Analysis
-
max time kernel
2841818s -
max time network
160s -
platform
android_x64 -
resource
android-33-x64-arm64-20231215-en -
resource tags
androidarch:arm64arch:x64image:android-33-x64-arm64-20231215-enlocale:en-usos:android-13-x64system -
submitted
22-12-2023 16:20
Static task
static1
Behavioral task
behavioral1
Sample
ed00ac13a05a861d2f9451213926a55d.apk
General
-
Target
ed00ac13a05a861d2f9451213926a55d.apk
-
Size
8.5MB
-
MD5
ed00ac13a05a861d2f9451213926a55d
-
SHA1
6e0d0866b5d402f44e5cd9e9746aec6601fb9277
-
SHA256
aa533dbe962c674b4c20fca0667f55561294dc46a1b760044f8045c06bd95de6
-
SHA512
d9c874e2eb8240d962a2a219e287374fab03a9823152eb0ae89c9d4cee2d63d07c5a33342b4f9153a22cc4dd0c70148293a76c5e0231ff7e1e28234856d08707
-
SSDEEP
196608:2limsvwC4z2/hIsq5vlALl60ncVGjmFkzH:2WwC46/hI5NALvmUzH
Malware Config
Signatures
-
Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 IoCs
description ioc Process Framework service call android.content.pm.IPackageManager.getInstalledApplications com.achievo.vipshop -
Requests cell location 1 IoCs
Uses Android APIs to to get current cell location.
description ioc Process Framework service call com.android.internal.telephony.ITelephony.getCellLocation com.achievo.vipshop:remote -
Reads information about phone network operator.
-
Checks the presence of a debugger
-
Listens for changes in the sensor environment (might be used to detect emulation) 1 IoCs
description ioc Process Framework API call android.hardware.SensorManager.registerListener com.achievo.vipshop:remote -
Uses Crypto APIs (Might try to encrypt user data) 3 IoCs
description ioc Process Framework API call javax.crypto.Cipher.doFinal com.achievo.vipshop Framework API call javax.crypto.Cipher.doFinal com.achievo.vipshop.MqttService Framework API call javax.crypto.Cipher.doFinal com.achievo.vipshop:remote
Processes
-
com.achievo.vipshop1⤵
- Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)
- Uses Crypto APIs (Might try to encrypt user data)
PID:4301
-
com.achievo.vipshop.MqttService1⤵
- Uses Crypto APIs (Might try to encrypt user data)
PID:4374
-
com.achievo.vipshop:remote1⤵
- Requests cell location
- Listens for changes in the sensor environment (might be used to detect emulation)
- Uses Crypto APIs (Might try to encrypt user data)
PID:4386
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
12KB
MD5d89acee9fbf356695093f2724f643ac8
SHA122d2f857dfd38f9df961569715333e53fe64ee36
SHA2564e1313b40c676cdc9653aecd74da0f6212f5d84ef960e1e8bc249811bdeb5783
SHA51266448f754e7932dfeb98d20cddef9fe318b3a3aff17c2c47d065db78c5f830208febed67faf30a41977bc62cbd5c7a6e8205da054ff296843a75ca1b463f420d
-
Filesize
512B
MD59569d26adb222405aebddb61325f9db0
SHA143af786a9ea422f6f978a944dc26f19b356c7078
SHA256322caba3cd937775d84b465f3345273925a13909a492ff955c7eac1d4e69ec48
SHA512846154ffea36d68f367eace0d089382288157d38fab4668796b9cee0c4acd917db20115886067bdaf07e12c12e03df2818ef8060e9ed26e90de1fc4b7de5cedc
-
Filesize
8KB
MD57b2a589c8be02148fa97712246a5289f
SHA157b7567ba984ed8ea001d5e506fff4460aeb8182
SHA2562f87be6a186226c4eac4ab48646710a618b15b76d39d9d26d586cd8b3702c563
SHA512ba3c31c6369bda96d733379c75f8d7cf0a749c602842b7f4824e3189b47b6ffd73ba11610067f217af1ed5c26196244737f9fd9cfb287dd5a0d6745e56ca5f7b
-
Filesize
8KB
MD5c1f403f2fb0a7b8b6701500e67c7e81c
SHA1f434c4f826f6e95d5f76f40b97c90efacc7dcbbe
SHA2569d69dcfc7081f0648bd291391053dca0d4beb288c0ad0b38113a09b0ad62c531
SHA512d7e7a98bd345f251cfe86a02723a45890d6cbbf1e1f2f6ba0ae13260aa5c2dc4919a84382233c6bdd37b3147aa248f14699185e8732b1f3db1e5b81d5bde3470
-
Filesize
12KB
MD5a540d06cb38faed3cd3d79521fcfcc6b
SHA109345facd44624065e3429200683a8193f85b1e5
SHA25619ad8a20f2a200bfb8dbc3a4af9abeda28d3300b13b47b784132c5ebbc3c9c0b
SHA512781b78a2df2efc58add9396edccbefd4b877903e5a7e742b90a8c1533807abb1656660113cf75c0bb02357ef2eec18aa2c6a1fb0701dc1e8d6d116b1ce1a000d
-
Filesize
12KB
MD54418116bdf1bbd5cee760ff7d031c1f9
SHA1dba8c06b40c6ec24153617817790bc49df8f00bf
SHA256a41866da322822a1d133eb8680e7df2eaec71a0e050b60c0b030b72af417ed85
SHA5129e6edded052e395e0a01fc97d5ae80e42e91c789aca1de0cd28b49c069db841fd11a07e59c9e929827db1cac50853535e35cd68b11530e0a35a2798b963a0063
-
Filesize
12KB
MD52d615d36944cf1c72423eb295a496f68
SHA106bab93b88208666de49da51581c28b02bfbe5a4
SHA256cf01ddb41ddd77586e6a02b1c6b9761ce6dbbe3101a7a5c7a27aa00009b54148
SHA512bfeedc1b5858d682495839ac7616ca6f1c7d3965cd8b0146b168834e0c4b7301b4bd5b895789e799ce9e02944a40b442b155fbae4d5e7f95a85958eaf37b6d0e
-
Filesize
28KB
MD55730eb1a4138fdeea8c6388ea455a65a
SHA1017f4c2dbc7623b999ee8ed620256ae11d04de0c
SHA2565ba2b41214d565c532e4c2a360a8cfe3721d6346a858f712fbdc86edcea9acfe
SHA512854f74527690119fa2af98e3549e90772cbf93bc5f2b0da593ff0c5e6a06ca2ac42f4ea26b7f969df18db10209a7072ec5b896fa4485f2ac5d29bb328ceae3b2
-
Filesize
512B
MD553d45551953e050544ea7e53bf6ec4c9
SHA12f99e433a509badd55219af721b72913f7a3f621
SHA256947dd219f95f9e1d770fe71709ad293a3bd2e4eedb3707354ba163b48d2fcc3a
SHA512a3253bb126c135aa349c619a06999538994827de3d892eb0f2667506cf60396b64708816feef5576e32b036d27727af2972a9fe76d0d47fd2ab3756354486c5b
-
Filesize
8KB
MD5f7ba5bbe375dfeaf3e2759a7ab04a254
SHA185dab6709f1d2265fd54a5825697c574f34c5ded
SHA25686a4aa05efeb32bbba1135384425f378aca9113cceed72318fbd73721c24ce61
SHA512ec2255b26488e4396e931cb2f0d82f2ccc6d8c9ecacc993c1d90823c2058a5bbe6398e0555849162a8db2f687926fb6faf2585fce97d56628119d094bf2a577f
-
Filesize
8KB
MD5ab8546dd4d60bf22a4b2662ae1c5b05f
SHA1dbfb08e09161b13775272e0807d82ade4eb480dd
SHA25669232af5e34ff13db22eda0dc7cc122d325a4b85ef1158ff15faef0d8ebcef4e
SHA5120518d83fc84fa9bc1bb3369ac60d39ac3c577b5a258f3ce904e45baf01b8203e0609ccf52a10dea4edf369df79e716cf8e09fb47072e02787f42d95106b841ac
-
/data/user/0/com.achievo.vipshop/files/.TwitterSdk/v/com.crashlytics.sdk.android/658B9DCE0311-0001-10CD-0EC906D5E57CBeginSession.cls_temp
Filesize78B
MD508a306b9c5f204334309c73ce2d65d54
SHA1db2f891d8adb6f7480df2077d6cdd8ebb835108c
SHA256038997a23013cf314834ff6722429d8695e73e5835824269001d1faec02c294f
SHA5122066ba232bfaf09eba4471a5ea12ba41a160d220cc4751e6ea3a9155a8637f2c52dd7740a82ecaf40f55a3d8a7d6e43f7e5dded036873d3db446e95cfd1a43cd
-
/data/user/0/com.achievo.vipshop/files/.TwitterSdk/v/com.crashlytics.sdk.android/658B9DCE0311-0001-10CD-0EC906D5E57CSessionApp.cls_temp
Filesize116B
MD53a70f4a9f2e18c11d514cd2ae363cbb6
SHA1bfa9ab6f04afde8e8e959872ace1ce0c0d288092
SHA25645c4c916e587d61be040e938d25749aeb3513df0f92797aaa07f380f6121f43d
SHA512e6300de6eeb7715e5637aefd18c00c323b87dd9645fd2de75673d3fa8f6fce7e51fe5c4b15939f975b8e72bebad20df714ad9910be5870e89d44301d72cc778e
-
/data/user/0/com.achievo.vipshop/files/.TwitterSdk/v/com.crashlytics.sdk.android/658B9DCE0311-0001-10CD-0EC906D5E57CSessionDevice.cls_temp
Filesize101B
MD5eaff60ba882c9462b2b2404227059cde
SHA1fc9499a7b5932e10ca60bd88dea3de760d6be494
SHA2569d3a462eaba04f7496c9dbca7cf8fa00ab20273f2957db09e0e6334fb660edf0
SHA51282b28240b43095b3721c76fdbbcb0439eaabcc84ecaf4210c43f1e7c8e9863676383febca13f8883b68086ffdfad087a68ec97e83e70fb38b1e7da16e4939fa9
-
/data/user/0/com.achievo.vipshop/files/.TwitterSdk/v/com.crashlytics.sdk.android/658B9DCE0311-0001-10CD-0EC906D5E57CSessionOS.cls_temp
Filesize15B
MD5f8b3ebea29c91d82f009e5a9c6d11060
SHA199d88c4b39d9143084e777b93d9692a59a3d087d
SHA256b7869422f5dcf3f24ae91560cec05ebb39852ed45baf3a31176f9b90de87aafe
SHA5126f89bfe6bc1c0a68bca73ef92c53e1a308fd63f2228a25a6e34d117fc5cd253209eed56fe08f51d5643343a152acfdbfbb1c5dcea224e2750aed46074af369de
-
/data/user/0/com.achievo.vipshop/files/.TwitterSdk/v/com.crashlytics.sdk.android/session_analytics.tap
Filesize807B
MD54d4d37d9421ea07dc289e1abf9cdc020
SHA1d94a6bfa56e54f1c6c3204b1292072dfa9327c05
SHA256c13989be3c3b2495f98ba00850e10de15e0809185ac178451abde38a47e7e4d4
SHA51237456b892e051438c6dcfbd9d418855f01102512397b2db7d46bf910dcbb25d5ada648e0f839a59721c1242565d568ecd888bf5550ba48ee20a69d662715a645
-
/data/user/0/com.achievo.vipshop/files/.TwitterSdk/v/com.crashlytics.sdk.android/session_analytics.tap
Filesize357B
MD50e8b20a1070fd9b1147f0262a5eec2ab
SHA164ec9e8bee25f75b06c7491e5e622a35afc5d815
SHA256cf1d7dfb92d119c1a2c9621509b1d6bab3e5c1bb4e68de5dbfcf6d9664316157
SHA512d8070df0752b4747e3a793449c04a79c37153877c6154268878a64a295181a86c93a4e311dea994c3a8090da4a02833b1770f22b13b9636d810ce21d0cce239d
-
/data/user/0/com.achievo.vipshop/files/.TwitterSdk/v/com.crashlytics.sdk.android/session_analytics.tap.tmp
Filesize16B
MD5c33583fae4e0b61cde1c5b9227963237
SHA1fe2ebe4d27469af1460f7e852031a04208ef629b
SHA25635c6d6e5b93657e4a741a1cec71c21813fe05aab219909ebbb0f62fb0ae648dc
SHA512fa09047004bec791b23f0dade0b64f8ab9bbd67555505e0d0818f6e89dfe56f474df80db0786d081d36adf23a5bacea40275ba043444a3a85d3d9612575bdd1e
-
/data/user/0/com.achievo.vipshop/files/.TwitterSdk/v/com.crashlytics.sdk.android/session_analytics_to_send/sa_075fb559-7682-4a4c-83d0-ecae07a8ee2e_1703648718995.tap
Filesize300B
MD544f371c10823e0a9f2d5a7178af808ab
SHA10d3419a298b5915629bf72e4c91a4daf10de5c29
SHA2562d524df46711085eb09e918619c6c372a08a9ca931bc158534abaa8c27905434
SHA512958ebc04683be70b26f25edb9f0ba3f2817ff9d722655ee757f9f1d84c04542f8113223d6f9ef81a6f3df8ba44951c76ad81faa4281ac26f8938007bbb98980b
-
Filesize
32KB
MD5c2d04eb40dad4332c8e9b393dd07b45e
SHA134cdc84cee99ddc1df6173d699357376c745281f
SHA2567ff0ce442a7275b9a5281470d8f7916bbab121acbd1e0988cef2d2908dce7b48
SHA51212b9e7e425f702031609ce664285f510d3731b9f78e2963cb39d43ca927b2d33d55a8fc5fee53193325146562eed446c2707b21a5434dcd0df5fe751e4bb7e94
-
Filesize
24KB
MD5f47ae2102109cf27517437f5eac08c98
SHA1acdfbde08b88aa234834cdec974ec6a2c3be2911
SHA256e301d46fee8113bd09d156c9fb9934fe805eb8c1b182bbc3d29625c9d34552a7
SHA5127d447ed34f8c60e0a3d5aec72efa68a23c2324859a29be0844c66ec8803ed80737c8bf33c511f1ecb24cdf6eb685eb7519ca430f32a18c3cc1f17472381ebb74
-
Filesize
24KB
MD5de5f694064bae94084dd695d6b8c8d63
SHA15e3e6ebd211d871162445416b75ada34636fa495
SHA2563a811294517d4df6ac2b6f464aca1d3a2e29e25caf9242304e1343d8b08987e0
SHA5126824be9493b5fae1d1fcfb61967d70d26e08a40282b06dafbff67a6a0b99dd9ffc00d4c6287db173d7015cda3e1ba7f57c3f7c3c17a731490e9f7525fc0f1fc0
-
Filesize
24KB
MD5ca9f0e5adddf8801680077fb144a9861
SHA1098a3c03078604df813081d4d397e601df5f56c9
SHA2562097d92dec16082f2d88bb3561678b2479060bf63ee4ab5411cd6eb5ecbd792b
SHA512a951763ea57466fa019d7dd3e167a3ecbd015fff0caa66b577465dc4626efbf1d7d49b79603360d178ac1e588670dc72583c9c35beeb6cbb0b65ff5068f279bd
-
Filesize
512B
MD521c9febb9d4d9588670bc050afb95f85
SHA1c607709c51ee3a035cb8cbbcb45b911491757ac8
SHA25628cbf925d4396ceb56f7f4ccc3fbda94964570266a52834d4bc9b6ff9a067b2d
SHA51232dd16eca0d3d5cefb2b0bb41259552137ba41dfede79c949c7bfc8f7ebee0f30953aae46239192f7ba1f81260fa333c95182e39558b32e24d4f5e4ec5858cd6
-
Filesize
8KB
MD55e7557c6747f5cd08472b521ec8b5339
SHA1d6275d487054fa68751ddeafab614297ac7628c2
SHA25623a941d0c9047ff6fd4c124d7a663c7728b907c7e95d55f18fc24ca866855d3c
SHA51251be5176b71f6f423526b8a1f22b640d9ebc54b3d15b5838a3d8370bf26054b87eafb595be764e314411a9e36873ca928b316f346ab2b4874df6d5b8d5a13c6c
-
Filesize
4KB
MD5aeafc386aa8ca215a7b73432e77d6d25
SHA1649384f6b4e8f33e50cf073a8c91791581a4e715
SHA2563f955f07d4a74450270871ca548c0520d9960b7ed1f57465b9429887b0748ff5
SHA5120e0599b64ed6c464a9a43e7b27b1b6038603cca08187cb93ed505d5d75bb26eeab788faa9d42b50ce8d4b8b39428221f7f774073a285996ccfde2bddf6df6678
-
Filesize
8KB
MD5e188cd93bbb09745fc143d8bcde92126
SHA1c242f5e0158a64c6e80890b56fd7b30e1a77760f
SHA256e13ff1dafc0aff481a49b3046ad6b5f48e56a8f25bcb79cb679d15d200a1c46a
SHA51246bcde5048a715a22a042a94275830a7aabc59c4af71ca51af6396a5b6c2a6f20b426bad310768cccc16b93ecf485c60c8b96cc43f59de6169dd8aec23712464
-
Filesize
8KB
MD5af2f9432476095b7d7e442cbe842471e
SHA14f277145230fd09d8614d70e8e2b8ab87c36c44e
SHA256780fc468aca99d98b6cb452a66e985038843b2fe89856e230addc7c333ce72c1
SHA512a312d9a08f94cbc931617919909772677986f635cb7a695fa70d2bbfaf8ea41496c11af99d618628c3f7cf9246c488d1611f8e1cf79debc3e08bc0f8c07e4fda
-
Filesize
8KB
MD5c89144e325017e9edf507fb5318a8288
SHA11d527e7a86f2118e5c8b6846ea643d3b0719f8f0
SHA256a6d3b10261de21f9ca27cfddd1d83179babdc04741484d59708a9f9f1229a528
SHA512fa45df9cebff3d49dacc2ee232ca3ec1fdf72187a12b3355723a85563dfa18458d1d1343a8dfc08142430136cb4f4052ab75dcd537eee2e0055192655bcdeffd
-
Filesize
56B
MD592f6dd105c0962327c10e21ca523a3b9
SHA1c2d9ac9487b5de33770812e4537144bf937f25ab
SHA25685e2c30a1e02c72d9f780e0fdb037bc99a75a2f7b56623dfc4f0a3779f1672a4
SHA512e7916b4b55923fbd0e32aee09e13dc7b6807001b61e7410e31f3553a9c730ed9e1790eed97c81f9944d6b4572e5913c7b3a6020e2c5e9ced0bc281bf6b5f85c3
-
Filesize
122KB
MD57b83031e78750fb8a223e4bfc86407bf
SHA1c25bcc3d36cae1b2c678b4406e89274d9020c6dc
SHA256331de5bb5982944c9d0b24dc62592165b2bd7c08cbcc8d3e275d8da2af49eb5f
SHA512bbeaf4bdbf7c5376980f47930900d22e83913e7545d10eba3acbe0a293451a72d4b25d7b1139cae3321add4871b6686ce5172459996fd211bfd42f7905e5994b
-
Filesize
28KB
MD551486e906c61e610f3e2dc3ce63ba0d5
SHA1a47cf9c5bd1723c4ab0c802b763e08cecebe666a
SHA256e2b28edbe4c76a373ffd73548535d2d159ec63c97f2dee4c782c87e577003e8d
SHA5128c4f2665efc3f3dc7cab23ccb07517fccd59a6377e8674ee47e6c13c3027d20d8e9eab176a74fd6015e6148c59f086de449d3815c474275a161699c9f9e3b406
-
Filesize
28KB
MD5ab173f3d15e2ea948d0d2cb394ffee33
SHA14dfd9acba29dc513b279778be96ca548b3c400d3
SHA256ab39d31a3d5653f162a96c3fbc1221c09caba5e00142714f0d67925cd8a783db
SHA512f76c67d5840c69b8228075fb1145b9fe03ea69cd1b1c41eb6347f6be65ee2726d04bdd57d2054a2b9f1af1763a39f90c1d6e7ad565441429a290f522c95a84a1
-
Filesize
512B
MD5a8d27ac107ddee35b33fab759e3e2748
SHA1c73f67137a521a7024d57dffc526217315dcd291
SHA256dceb8ebe9718092bb4d2dd69a0f66b0bf94f22e87751c05693261fe0500de24d
SHA512ee601e51964f7bf32bd18ef30fe901dadd6dd982f7607a46962bf1dcb4954f1e437e31fd78e67321d4e7a5d63252f4913c56a28e039f22811fa551de59a357bd
-
Filesize
8KB
MD5f544b9229d3539a784a2fef0bcc44eb9
SHA13896ada67483dd6741d7190a0d9aab3515b396bd
SHA2568c06bd5ff561057954d5d41968b24431236a40623f0bedbcc90fd846d05a696d
SHA51285dfb6ade634ce870b6e414b3d2372a565741dedb98a39944adabb778df33a1df3c7c60680c58135497111468023021a80eda8e92e76df1c8a04b75581785586
-
Filesize
8KB
MD5b7207e0fdaeaa46102484b452423d00c
SHA15ae7527106f7c00d0ef1857370239bf7e3557917
SHA25685fa5e1401d00f987eaaa03c341f7a709547bfb8374d92734215d29875ba6ef9
SHA51205986f8a4ba09613da46ead63111f663015556070af1e09cb65d642d1928e28f484ec082c696a815f6370b1d86aa65926f499204558ed9c1697a1185d6bdb8aa
-
Filesize
8KB
MD5af62f6a3a35e0838579ff4803d9cc93e
SHA1e797961c1274e4fdd711a3edd824b005b525bf92
SHA256164916e4ebe49fdb3a96419fa0ed520e5bc8c51c39de6dfb50fff8358f3bb4ab
SHA5121a8808908616e0ff5f35c11e160f9ab6e60e3f62cb4e924ba064e199920649c33f10c9d2660dbe14e19f11a6f4bc818e620a5a7b92ef7c851d68fc9e2c1fe450
-
Filesize
4KB
MD548fddf0fccd87d7188a3a5ec440bd0fc
SHA1733f3f125cd80c51bbc84031bd8c72f03735b43e
SHA256792d328c1dc27e218221311a40d07ac1eba28c0876708c219c2a235ad79db682
SHA51244f48f069d57ebdfd3347b96e6051f85ff43541f5bb7c74c8b607d52069eb8c5d179f8f509af3e1bfa649fba52ab875b58ea25f11b623742934ada0ecdd6f963