Analysis
-
max time kernel
2886483s -
max time network
173s -
platform
android_x64 -
resource
android-x64-20231215-en -
resource tags
androidarch:x64arch:x86image:android-x64-20231215-enlocale:en-usos:android-10-x64system -
submitted
23-12-2023 12:48
Static task
static1
Behavioral task
behavioral1
Sample
16aa5df4e0487e92b43e8ff70932a039f10460567562b8737864631231ab13e5.apk
Behavioral task
behavioral2
Sample
16aa5df4e0487e92b43e8ff70932a039f10460567562b8737864631231ab13e5.apk
Resource
android-x64-20231215-en
Behavioral task
behavioral3
Sample
dmss_v2.apk
Behavioral task
behavioral4
Sample
dmss_v2.apk
Resource
android-x64-20231215-en
Behavioral task
behavioral5
Sample
dmss_v2.apk
Resource
android-x64-arm64-20231215-en
Behavioral task
behavioral6
Sample
dump.apk
Behavioral task
behavioral7
Sample
dump.apk
Resource
android-x64-20231215-en
Behavioral task
behavioral8
Sample
dump.apk
Resource
android-x64-arm64-20231215-en
Behavioral task
behavioral9
Sample
dynamic.apk
Behavioral task
behavioral10
Sample
dynamic.apk
Resource
android-x64-20231215-en
Behavioral task
behavioral11
Sample
dynamic.apk
Resource
android-x64-arm64-20231215-en
General
-
Target
16aa5df4e0487e92b43e8ff70932a039f10460567562b8737864631231ab13e5.apk
-
Size
6.8MB
-
MD5
25948047f84a5f681f06ca7815f0c928
-
SHA1
0e3209b13a0dfd2f275a3dbbe8e54cc0af371d4f
-
SHA256
16aa5df4e0487e92b43e8ff70932a039f10460567562b8737864631231ab13e5
-
SHA512
d91636cc465ef1f434692504fd45c23ac8555861c052ae7396a5fcd02cc2207939a0ebd5a0236dd67d9aea73f54e3bd027cd4cba28b1732bb222432646e68a3e
-
SSDEEP
98304:Gr761NF7mPgOA0bzmrxQuB7MmNnt1d/AYs/I09XfbCFXruTcECHD+/OxN566D6bZ:GrsOtM2uxMGwJCFFZ+/jqguPs
Malware Config
Signatures
-
Requests cell location 2 IoCs
Uses Android APIs to to get current cell information.
description ioc Process Framework service call com.android.internal.telephony.ITelephony.getAllCellInfo com.qihoo.appstore Framework service call com.android.internal.telephony.ITelephony.getCellLocation com.qihoo.appstore -
Checks known Qemu files. 6 IoCs
Checks for known Qemu files that exist on Android virtual device images.
ioc Process /sys/qemu_trace com.qihoo.appstore /system/bin/qemu-props com.qihoo.appstore /system/lib/libc_malloc_debug_qemu.so com.qihoo.daemon /sys/qemu_trace com.qihoo.daemon /system/bin/qemu-props com.qihoo.daemon /system/lib/libc_malloc_debug_qemu.so com.qihoo.appstore -
Loads dropped Dex/Jar 1 IoCs
Runs executable file dropped to the device during analysis.
ioc pid Process /data/user/0/com.qihoo.appstore/files/sllak/opt/5066/finalcore.jar 5066 com.qihoo.appstore -
Acquires the wake lock 1 IoCs
description ioc Process Framework service call android.os.IPowerManager.acquireWakeLock com.qihoo.daemon -
Reads information about phone network operator.
-
Uses Crypto APIs (Might try to encrypt user data) 2 IoCs
description ioc Process Framework API call javax.crypto.Cipher.doFinal com.qihoo.appstore Framework API call javax.crypto.Cipher.doFinal com.qihoo.daemon
Processes
-
com.qihoo.appstore1⤵
- Requests cell location
- Checks known Qemu files.
- Loads dropped Dex/Jar
- Uses Crypto APIs (Might try to encrypt user data)
PID:5066
-
com.qihoo.daemon1⤵
- Checks known Qemu files.
- Acquires the wake lock
- Uses Crypto APIs (Might try to encrypt user data)
PID:5142
-
com.qihoo.appstore:critical1⤵PID:5369
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
28KB
MD5073bf578f358397eb0890a40280081ac
SHA13ef956e97836079ef32105e6f84b401e7dd4d10c
SHA256c48a18c175de831a21353fb0bdf0d3e43b83ba7655982152df5cf0100b2bf37b
SHA51222c8bca8429348bf9c0614ba55e6e8dc865cae42306bda2d05b588d7ab34ceda0071695654efe0a429cdf5a6ee812db8d18ba794a80be2512c5305bcdb314134
-
Filesize
28KB
MD568a663c3f95568e27a9480c447c29c1b
SHA1bdbd0c162d679fc3e2f96beec7b3fc21be4cf78b
SHA256442847f7a12c988f83a674323cd5da163d5ec79152b658abe27baafbf70935c4
SHA512b3317e0dd3be80101b53bd0eca193f4654baea2c8682e0d880afc248f142c6e34c22f5ecd689e56914954bfbc842cc450fa2efe01f668cc8315250c3b4d706e2
-
Filesize
512B
MD5c9a1b366f9c3b20793df278a9dc1999e
SHA18a67dfcfa582faf06dd48729bf32e75bceeb7be3
SHA2565941c9f192142765e1825c5d66526eee9294325dd2ab604cf72af9e2f0f8e44d
SHA5128102f4d9ede0c14262b6953f4efb8258dba0237fcbce47466b9155f0212538ea195f697baa28c303f5991e1ed69857e75055dda39ac4118bce2691ec63fd2bea
-
Filesize
8KB
MD5735a5d3f043430079b90b23fcca42a44
SHA1ce52a26ea08e202f581541734e59edae81dc6dab
SHA256631179ddaf68ad25fbb44aff2cb32510ef33c08024fbfabaea041a4c9e363369
SHA51248df32435c0c4a58f7afe23e6fc8f08382e03ae2fd586ba19b2f61343c5a975129afbefa8b9e746609f1a82589cbc0158588bb24c7fc852d813a1f79ac4dfdda
-
Filesize
8KB
MD5b167eb029124a18d17823bdcd19439c1
SHA15d7270f3501f6d88d87d9aad2254091e7d4e2c0c
SHA25654aa73c3200eeab9da01f74f924aaa353920c1f3df1be4af75eca8876222b7a6
SHA512c83442b6eaf82ecdc9a73dd9b8d56625ee36227b9b20f5a0a73870d29d76db9c9ca3929982ab73f6fa44e5baec52c84e944f3812178d0e75f90815c5bdb5aef0
-
Filesize
12KB
MD513093fd685828fc8e342291bcec7aec8
SHA123792e40f58deab8ae658eacfea1448cfb88cb39
SHA256a8e3349df36b4f32806774ed14ff5080a869a2637830495527facaafa570a95c
SHA512bc233ebe88038ff02cbd3b828edf66b73bd9e9fe674b665f6d180fef2585c25cdd809320bcb253b537e3d6e97aa689aa04d6f7c5160d49589917e0421ee263a7
-
Filesize
512B
MD5589e42615d7c3d6bda1037bac8b1c8bd
SHA1dd12597fda53a88202432d75324e880498316e54
SHA2563193959a05ff864320d9946395fa0f9704e060e991f46522d115823ebb5b311e
SHA512ef6458814355d9fe3829b7df82926fd987f435b4fa3b63e449c9fe1e1f67be12c9bb08ed772f85c29205201900472ec9b2ad098e2b29906efd3baba709945a34
-
Filesize
8KB
MD5ec48d70eb784417df715302098432cac
SHA17f5d7a32a6e6717530c558c22c2da1e89a7175c3
SHA256807e34f2879a70dc2a80f5e4ac5986ab52d5c2704de07f22f0910b5f749c840c
SHA512dcc9723da035f45c66013d8fa559b51adf8e22f346b115c5b1ac7f309661d16c50997c7002d4b5db7c72b6a1144c6fb522348c7e66e8674d6b14b48665d80be4
-
Filesize
4KB
MD57a4436120acd67868b5673be3293fd96
SHA1c75ad951925f8b9117958c235b0f1fc215e3e559
SHA256c66899922710d7c0288bf01838cf67f53e054b2991bd51515109d5813c191a6d
SHA512df6eec262fdc2b869847bb579b1a5d857bc88bc93fa67e715a560e40c6bc419579775d9fe04c04020dbb37e873891f5136a8c9e8d0faed58414fc53f6eee2e8a
-
Filesize
28KB
MD5f630f8cf9174c836248b6d30cbdd5779
SHA14db6d82e8e17de9fcdf0ead09e97123cda1ca86f
SHA256ae606221ff789289e1c69cd9f79ee035d1c587a96d556ad8ac6ee91fe6741041
SHA512c5045a96a9214932971165424348327e2396c204839749884ab3105c7d185693c6900acc3d52cdc1463633890cb123e21abd7e68d71907c043d37f4b52a7ec5a
-
Filesize
512B
MD5e7dc5efea55c6e9c6c00cea5e3f864b6
SHA1df8a8cb1e495928baef34a3fa71732766d4ae7ae
SHA256e43cac1734fae1aea5f164d2f2fdea23400b72f4540d166ad68877400bfe7a60
SHA512de943416e00938bb8dadaf551adb871f17c2dbb014e3b66f7de7a680f06a9d6777db424053aecaa1118b1cd06385f9ee8ab685c711fdcce2cd31375df808e34e
-
Filesize
8KB
MD50db48f666018b10f23107156266e835a
SHA1692fde388b4024c339bf3b68aaf76a3a828b9508
SHA256a6fdbb51de21fb5fbe77dd39b92407494d999c741e98aef146b4cb79fdf4aa69
SHA51286b1c2c017f8f2f28d0f174f27a968839cd4787e370976934224d7ea0fc999e58652aff3398b6c47c3e6a0586dbcaccd34be8c643f47812741026e8809ddc4c9
-
Filesize
8KB
MD58db2b2a69852ad1cd75df0abc4b345ed
SHA1eacbf621b72e17a6feca0232267f83a0c66dc4b6
SHA25686a7fcda195f58824287aa75d9987b1fc526a9383a14afb8f4e6c36c36e0ad61
SHA51224eb29b891477ab6a21ba4dd3d065af640a7339b793183460acb7bc457d958d5f74dcd9fefcfbf979df838308d79222c31216b39828d7ecb786016716bb54aea
-
Filesize
512B
MD5945a3efd84ac0d658d0862337138ec0f
SHA175c2c3cdc722fc95e0805b999fac291aad5dea2d
SHA25692ed64f6c1d98f50aea8eb1062ee570d6ce38a913417c8a483d108a0b9fe7afa
SHA512925e808d9e284110ec8d6e63f6e2eafa0597554289e5317af31f4d995ca6bc23d17bb74b2fb52f70c026d0bf0154c90f0f9b5bd8950d8b77c35cb5f47b9b5c87
-
Filesize
12KB
MD5ea628e04765adaf4238a5dcdff4bbd51
SHA1a801947619ea8c368efe9c006a324dc6339ac60b
SHA256885e337c2156e4dbf2176a9677ade50418740532d222ccae5ad4aa371b54c6a4
SHA512c0287b0e7b690a7231a37d1745c49f3d861b22aa65dd769ba6a8b5ab9da55443f749957781ee05a405019c39e1be45d37a971b821bffd62a1d5620bc39119abe
-
Filesize
512B
MD5e0c43be31a3b6ddd86a75fbd41d5f47a
SHA15406b75164befee67540758c784e7322ee453ee7
SHA2565087c401f33df6adacca71487961cae710974ac2e46ca7ab7c0c052d433d3127
SHA512a577224ac4994da6fffc3a10c40822f4e9860401169e300be7a4fe489cc2df30763fa9744379544e72b87dba65b82dac9efd82439259fd51b5e77595184a98d7
-
Filesize
8KB
MD53c6cf12a564aee2727a30a825ea214bf
SHA1f097b0f5a2dd04ac6c977f84979d88c25e2055ad
SHA2564fdcbc925a2ef66563eb6e9bcbf9bafc19df4d145e176de5da11593ed230be3a
SHA51292a10cb7554ffd1169c6aafa2637cdfe480e92454a9fef6b9921c8a8e7db5cf4f32308428bc7b8cc66dc10d4defc4cc54d4af2e8561668e201edefadce7e29c9
-
Filesize
20KB
MD563034ee19c8ac183f4be94f0e4350592
SHA18bb94ab357099476de70fa34031349c4f82c8f12
SHA256fc8213a10a4907987570701d47828767ffd9517ac55111519fb6c909b015ec7f
SHA51214f6fb8b3648f247bb1c675f5e10f0259845c7a6c559d960ad74759634c1bfc92e0f41cc4cbc973cec45395b2269c885f9dac07d926f490f505cf2a89bb93aaa
-
Filesize
512B
MD5c1fff65803b1b2c77d00c9f4483cf67a
SHA19c015906c8fe4b37e9dc4a5444e652b1a74cd8cf
SHA2567da2561a12635e1a6842f520a66cdff1ce971c4a885f48498068377f15149554
SHA51286e8e0eeb796e4371b66dd5f3b329ff4b1f222c6a05140dc21f0c29aac209c0e27844ed312520ec92633adada15f13603b6a9dcc12c7e1d465fb649222cb031f
-
Filesize
8KB
MD504b5475fa09c3ec8aa86ac491f3678b8
SHA1a3c1bf47f339753e1de814c549690572e2e46d6a
SHA2566b9e6d7d29334acb62c6b37107d4c5add26f4a19f8d0209e76d3c0ba67a4fafd
SHA512cbccae9117b19bebb40a8102c902f3d0c535342dd991225e7a5d202dfc9c4a48471b0f518409e607ba23934539edda1e0a95c2303aa85c0d95e04adc1f945ddb
-
Filesize
8KB
MD5e540256af18dcedcb2f6f636006c3a87
SHA10377ca937682fcbff09375ca03568fca0a07c5a2
SHA256d87ce37c6ad220916005daa9c433ec235b4c364aeda92c61004524107e47c538
SHA51208f64cd5bca4397f9a44735c60bfbe123887ac15c432d17f192769490573bfe70d7acd6c145c36905c3e1e4e4092c05b14c985c21437cb35458da300f1a5ce2d
-
Filesize
8KB
MD596b376d0eda422be13f379c3741ab1af
SHA181bbd0bf43dbf03fec97a0f2f87c63b6c0a68ce1
SHA256902837989a0cc0ef627b84c4cbec61d1f5cecc441c54c9435856485ceb8e4872
SHA512695fae3287d2bb406eb11a571656d2e70866e95eaa3b5ef616da2c1c975e16947e95b8920163642603f59e23a78182ded614c7fa95b59bc709e4186115f85363
-
Filesize
1B
MD5e4da3b7fbbce2345d7772b0674a318d5
SHA1ac3478d69a3c81fa62e60f5c3696165a4e5e6ac4
SHA256ef2d127de37b942baad06145e54b0c619a1f22327b2ebbcfbec78f5564afe39d
SHA51206df05371981a237d0ed11472fae7c94c9ac0eff1d05413516710d17b10a4fb6f4517bda4a695f02d0a73dd4db543b4653df28f5d09dab86f92ffb9b86d01e25
-
Filesize
512B
MD5af3da9783211087f8fe13d8f57ef21cc
SHA13b8cd9216370d3dab9219ed2ab1d1d65b6731aaa
SHA256ae2ed83ec250cbad0a8d5d57e43816ad1447d2f9996f12f43852d74da4d62460
SHA512dc586a2f3d6c0b468cc032fa57f159facf3896a633d665edd1a36ed72d4235f9f9439c62f5d73508e44477f0e1219f521ea8af4175122402673d83ee0c3ec0ed
-
Filesize
1B
MD5eccbc87e4b5ce2fe28308fd9f2a7baf3
SHA177de68daecd823babbb58edb1c8e14d7106e83bb
SHA2564e07408562bedb8b60ce05c1decfe3ad16b72230967de01f640b7e4729b49fce
SHA5123bafbf08882a2d10133093a1b8433f50563b93c14acd05b79028eb1d12799027241450980651994501423a66c276ae26c43b739bc65c4e16b10c3af6c202aebb
-
Filesize
465B
MD511b1d65306f29cb49dc90d9982607e53
SHA14f863673073dc160d085d7754b605a4bedf7f26d
SHA256c94f4db599c09ff68b96f10c5e5d3c09ae25341024474573ec747f5e3abb4378
SHA512f8031f453536b71c55e4acd534dd7ff66fffb2b432eb87ae7817535e0bb6233da065c4f09ec5e1bc146da36d36bf68075cc2c0b9487cf5ea86ffab81dbd1bd9a
-
Filesize
83B
MD58ea94c47513a6294c16b4e9d80358e82
SHA1dc27a13ffc44146a96c9c14974d6aeae7f2c7bb4
SHA256d14c3ecfed2356c8db30b3a92e1051ff5aa1729763d1c5b302c004c7f0dfe6c1
SHA512f1d31bd0dea42322f60578644320a8948aeb78d347cce649ed2d606a290ba9941bfbfc68ccddf25a118d44a396afe254df0aba60bbafd261b1aa53145e619761
-
Filesize
8KB
MD5e81206449065839f9ce4aba536e18365
SHA1d8e51c9007c7d1ddf28cb92e62f1f8d18e95f221
SHA2565846a83729aaf82ce9970f75b61c6b58c4f317e59f60d6fc055d610f4d928f16
SHA5128f37d5f187fb9d11489ebee7908252e1d3bda1614fdd6b10be0df56246b9f44ad3c4f679b001fafc96c4db5cadb3e539f556d5aba495ceff4aa1e9c860a49910
-
Filesize
504B
MD512ceb417f2219efd3ffb1092f1b022d2
SHA13da2cd9b1664a1b592515c81035d94d6ecb1cbd8
SHA256354b79bbb4eceece93a96d707d8318c89aa2f681a0fd4368b940d4b95b8c4f0d
SHA51204da01a9d0aed3987d47141747d8d41fff84599234fde45d76529214434643c056c1ba10895b08b93576cfcd4fe35f745f98f6025f9392a654cdc5c4393c62e9
-
Filesize
12KB
MD5017bfd7f9b211e47c12d474bb48dbc7c
SHA16b27467ffe6b4efc4876d5e9c331f94390649069
SHA2569f0fd9ea94cd14dc6c4c4e8159ec24eccdf5da3892727c834bcb5f65c97c0bcc
SHA51219398c6240e71d5787bb630e3ae4b94dbd7e772b4aab31306741e652765440a54a43d18445dfae87e5994fc563a2ccee4a817be3d11f1026728de476215101eb
-
Filesize
520B
MD50810cba5d7419b24b8872515d831b0bd
SHA1f8349471e25e78a244df4fa792d78db38b38b454
SHA2569b8f9d2b0d3937035563d01fcbdc4911e53dcc330dfc1c919ef767bf141f1e26
SHA5128485148f2f634b55e584e0ae64500542bc3212f75cbd1a8ac1a8918e63ac2dad6a3304cdb342813cc1986a47974105e0bc3924e35ffcd5cb89206d6991527af3
-
Filesize
544B
MD511b788cc03be27218404a266d9fa9dd1
SHA117425f1e1a90ecb0b2c09dce94292291860da8bf
SHA2565d40a247981fa3b6cd0c4ddcace8501a27b94178a017f6114c8b4f1725c70392
SHA512662eb172d4f5936b1face994c3824b0c34502283ac5ea45603d4dafe038be20f11637c2b0d532bc7617d7acc2f8bdc337ed3598c6a32e597d5f6fb35f62f5669
-
Filesize
1009B
MD58571a20d5ac2aeb3a3aeffc75563028c
SHA119cc5428c720bc356a6eb1b564f27243a3000750
SHA256d3a7999a0f7c03939efa9626a0db217def0a99ce6ce897391b6dd2c93cabd094
SHA512a1afb0e81ee89b7b74b099003a7e83c73123b4dfadfad766ee2cd10ab59703bd3e551cdd88eb5a0d0bd21288794bc7f170a5c91bfa5b39050e97b291e3de38b4
-
Filesize
580B
MD5da090cd7e1e5b846cc3f570911d06138
SHA1ad24b4b021b6a6c418af361f1b11f4d48ea23d79
SHA2562c2009bf8116d5f5d10724c9cfcea0befb4c08b21cae3b752156cfcdd8999c18
SHA51272bbfbbdb0c542f10a71d421ea7265db8748f0089f5c9a2434ee7605585ed120c4fd30b485c69a83b38021a933d9cd651d535360e950f0e4406170695cd368fa
-
Filesize
628B
MD533d0d18eb181e14351bc5b7091431b75
SHA1cfeef9d228aaf074802f65f13b873978c92a5de0
SHA25606fc5b495b006e2a28b25ab623e26a88550e275d252be810d912ffeb0ced9298
SHA51207c01c3ade2882e6817194fc25f036440050af6bf3f7ad2dcf8dcb7c5836dc6610063a6d234a389cbabcd1c4d432c4a3d5bacf36529d2f52aea9b01859fe1dc4
-
Filesize
77KB
MD5e319d04a875bb152ad9f13d13a7ac635
SHA1c7d9a8ec0872dfeec77d8cb9cc6ff33549772bb4
SHA25687c696f4f768eada5c7bd6877cf7c7ad5ad8b91828082ebf7e6fe681604b297c
SHA512e5fbf545c856066c7b37841312600f9aa131f097a5ab63f03e8ae1226f8fa97dcefed8ef298328ad78629b44ebb2ab2f9122472fc6fd94ed01a6c44e26bf904c
-
Filesize
77KB
MD5849d9ae96fa7b1fcf300d24d0f5d4cc9
SHA1e386f42de2fc7ce24dbbf8f9e87fc8050d806833
SHA256ecf618b4f22e016ea875601d20c13896731e5297e26c49e50100393e60749266
SHA512ccf3740e87c7e44e442d9c4ed007c89bf337c1e2fbe389492b81232e142a47ce3b82cf35c0ccf69835c1760c77240d592a666359eb1cbb56d526d75ebed2a8fe
-
Filesize
2KB
MD56b79bcda9294dd3ce9b51a55debaecc6
SHA14689e25453774db348b08dab6f90f3ab4e659d43
SHA2560f1ddd6e0ef710a718913705af2481b308f35e5a21a71cab90aef9960492e183
SHA512160b1b84d08b61825cc31fc52d012678254510b8f044f2828e800fba21fbeca150ebc3a9ee6f12248f3eeb94b89c852649684776a0eb3aabfc4373049bc88339
-
Filesize
596B
MD5339378772a007c937850b700d698f19d
SHA102a7ced4703718b0af83557c57bf87c3935bd839
SHA2560d2110bd02d7ccb40f7b15b68b333e8b19c4b372e113756b4aa2d3450c9b65cb
SHA5126167798b4d54f2764852b0544cc769a3e3eac4a489a0f3e4e677d87f64d052c389deba34db754d448a1c5acc95ce3981dc758e7f3c32126a5cbd545db8b9528c
-
Filesize
539B
MD5edbb02fca47734d65d75936a7d4ef07a
SHA1c5ddaf7de5de118b2c9b99acdc5771b8c6324823
SHA256015c23bbeb7e677dace3f9f1f9fd81cf0311a808e956a7ae61f02d821d2a019e
SHA512c30d0e149c11a625a57980ab2e30c23feec9194f81748fe8702fe8a956a968c1c87ab37804ac35cb5eaf34b09450d43dc1a3ee7de5125dd419553198486fa474
-
Filesize
94KB
MD5042ca0fbca28f6faa89a024b42e2ef55
SHA1893736affddef66d91414e5aabcf1762f3a0ea3e
SHA256fffcddafa1790f8329710b7a41f6f1990cb080e942c0cdd03255dd1bead26993
SHA5127061d22eb867df6f18fa8f12741d4885d83ef04c04011b560c7ddcddcd4db43fe2eaebd5f9120f8414d1005e81d3165a66fd353b0bac9475a45803ef340dcbef
-
Filesize
176KB
MD5b667ca71e42bbeb899566c8834ed085e
SHA1053a3f889e326efdfa0d3ae7e5b2655f0b7376d2
SHA256536678202267f95d80480f15065e784d7ec609922a0963d935e9c5a4b0f62bef
SHA51252255d3d7066d01bd47a9da788f86c707af14e7666a918737fa5ffb4bb003e97b28dd84a7cead3439ee39e10b568c97e80174a80bf776c7dd58335b06656f8f2