+CKhOv2Pr8a8dSQ2YhxIlOec0H4J/lCoodlmGSWc5rJqCG4xWV:tu5Cvor8L2YhocWm/l4dYzxu

Score

7^/10

Malware Config

Signatures

Loads dropped Dex/Jar 3 IoCs

Runs executable file dropped to the device during analysis.

ioc	pid	Process
/data/user/0/com.mandi.smite/app_plugin/PlayerUIApk.apk	4285	/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.mandi.smite/app_plugin/PlayerUIApk.apk --output-vdex-fd=44 --oat-fd=45 --oat-location=/data/user/0/com.mandi.smite/app_plugin/oat/x86/PlayerUIApk.odex --compiler-filter=quicken --class-loader-context=&
/data/user/0/com.mandi.smite/app_plugin/PlayerUIApk.apk	4260	com.mandi.smite
/data/user/0/com.mandi.smite/app_plugin/PlayerUIApk.apk	4313	com.mandi.smite:download

Requests dangerous framework permissions 3 IoCs

description	ioc
Allows read only access to phone state, including the current cellular network information, the status of any ongoing calls, and a list of any PhoneAccounts registered on the device.	android.permission.READ_PHONE_STATE
Required to be able to access the camera device.	android.permission.CAMERA
Allows an application to write to external storage.	android.permission.WRITE_EXTERNAL_STORAGE

Uses Crypto APIs (Might try to encrypt user data) 1 IoCs

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	com.mandi.smite

com.mandi.smite
1⤵
- Loads dropped Dex/Jar
- Uses Crypto APIs (Might try to encrypt user data)
PID:4260
- /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.mandi.smite/app_plugin/PlayerUIApk.apk --output-vdex-fd=44 --oat-fd=45 --oat-location=/data/user/0/com.mandi.smite/app_plugin/oat/x86/PlayerUIApk.odex --compiler-filter=quicken --class-loader-context=&
  2⤵
  - Loads dropped Dex/Jar
  PID:4285
- /system/bin/cat /sys/devices/system/cpu/cpu0/cpufreq/cpuinfo_min_freq
  2⤵
  PID:4414

com.mandi.smite:download
1⤵
- Loads dropped Dex/Jar
PID:4313

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.mandi.smite/app_plugin/PlayerUIApk.apk

Filesize
143KB

MD5
453960899faf2f8710b4a89f40ff3070

SHA1
83b43b3fa9be3074300a336772d5360a5b5e4b95

SHA256
fb48fe020d71a13ce48fee53e54cb6e0120dd3fb94519ea376f170b18fb60a4a

SHA512
1824db0130b002f908f63703f247a4fce985a92b4389b6de66c991fd19ef47f724b3c71d045bb13f71c22fe2965a61b023249f1758236b69bcbef3ac522742fb

Download Submit
/data/data/com.mandi.smite/databases/pri_wxop_tencent_analysis.db-journal

Filesize
512B

MD5
891d2d1eeef6965e3d215d755d5d201d

SHA1
7b278f9a9b8b46cbb4556fb45e63af46917c3b1e

SHA256
4bf7791cbb163c6bb3b3f064315ea83f594eb167df4942fdcad6fdaec38ae56a

SHA512
39f7add7ed7a7b856e1b33179664eefbb3251d68426bcfbeee6a9f4c1e58be7b2f7789c3e8b636dcf25be0a481b3d192b76c0b387017b14a7c4c3d6aee615e05

Download Submit
/data/data/com.mandi.smite/databases/pri_wxop_tencent_analysis.db-wal

Filesize
56KB

MD5
ac4bf65c7088612e6323766acb71a7e8

SHA1
b6d188a55c791166277f82c8ed0abc3598301574

SHA256
3f4ca33629bade7f407891f8dd7c3d91e7db0c66ff4e19312db92181f22fbcd2

SHA512
c253aed0d54248a14b48cdc781608b167694c32ed6e0d116fa772354df63bfa55537100d400693dbdcd0ac368a826961e9c9c0d8af2197dfc4219d8778341e15

Download Submit
/data/data/com.mandi.smite/databases/umeng_community.db

Filesize
4KB

MD5
f2b4b0190b9f384ca885f0c8c9b14700

SHA1
934ff2646757b5b6e7f20f6a0aa76c7f995d9361

SHA256
0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514

SHA512
ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1

Download Submit
/data/data/com.mandi.smite/databases/umeng_community.db-journal

Filesize
512B

MD5
3fc4e12073b552bb10e17357e71ae46e

SHA1
ff3356cebe51aa0c261bc4aeb500e952231b8640

SHA256
47a3e112ab3a42fb9768d259be9c7eca46a10a1bcd4df00823b0f23fb3d87e47

SHA512
87728b20a144d9d8ef5cc3b5d76478168c4758cfc9686a4b6636f912b8eba4e7d80b6ce6f96e3f7256bee7f58a7d5462d4117d2f514dfba18c0fee648f7c73ff

Download Submit
/data/data/com.mandi.smite/databases/umeng_community.db-shm

Filesize
28KB

MD5
cf845a781c107ec1346e849c9dd1b7e8

SHA1
b44ccc7f7d519352422e59ee8b0bdbac881768a7

SHA256
18619b678a5c207a971a0aa931604f48162e307c57ecdec450d5f095fe9f32c7

SHA512
4802861ea06dc7fb85229a3c8f04e707a084f1ba516510c6f269821b33c8ee4ebf495258fe5bee4850668a5aac1a45f0edf51580da13b7ee160a29d067c67612

Download Submit
/data/data/com.mandi.smite/databases/umeng_community.db-wal

Filesize
16KB

MD5
d798406e0f3302dca74d8aa122f42862

SHA1
bfb3f3f3510db0f7c069de138d31d7175d8cd661

SHA256
64fea047de50af8d221e7373719c76915e3105d34ec5bd0aaf5047dc71bdbef9

SHA512
4c6f3b71a42fb6dc1dcb91eabc46bfac8c0935c71d45594988e0eb5120ba48337ca58158ff8edd186811c16014676cd63f0adb83361ddd8628bd2a2962b6641e

Download Submit
/data/data/com.mandi.smite/databases/wxop_tencent_analysis.db-journal

Filesize
512B

MD5
51a46d33bc55b9dfac5c22b5c5423c1a

SHA1
e5adbbb0f6331e5871f9a4db540b0799f3f0bc99

SHA256
aa4a62be4d55fccdbf08541cde7abc8f054dbcaf976adc660a0a51375d285c85

SHA512
35aebc47e6ea184b9549d308a6a3b0f415bddff3b25766ff1f270562022d8945e50972899a3bc6b79299b3860627c58f04f697a1834f468058ce723a2300c252

Download Submit
/data/data/com.mandi.smite/databases/wxop_tencent_analysis.db-wal

Filesize
16KB

MD5
3f7835a56ebedf9dffb51ba11c2f834d

SHA1
97abcf3fac4646e358c1ebcca0ca7d9cc498136d

SHA256
8bf6cb7799449499e24f128571050f9d69448e5f6a5d4f18bd397cfac7408328

SHA512
1767668d3ef27661461e5b60bd9b3a0175490441c66303775c1a436718ec164ad5a32a2410c85ea9960359c2f842d80dd4ee64d58191e535c91fc73b5505742c

Download Submit
/data/data/com.mandi.smite/files/.um/um_cache_1703309838480.env

Filesize
718B

MD5
2a1fb908d3e75c9271d45081b9349a38

SHA1
77aacec724351c47f59f53e3b0a82a95b7eaeb9c

SHA256
5a294c3dd1ab796a1d019e52e0b5d586dc300ba99ee3f5da9c08beee2245d880

SHA512
64ed0ba66423f75f9ce39cf8dc06afb115f37e6b03ff3e367bd283d765f20ed3914ed3d1314a1cd12995b0b62dded98130bb965ac1865d7ced9ab7f4443a9f50

Download Submit
/data/data/com.mandi.smite/files/.umeng/exchangeIdentity.json

Filesize
162B

MD5
5a2d39958adc310407a335749969e5b9

SHA1
d6df4d5e012e588ae714ebe3ce34a15742cccf16

SHA256
0aeb8b3ec64804d6b8abb91dae789c23753eb75851ecccfd3d7049647deb998d

SHA512
14641305aea3eb19d182f1164e58c3b974e120955ab8793c71c86c1621f5867c9aeb5a9692f3e58abc620b5f5c44304280dcbe237465ddfd867ec34aab332cc8

Download Submit
/data/data/com.mandi.smite/files/umeng_it.cache

Filesize
415B

MD5
2d0a8de38c72885eb5d762041c03b24d

SHA1
08a4504379a7d05497c7cec4c4fcf8f9e517b6fd

SHA256
ca81cd0b3844837a46aa99b8af2d601fbdbd35873aaf7ea15c86c49215aeb3e8

SHA512
2e9b4999ab31c667df1549d6d999296cfbeb3d47ed065c5cc086670ce39619772d91fcb4d6b46acff42b3916dec16a56c6196db8a22ebb83e65090e639f18c06

Download Submit
/data/user/0/com.mandi.smite/app_plugin/PlayerUIApk.apk

Filesize
285KB

MD5
20d786fc8d2acec4bfad1e7dd982f666

SHA1
253da61dac2afff4677deb36b06bcd1aba267730

SHA256
dca695a3f0ead3ed137af6fe053520aeb47fede7f1d780b3b204cf99eee0dca4

SHA512
05b3985cc5fa8fb02415c95a4f186efb7d3de2f7f50fa69f191354442bd19a3e43f124e84c834d3fd1ecc4ace139bb94e48e81b9bfbb276a2c522a85c8c9104d

Download Submit
/data/user/0/com.mandi.smite/app_plugin/PlayerUIApk.apk

Filesize
285KB

MD5
ac0c01be752771d01bec41ace38a337a

SHA1
341f50c23a97d311bcb6971ff4732b20fa32d4fe

SHA256
4b89f24a04562e927cf38149227f05f9049b2507adec6bdb67b808d68ad4a316

SHA512
0d326ebff770f6a20b8db1e5de8df12d6a36799e03622fe89ca08bb51e799950590bd19d027342f0031256d54676c1244900d46ed02e79fd543e36671ed9208b

Download Submit