Overview
overview
8Static
static
60032630313...b6.apk
android-9-x86
80032630313...b6.apk
android-11-x64
8dmss_v2.apk
android-9-x86
dmss_v2.apk
android-10-x64
dmss_v2.apk
android-11-x64
dump.apk
android-9-x86
1dump.apk
android-10-x64
1dump.apk
android-11-x64
1dynamic.apk
android-9-x86
dynamic.apk
android-10-x64
dynamic.apk
android-11-x64
Analysis
-
max time kernel
2524105s -
max time network
159s -
platform
android_x86 -
resource
android-x86-arm-20231215-en -
resource tags
androidarch:armarch:x86image:android-x86-arm-20231215-enlocale:en-usos:android-9-x86system -
submitted
23/12/2023, 11:17
Static task
static1
Behavioral task
behavioral1
Sample
0032630313f4487e354c8ac7f9bdef479af7f888c8e0877fd80d4df63ad6a8b6.apk
Resource
android-x86-arm-20231215-en
Behavioral task
behavioral2
Sample
0032630313f4487e354c8ac7f9bdef479af7f888c8e0877fd80d4df63ad6a8b6.apk
Resource
android-x64-arm64-20231215-en
Behavioral task
behavioral3
Sample
dmss_v2.apk
Resource
android-x86-arm-20231215-en
Behavioral task
behavioral4
Sample
dmss_v2.apk
Resource
android-x64-20231215-en
Behavioral task
behavioral5
Sample
dmss_v2.apk
Resource
android-x64-arm64-20231215-en
Behavioral task
behavioral6
Sample
dump.apk
Resource
android-x86-arm-20231215-en
Behavioral task
behavioral7
Sample
dump.apk
Resource
android-x64-20231215-en
Behavioral task
behavioral8
Sample
dump.apk
Resource
android-x64-arm64-20231215-en
Behavioral task
behavioral9
Sample
dynamic.apk
Resource
android-x86-arm-20231215-en
Behavioral task
behavioral10
Sample
dynamic.apk
Resource
android-x64-20231215-en
Behavioral task
behavioral11
Sample
dynamic.apk
Resource
android-x64-arm64-20231215-en
General
-
Target
0032630313f4487e354c8ac7f9bdef479af7f888c8e0877fd80d4df63ad6a8b6.apk
-
Size
6.8MB
-
MD5
8d549d07eefca9fb3b492b83c77fa4d3
-
SHA1
927723abe240611e4239aeca4fc8fd59457a3178
-
SHA256
0032630313f4487e354c8ac7f9bdef479af7f888c8e0877fd80d4df63ad6a8b6
-
SHA512
a4397cb3160f39dd009833ea7e4be553b1980976e9ce885e8c1b7b0f0a94b7b76ad2ce0bd3df28eb97c73db41538cbd46bb2249ed6be2e6595c0a42814bfc1f8
-
SSDEEP
98304:Gr761NF7mPgOA0bzmrxQuB7MmNnt1d/AYs/I09XfbCFXruTcECHD+/OxN566D6bS:GrsOtM2uxMGwJCFFZ+/jqguPP
Malware Config
Signatures
-
Requests cell location 2 IoCs
Uses Android APIs to to get current cell location.
description ioc Process Framework service call com.android.internal.telephony.ITelephony.getCellLocation com.qihoo.appstore Framework service call com.android.internal.telephony.ITelephony.getAllCellInfo com.qihoo.appstore -
Checks known Qemu files. 6 IoCs
Checks for known Qemu files that exist on Android virtual device images.
ioc Process /system/bin/qemu-props com.qihoo.appstore /system/lib/libc_malloc_debug_qemu.so com.qihoo.daemon /sys/qemu_trace com.qihoo.daemon /system/bin/qemu-props com.qihoo.daemon /system/lib/libc_malloc_debug_qemu.so com.qihoo.appstore /sys/qemu_trace com.qihoo.appstore -
Loads dropped Dex/Jar 1 IoCs
Runs executable file dropped to the device during analysis.
ioc pid Process /data/user/0/com.qihoo.appstore/files/sllak/opt/4261/finalcore.jar 4261 com.qihoo.appstore -
Acquires the wake lock 1 IoCs
description ioc Process Framework service call android.os.IPowerManager.acquireWakeLock com.qihoo.daemon -
Reads information about phone network operator.
-
Uses Crypto APIs (Might try to encrypt user data) 2 IoCs
description ioc Process Framework API call javax.crypto.Cipher.doFinal com.qihoo.appstore Framework API call javax.crypto.Cipher.doFinal com.qihoo.daemon
Processes
-
com.qihoo.appstore1⤵
- Requests cell location
- Checks known Qemu files.
- Loads dropped Dex/Jar
- Uses Crypto APIs (Might try to encrypt user data)
PID:4261 -
/system/bin/sh /system/bin/pm list packages2⤵PID:4742
-
cmd package list packages3⤵PID:4759
-
-
-
/system/bin/cat /sys/devices/system/cpu/cpu0/cpufreq/cpuinfo_max_freq2⤵PID:5034
-
-
com.qihoo.daemon1⤵
- Checks known Qemu files.
- Acquires the wake lock
- Uses Crypto APIs (Might try to encrypt user data)
PID:4291 -
/system/bin/sh2⤵PID:4460
-
-
/system/bin/sh /system/bin/pm list packages2⤵PID:4580
-
cmd package list packages3⤵PID:4598
-
-
-
cat /proc/version2⤵PID:4657
-
-
ps2⤵PID:4681
-
-
com.qihoo.appstore:critical1⤵PID:4481
-
app_process32 / com.qihoo.appstore.rootcommand.persistent.CoreDaemon --nice-name=com.qihoo.appstore_CoreDaemon --daemon1⤵PID:4519
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
28KB
MD504183d28d08d24a5b03704e8a44f1e0e
SHA13710a7d4f4a50e9a8a14d1cd312291d99fadf7ff
SHA256cbcd94a175e1689d50dc1d42f20d9238dc71ff218539f8eab55da964e5190695
SHA512817f91475b63f1e8feb1a11cf55f0409b6728bfe8db1b6fc6db63a7dbb091a144c607b2f339993d79b0a7ab338d02c9612af63296624a1ba1f6de03b96fc245d
-
Filesize
512B
MD58bff2010e902aea505637ae4bc920c62
SHA1acd3fe3ad6ee9aa4c7bb8e938017cd1323adf9d5
SHA2569da89de493e1d20407e0991275dff64fae954ca099d68df126c627c13bed6275
SHA512885775cd1366d293ded96e94cc87f677e603e04406ca52d02ed4425f4c8a7de7e65799fcc31d32c6df16aa990780c2d75901107a28fc4aeb755b5199def67563
-
Filesize
40KB
MD5b4f17e770663f91b9953d64ce6eb8465
SHA1a07ca21aea1c80e89c94e405cd5d8b460a15744e
SHA256c0e9043e35293cbb9fe2e1b872ba2267cd88aa065e19ba46b640c99757dab22a
SHA5129b3062de8cebeaee490b9d5547c04248eb2e741f1c8d500cc7b6ec1629804399f4b659905e9b9eebff217f77d9e45ecfbf08c66d7b3b5da2c19a9a54ff916413
-
Filesize
8KB
MD50d34448e9718148dd668f456752b1efa
SHA159ac86285c3dc346300f576b81d0161cc1f402fe
SHA256e5ab502088d4d792f48ee1d14ae27ea6c2e4252ec065d55e473974de4fbb2536
SHA5124f622eb6148a93f8517da7a1f3204f8a0716dd7207173aed454f59402c705220ad2e3599533f45a950ce0f907611a9633211573b87c5eb82bb8f7d91794ef689
-
Filesize
512B
MD50a5ff34288d105a2d12f0ce3fd69004d
SHA1a097581de2fcfa85d20d7625d5c0d57567513b54
SHA256c56873584e23a1f70214c36eb64fd287e5b6492d964cd36adda0555257e92955
SHA512a53ed4ef1dd1c36b648d4e3f36a0b166c7c774ef9758238658df6b7280cf01cb7125f2a38132d180874c7ce16ede46bb686d6646cc6aee760f772884bd43659b
-
Filesize
20KB
MD52f9ce254e050845a423c50328a5b64bc
SHA1ed4eec58e3fcc033555bb50dc3ab3ceec9124cd7
SHA2561ad93ca82839f97dfe67c2781b9001276f7044b25ae0a832e2e286727dd66b13
SHA51231a6d903598cf5f10557cb8a03bb510ff8be085bda52b01d996ef702ec7fd26c48ef9d59ee86811c06f4407976f462053cbe6fcf39f369aaaf39934db851119e
-
Filesize
512B
MD5b92265ecd0814c50b366335e03d0e203
SHA1fcdb4b53e8a3314e043fd1f2e34f2a6def746b66
SHA256ff2aa8dbdac004fee5226ead4ac4ab65412e5b173e7d33fd45a9a9b2b787d581
SHA5120f61b530eab18ea5b1eae8d3d84ce5d9acb85655b51bc2563a355ce8442802adec5c65cac4cd73bf2ee7d1957ed8bc58b2f191273a2b2441c18b6028dcde59e2
-
Filesize
40KB
MD5a5e079af188d06058166ef1e050e69d3
SHA1775cfefad6a82321626b2b8b52cdb928b130d9c5
SHA256576f7eef0579838e01a5bb9c47fe8753ddd346c83af0579bf4ae1312ea1ed4bd
SHA512695b97f542228f1ebf82c6faa7426ef4a57e54ea69aadd7fc9988964f1e3925cc74973d74a6264e3e8d5c3930ccd5b4870cd7ffbc6eb31e199e2bfe96beef087
-
Filesize
512B
MD5d62edd26b79f0f412b4e206ee9c859fc
SHA13a5f37dd7c6f51687a252d763e8730b1f527f221
SHA25601c69277b78ca8ca7689acd7a82f9cf217b630d7fd995412ffe5ae53cb4c275b
SHA512738178ac2e6f65634ecc7f9f43fb9e6bd22aaa5657561da7f5722e679f43079c7770f55ddeebac55da4240fceacb808f6e57b1e214498ebcace96802c6a3a562
-
Filesize
16KB
MD58aa90affacdc17d6edfa08d07359c48b
SHA155fdf51f76b0c5486adc313b2ed54c127ee4b832
SHA256d9b923b8291dc4600ae224f49b660b972857779031f875b1bf93563dc1d6d7ba
SHA5124e53c90468f7ef3adbbb7913154b6071b4d3e3911417a65651b836deede9e12f5add6440b917506d6adf95c4e9c73c014ddce945bfc6f1545c70610b193e55f7
-
Filesize
4KB
MD5f2b4b0190b9f384ca885f0c8c9b14700
SHA1934ff2646757b5b6e7f20f6a0aa76c7f995d9361
SHA2560a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514
SHA512ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1
-
Filesize
512B
MD5dac4a7483ae67bd9b07e65c9beae1493
SHA10587a222162b08bb4cdecfc37b67bda9c40ed90b
SHA256619414ab4f623471f9cef6c780d10dab0087afd1b471ae1fb87f19083034e21b
SHA512b53d4c07e28bf4fd44c8525a96ad1ee1149e69c420f8c8eb08856665cf0dfd743bd2e5f5d8024281ea8520695b4915379910c5b24f2598908c7378fd0a9a5cac
-
Filesize
10KB
MD59a178ac892e45b5367118c9d2c3daa95
SHA10b7aa56eb355dbc42ec2cc8cdc5c73139484b1fc
SHA256c0b87bf3a316f307a7eb3c9abed45adcb695f497fe222c73663b2c37bbb6adb0
SHA5128ed7efd69be3b747d7240ce3a323d23dabc7f447bd037e3ed33ed028662f22040f086d85670c906119b7ca7d6c27c0e0ab9ebd9c6679180f85216b7219d50e82
-
Filesize
20KB
MD560e4cf217e77c56efd3707b603797c5b
SHA1816247b4883d3adb30c4db39fda16d2288e27de0
SHA2568e2b8343f703045fb8596dee1888f65fc66b64d10304a4a49fd4ad1f63bd67ea
SHA51222a8cd2974663e8caa220177e7bc64aaf35735dc8abc3870a7e47ea86b02d8b06b041000e5505039b3116290aee67e9645ad2d9c26218749f5b5b2e332712af2
-
Filesize
16KB
MD5be26c99402b2dcc4dad99d1b61b090f7
SHA177dd20504ff92e0367209d95b47b57b6a374f0f9
SHA256003549e4de7310d76ea8a71873c9694141118de9fe9e500bde0d2e178747022e
SHA512c7c7c8c5b3d7e1a4fd8b642ebc16668259c777c66dc1c9ac8872a0e3d1f8017b759d089640038dcfac821111297cd4afca887980c74da6b413b670b05668f1ae
-
Filesize
20KB
MD509a5905f86ecc8a0a58731f0b72f4098
SHA18f8ee0b9dbafb4933dd13c2af993cfd4c47d9a81
SHA25637097567f1c4e1ebf00216449dc923415de3f1524eaa1646cfa21ea9eab2143c
SHA512c1e953e7ac5654bc315c22b97471664c820e3fda6e047087b5c92baf7d05a7c4f743a71505587b33375e907c5f16bc2e80c461bb1779d34cdec4620edf5a5b17
-
Filesize
4KB
MD53f3d10c5c5068b3bf37e5dfa7173b702
SHA194d50ffa882d821969d81923ce204643d61dd990
SHA256dfefea6a56cc5b3c52750858a5b06ae0867b3159339c1c50c38918338d2329a4
SHA512215dd07ad03c35ceaeefa3445efe6635acdd2849311586e7cdc89cfe9b67ac3d306face5c807156146da1aba3b5c542121f9a376f8728a708f6a606257d1387b
-
Filesize
512B
MD5503e6f2aab800b6a69c17b9154dfb5d1
SHA10bba423607136149922a3bdd6983a4c4e908e314
SHA25688bc84f67e333a93a915bca6bbc99d6a2693cc36c804460641d91be0391c33b0
SHA512fb2c73b8e80b3208117345e69d3d8645c3e969eb75cb294e58f280885aff9daa31b995982960c135c136c8b48f36915e61df6140faac4335114c220d1d8a9c59
-
Filesize
20KB
MD5e0ddc29dccfd6312689ea105cf0434a8
SHA159191210f5a80bc047f8155ea92544f4095c38c5
SHA2563079b5c02af6b7ddced940086bf7095b1205bf0f396b87da0d5c5f6d8b5b6143
SHA512d5ec8a2bd21928c07ada4ab4df8e72b6905872533d01afe4eb243ef06674e630a9834a03dc5fc2f8d487c3cee8aa3b3117e73379ae64e6f4dcf3f8dd0145fdb5
-
Filesize
512B
MD5b02293ecb6680875559b11e27ff5c8b8
SHA1f61d8c0da3fcd6380be976c1b0f57dc106b3096d
SHA256b1abf331ac4ab3599e93033977b4bc7cf80ededbde836d4845ce5b03c5d66468
SHA51214bcd8772a69b265bcf51c52cfe94481a654e22b880458355718c1e069bc83615f453816a4fcd8191506be5fafffd0ad0aeda7c4d228e76371e0a740b85c5ad7
-
Filesize
28KB
MD5cf845a781c107ec1346e849c9dd1b7e8
SHA1b44ccc7f7d519352422e59ee8b0bdbac881768a7
SHA25618619b678a5c207a971a0aa931604f48162e307c57ecdec450d5f095fe9f32c7
SHA5124802861ea06dc7fb85229a3c8f04e707a084f1ba516510c6f269821b33c8ee4ebf495258fe5bee4850668a5aac1a45f0edf51580da13b7ee160a29d067c67612
-
Filesize
32KB
MD55aa5b03f300604b4147781c6d7865eec
SHA1d11235f3520e154bde254c4ac69d0e56c8156e0b
SHA2569b0a16c61dc6716f8e7724bb9431985441e5e93d8dff3c85127c34c22bf98a39
SHA51263e9dddf49eccc1765f630c6fa2d236efab820fc4456039628cc85535621ef595fa2d287292b3ab3875792fa3033a6b62547038f54ecc9b689f4a975145319c7
-
Filesize
512B
MD542d80059598ae6cbd6f7296f0cbf7fbc
SHA16a3201063ba4b3349d7f38bad35111645e2ebaf6
SHA256621829c887766358fd9b5bdd907ce44dd67e2a8f229da27e148d1f70748be1cf
SHA5127d0826715614df858a12281a65fb8431a193e189330a790232e8a6e259139e474a48daddfd4d891dec251be08217f5f4a569e6cfedd212034d9d63978076239b
-
Filesize
520B
MD5c07ee00c15f25f0b7f1ba56083b2dbfd
SHA1d63bed9ccc6ed4b8666ede56f7a987a33f8d1067
SHA256e93467df883b797eaa7451dcf97534e2b672235c736cdb6b01dfec7647450da8
SHA512df9fa0c19ce60c96e46ef5cfb98632648c6884f93b82ca3b21ae13beadd77de961bb6e7dd704dff5d6f6a2252261def334404b6989495e6836db360c71ecdb9c
-
Filesize
700B
MD54d3cd6c00588964372f19365c990e0bd
SHA1c390c29081e59387abf547b0252a39af389417a7
SHA25680e0de927d7d706e1ac8bd66b7289897eefabb53bb7e69a27a69fff3c409c563
SHA5124477188293d4d22e1e382d57f15aeda758d22785ffe3e918ab2566a37e30dd85db52fa44da169b92300a358185e49fdbf5eabcde55e584035f15cc283ed645c1
-
Filesize
1KB
MD5628849ff460635bd28428248b9bc0cdb
SHA1802f811b2e5e61949e8fce19e556df5d20f9dee1
SHA25607935e2572921af822904060e8ade4c53d97fd3575be3f4b3e748d51398c5994
SHA512cae47ee1506da8442fb383953d5f049a600f6b9a8e3fafd2d04f800bec0569f2664a5621118d3042f381b9c89eb952d5e4dc4fbd46eded2be7665f8aa5c0a9fa
-
Filesize
77KB
MD55918763852216d366f1a5471a9cb135d
SHA160c8c420f0d0b5732818e6dc944fcca115701f1a
SHA25611b207219e49a4ef4d9b859d1befe926f5d5d21e6523b4a2532e0492d1c05284
SHA512e7ec9e8c831ebfe1c5c6d2e3fce55cd33bdbf51acc934cab938c1a76276a5207fc96f7ba8ee494de653cff983ba019a14c3a0e48bc14d2ca0f6db0398d0446b8
-
Filesize
1KB
MD512432d3d6757379976ca6bdb91ede547
SHA1dde33250f72634fe6c506bff04ed3ee75aff23fc
SHA256c07944bf3830649df55d256e2a0b92b773b613872f930f8c0e1b92762684276b
SHA512261d130d085fe607ec6a33b78d565bcbe870ab50f32e6d815d5ec1525568ded9fcc7551e819dfaefc4548e9623100f73048412566cb8f2f66a446c8a9de7696b
-
Filesize
32KB
MD5bb535ef0b8d97bdc1bc36df686773766
SHA1da23ccdafe17c899f6a6e8d9ca95e34fd17f24fc
SHA25679257071fe2b772ac1510742df953aa331667c2bc675c39d56ccc3f42f3333c4
SHA512f761b4546d59b6fbe3dc0d4577124fcdd6cf96890d064300569347a3f4853c5cbc4397fb89e7270f712649106615d87e3c269de18862670da4befef1f57cd2b6
-
Filesize
1KB
MD5e37ad6fcec48013dd72935fdf28fa79d
SHA11f3b78b3df983853a15cbfa63d2d999a18f88efc
SHA256ba582b96ab480929e029eb146e52935e015991b716178226a0d8a5284dca4bc2
SHA51225bc3b6ac501108113400d205d4a60236e9732f43353188bc4a23729a377cf5a32639095cd7778d99056e647be86e256d0377449c01eb0900ac4dde8f0db5885
-
Filesize
28KB
MD5d0e492b5506cb2090f00dd32fd5c3554
SHA12ffe9d36b0cb1990080cb249313c9360390df0cc
SHA25677ddf5d78e5010d8ff7c78b3cd4900593597c0aa50cf3c0736ff893fd51f24d6
SHA512b39a31ce44aeb0c6770baf7084d16f6c026975096cdf804fc1573a0b2607a3c0e3e8868452f70ccbfbb2609013d318eb9031cf9f216978c30866e401f2804424
-
Filesize
2KB
MD53e2f0e186194975377783cbe1ebcfc44
SHA107aa16b709ed5c119e722e57d61b3e8c5adf4332
SHA256eff5227c6c8959854e3e1ff8dd874d7e803c7c68ad0c4790f504ad5ba695135f
SHA512934c9a77e0feeddbc2a91bc2295bef00a79e8c728736f2e291cbd89cf0f05470b0a592b8d45a450eab902e9ee9fabefa5171e5e89778e7cd89fc5376f9c4a90a
-
Filesize
596B
MD5007a9516b3490b7a28bbd528b1c74a86
SHA1d03f3183fef22627f59fdf43630090b0e59b8aac
SHA2568eddee4dea63082214cba33f029bf7083ae800b1dce626eea7982cf444ebfdd2
SHA512612c93832157603bf44a9c81cc143ac227214c76922c9d127ae209b080845df394fcde293fe7808069acb61fb0b16fc9851dcd8630f37d0431a9b42638c19b85
-
Filesize
51KB
MD514b685427326725168b3b0b4a52628a2
SHA16f643808e25a90bc0387e89ba01e5590801c0190
SHA2564c4db9221db6aa4b1907823e39cf1eb1f9ac0e11613cd86d352e6f7f666a9578
SHA512286aba9af2bae48e8f35359e739c81cf4319f487e4aadc710289bd1ed4dad0c53f00f89ffbc0e1b175e43e509795ba825893f04d44c8437956b965def725fa13
-
Filesize
176KB
MD5b667ca71e42bbeb899566c8834ed085e
SHA1053a3f889e326efdfa0d3ae7e5b2655f0b7376d2
SHA256536678202267f95d80480f15065e784d7ec609922a0963d935e9c5a4b0f62bef
SHA51252255d3d7066d01bd47a9da788f86c707af14e7666a918737fa5ffb4bb003e97b28dd84a7cead3439ee39e10b568c97e80174a80bf776c7dd58335b06656f8f2
-
Filesize
83B
MD58141fa81b51c336838cdf93393b2b244
SHA146532e130409738f7172827d7c549b78f61c511b
SHA256249acd871b5902e1ae0f9cbf5801993bfdee28710ef90bfba411ce78003dc8d3
SHA512544bb72d1660b0e50e234ed9ac56e2ab2c92987dde09bccbd44e948307211b4a17aceaa338d13bf79e75f47baa68a81701b17c98bb30c5468218de992b62f2b4