a83b892e4cbe750cdc72315043578c9dab444083a16fe6f73c95f898b6307426

Analysis

max time kernel
2495739s
max time network
168s
platform
android_x64
resource
android-x64-20231215-en
resource tags

androidarch:x64arch:x86image:android-x64-20231215-enlocale:en-usos:android-10-x64system
submitted
20/12/2023, 11:05

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
a83b892e4cbe750cdc72315043578c9dab444083a16fe6f73c95f898b6307426.apk
Size 2.3MB
Sample231220-m65saacdel
SHA256 a83b892e4cbe750cdc72315043578c9dab444083a16fe6f73c95f898b6307426
MD5 c43b9dc5d8282b25d9adc1e26c119390
SHA1 9a718052ad71a39d3e259c6e2295211f186b491a
SHA512 4521e4383f27f37ef0a0d5d7e7214f72e33e7499bcbae64c45bb6bf52931e48f83f8b541f3702f6e45edb52c0a3d58930b61eb5feb29494954b02cb948df1100
SSDEEP 49152:sqvE/I1p5WgbM3ruLD343IPpLjoSSAbh5XvUBmWY+7+cFGG2XN:sqv0CoXruLDUIPhtSAl5XE5t7XO
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

Malware Config

Signatures

Requests cell location 2 IoCs

Uses Android APIs to to get current cell location.

description	ioc	Process
Framework service call	com.android.internal.telephony.ITelephony.getCellLocation	com.zeek.notstop
Framework service call	com.android.internal.telephony.ITelephony.getAllCellInfo	com.zeek.notstop

Loads dropped Dex/Jar 1 IoCs

Runs executable file dropped to the device during analysis.

ioc	pid	Process
/data/user/0/com.zeek.notstop/app_baidu_ad_sdk/__xadsdk__remote__final__builtin__.jar	4999	com.zeek.notstop

Reads information about phone network operator.

com.zeek.notstop
1⤵
- Requests cell location
- Loads dropped Dex/Jar
PID:4999

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

__xadsdk__remote__final__builtin__.jar

Path /data/data/com.zeek.notstop/app_baidu_ad_sdk/__xadsdk__remote__final__builtin__.jar
Size 39KB
SHA256 16a065cff14ca5cc55cf1722bc09ca5c62aca0d599e9b6406d96018068fc2f45
MD5 14381047ed2ec34a93f1a7c9d316a3c8
SHA1 46080214661491d10eb2c7765cbb6630cab04c55
SHA512 b3f7feb2f1dd9da81166991298a2e7c644d875dc925008bfa04526e65935d8466576d7b359540cc785eb1cd8e86c6a4b7094ab13a556ed8457cf7e124de5179a
SSDEEP 768:YFiRxQJm4aphuNjP+Gb4oqaewFxi1ghnHK7Zpzj2k0zfk5UzyXNgCzbY:Yg6m4Wcz+CrqAnJhnH2v8c5UzwzbY
MD5 SHA1 SHA512 SSDEEP

Submit Download

um_cache_1703302703785.env

Path /data/data/com.zeek.notstop/files/.um/um_cache_1703302703785.env
Size 642B
SHA256 e29dc580867bd27fa5584c444db1b2b4490b49c53980e5e3f3cfb2e9eb94d6b0
MD5 c9e8f2282cdab276573374cfa3ef5462
SHA1 5c063e89b02b3a5937f3aed30a3f9cf4f164b7df
SHA512 359be77d8d9b8ff485268c25169817f733d570f5ea28852f844898d3df2ba81837b7be4a6a41eb24984c61aefeeba214b1b9dc43faae198c47447040300b30bc
MD5 SHA1 SHA512

Submit Download

exchangeIdentity.json

Path /data/data/com.zeek.notstop/files/.umeng/exchangeIdentity.json
Size 162B
SHA256 ef6e2af8972625ae138b2bf51a94bafd52b8fc1a391bc65e0510ca41cc122897
MD5 3b4ae1a34d1e96c52b8c7ad78e37110b
SHA1 ec79fcce9314549525eab9153515b302116bb6cd
SHA512 028c24f73b76ea6bef535de47377742ecdd50041134c823cc62c26a7b940097fa88c41628ab1e8f7d3ed8288fd9d67ddc20f841af8d1e0d37d32008e18f8a668
MD5 SHA1 SHA512

Submit Download

umeng_it.cache

Path /data/data/com.zeek.notstop/files/umeng_it.cache
Size 352B
SHA256 d49ccfb4a6301e34a44f3e2f9caf70df933400400540cba5010a12cf3134f838
MD5 7cfaf19bc4b8f73b331ef4090befbf7b
SHA1 5a8c3905ea240de409b2603c5d360a214f6ec75b
SHA512 b0c139a33521a2124bdc5c5ed3732b9d5b3a91ebef96010295784e951054b689566260135d7543fdb05d21f85bc214ed2ba466353c061a8c1f4b5fa99a3c402b
MD5 SHA1 SHA512

Submit Download

__xadsdk__remote__final__builtin__.jar

Path /data/user/0/com.zeek.notstop/app_baidu_ad_sdk/__xadsdk__remote__final__builtin__.jar
Size 207KB
SHA256 1282df6e431b6027980f9460320b72779c6bcd19a28886cdb5fb77ea5e434da6
MD5 f13c5e5d15d4529a941009a391d338fd
SHA1 11d50d18e9ca4f65ae685abc7646bd7180f8b21d
SHA512 d191b3a03019c94ac801c13763698cecad99df80771c9af03770b411b4074a8583b0c034edede0fd19307799d3a001d996b45beeb9e3a7b9fe1fcb19b19e6e40
SSDEEP 3072:gpLRbRoj82ORTR65g3HOwtCCBLaqnRxmhiJfcrDAOGsnse6wGv9aeK:g7Roj8RMg3urKcwfcrDmsSv9ap
MD5 SHA1 SHA512 SSDEEP

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads