Overview
overview
8Static
static
620a9749e2f...a2.apk
android-9-x86
820a9749e2f...a2.apk
android-11-x64
8Bet.apk
android-9-x86
Bet.apk
android-10-x64
Bet.apk
android-11-x64
Kaijiang.apk
android-9-x86
Kaijiang.apk
android-10-x64
Kaijiang.apk
android-11-x64
Main.apk
android-9-x86
Main.apk
android-10-x64
Main.apk
android-11-x64
Query.apk
android-9-x86
Query.apk
android-10-x64
Query.apk
android-11-x64
ScoreGuess.apk
android-9-x86
ScoreGuess.apk
android-10-x64
ScoreGuess.apk
android-11-x64
plugin-deploy.apk
android-9-x86
plugin-deploy.apk
android-10-x64
plugin-deploy.apk
android-11-x64
Analysis
-
max time kernel
2534629s -
max time network
167s -
platform
android_x64 -
resource
android-x64-arm64-20231215-en -
resource tags
androidarch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20231215-enlocale:en-usos:android-11-x64system -
submitted
23/12/2023, 13:27
Static task
static1
Behavioral task
behavioral1
Sample
20a9749e2f0914e69ed9ccd2c8576818c801376fccdbab3ed4831c813e814da2.apk
Resource
android-x86-arm-20231215-en
Behavioral task
behavioral2
Sample
20a9749e2f0914e69ed9ccd2c8576818c801376fccdbab3ed4831c813e814da2.apk
Resource
android-x64-arm64-20231215-en
Behavioral task
behavioral3
Sample
Bet.apk
Resource
android-x86-arm-20231215-en
Behavioral task
behavioral4
Sample
Bet.apk
Resource
android-x64-20231215-en
Behavioral task
behavioral5
Sample
Bet.apk
Resource
android-x64-arm64-20231215-en
Behavioral task
behavioral6
Sample
Kaijiang.apk
Resource
android-x86-arm-20231215-en
Behavioral task
behavioral7
Sample
Kaijiang.apk
Resource
android-x64-20231215-en
Behavioral task
behavioral8
Sample
Kaijiang.apk
Resource
android-x64-arm64-20231215-en
Behavioral task
behavioral9
Sample
Main.apk
Resource
android-x86-arm-20231215-en
Behavioral task
behavioral10
Sample
Main.apk
Resource
android-x64-20231215-en
Behavioral task
behavioral11
Sample
Main.apk
Resource
android-x64-arm64-20231215-en
Behavioral task
behavioral12
Sample
Query.apk
Resource
android-x86-arm-20231215-en
Behavioral task
behavioral13
Sample
Query.apk
Resource
android-x64-20231215-en
Behavioral task
behavioral14
Sample
Query.apk
Resource
android-x64-arm64-20231215-en
Behavioral task
behavioral15
Sample
ScoreGuess.apk
Resource
android-x86-arm-20231215-en
Behavioral task
behavioral16
Sample
ScoreGuess.apk
Resource
android-x64-20231215-en
Behavioral task
behavioral17
Sample
ScoreGuess.apk
Resource
android-x64-arm64-20231215-en
Behavioral task
behavioral18
Sample
plugin-deploy.apk
Resource
android-x86-arm-20231215-en
Behavioral task
behavioral19
Sample
plugin-deploy.apk
Resource
android-x64-20231215-en
Behavioral task
behavioral20
Sample
plugin-deploy.apk
Resource
android-x64-arm64-20231215-en
General
-
Target
20a9749e2f0914e69ed9ccd2c8576818c801376fccdbab3ed4831c813e814da2.apk
-
Size
15.7MB
-
MD5
f8e48ddbe13dca9f7b92d1835fe1249d
-
SHA1
9403a59239e6123253a5ae2caa111496fae55c61
-
SHA256
20a9749e2f0914e69ed9ccd2c8576818c801376fccdbab3ed4831c813e814da2
-
SHA512
74186310d0229d05b483783a2e08f29a6ccbf192a4fa69108c23b58104d6c5d85c1d9b9e5755ca16bc1839a1d3f20731c9c90bd09b65eea5f3419945519dc848
-
SSDEEP
393216:Sc8sYF26P48qGuWyzcMjWZz3Mkw49rEpx6ePr7e:Sc8sYF22u/gMjWd3MkworE36ePW
Malware Config
Signatures
-
Requests cell location 1 IoCs
Uses Android APIs to to get current cell location.
description ioc Process Framework service call com.android.internal.telephony.ITelephony.getCellLocation com.acp.main -
Loads dropped Dex/Jar 7 IoCs
Runs executable file dropped to the device during analysis.
ioc pid Process /data/user/0/com.acp.main/app_push_lib/plugin-deploy.jar 4470 com.acp.main /data/user/0/com.acp.main/app_push_lib/plugin-deploy.jar 4526 com.acp.main:bdservice_v1 /data/user/0/com.acp.main/files/Main.apk 4470 com.acp.main /data/user/0/com.acp.main/files/Bet.apk 4470 com.acp.main /data/user/0/com.acp.main/files/Kaijiang.apk 4470 com.acp.main /data/user/0/com.acp.main/files/Query.apk 4470 com.acp.main /data/user/0/com.acp.main/files/ScoreGuess.apk 4470 com.acp.main -
Reads information about phone network operator.
-
Requests dangerous framework permissions 14 IoCs
description ioc Allows an application to write to external storage. android.permission.WRITE_EXTERNAL_STORAGE Allows read only access to phone state, including the current cellular network information, the status of any ongoing calls, and a list of any PhoneAccounts registered on the device. android.permission.READ_PHONE_STATE Allows an application to read from external storage. android.permission.READ_EXTERNAL_STORAGE Allows an app to create windows using the type LayoutParams.TYPE_APPLICATION_OVERLAY, shown on top of all other apps. android.permission.SYSTEM_ALERT_WINDOW Allows an application to read SMS messages. android.permission.READ_SMS Allows an application to receive SMS messages. android.permission.RECEIVE_SMS Allows an application to write to external storage. android.permission.WRITE_EXTERNAL_STORAGE Allows read only access to phone state, including the current cellular network information, the status of any ongoing calls, and a list of any PhoneAccounts registered on the device. android.permission.READ_PHONE_STATE Allows an app to create windows using the type LayoutParams.TYPE_APPLICATION_OVERLAY, shown on top of all other apps. android.permission.SYSTEM_ALERT_WINDOW Allows an app to access approximate location. android.permission.ACCESS_COARSE_LOCATION Allows an app to access precise location. android.permission.ACCESS_FINE_LOCATION Allows read only access to phone state, including the current cellular network information, the status of any ongoing calls, and a list of any PhoneAccounts registered on the device. android.permission.READ_PHONE_STATE Allows read only access to phone state, including the current cellular network information, the status of any ongoing calls, and a list of any PhoneAccounts registered on the device. android.permission.READ_PHONE_STATE Allows an application to write to external storage. android.permission.WRITE_EXTERNAL_STORAGE -
Uses Crypto APIs (Might try to encrypt user data) 2 IoCs
description ioc Process Framework API call javax.crypto.Cipher.doFinal com.acp.main Framework API call javax.crypto.Cipher.doFinal com.acp.main:bdservice_v1
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
231B
MD587701f262bc6ca66559b3f97c2c79133
SHA13a5f53f575547d51fd20734b55b71bd0c5cc82a8
SHA2564386e6c1e2f5aef3010306cc8906a53b54c6018d521228f77dc900d99b8b4fd7
SHA5126b5ee1caf49cf81bd4487c5e0781a5dc42a867f5a5704edb9d8239e1bd4bd521dd9cfc8ff1afda14c2a56e9b5d7a39678ca48f4da5a0f30305c41f400161bf4e
-
Filesize
213KB
MD5e70723b8f6c4c7c09a6019733022cf53
SHA1e3ca32166c65e4dc73c21347ab22d54a7b5a9a83
SHA25632d35cd80b0302e3fcdd7349b4ff9a7b689ce080435109607ff79a834ff710d5
SHA512461c0499193c5ef5aa4e2e5d358031e7d28c98c8e1e38d22b710271bf3b561c28232bfaadbc2c275357e31b7b0ad6bca798008328ac3cff3701c1c9cca2ddddd
-
Filesize
530KB
MD5bdfa71feb08b80b649fddcd7488b03b4
SHA1bcacf11199fd2c353034a7271b5dbfe2dd4cbddb
SHA256f8bd07a7afce2d102976afaadd33dc70336a0b06682ac8d6fe9544a08d086d1d
SHA51237dc848b995def498d0c832a76ed0ad429db18f26a5e9659c2b77a63bff555560160b6be4d22387eb529b2291bb27ae21718ddadb315bd1aa4c092d6330f049a
-
Filesize
174B
MD51ea8459a688352c3573a8e80727c2644
SHA19b47864e96eed98798a6da2b8860c8f8a68f089e
SHA256be2c0f9e472138a78d35f29013fc43dfeae991806dfebbc5be5c8dc86b8a1093
SHA51299a26c03e760fdac91546a47e18e58851996b7e38e93812a6be23f1eee64370323ac492c4c224bd419d91566356fcb8eca3989ff4f2ce41db3d16301fa9dd75f
-
Filesize
31B
MD58c92de9ce46d41a22f3b20f77404cc1d
SHA18671a6dca00edb72be47363a7071be65cf270373
SHA25668bb33ddeed9200be85a71f70b377985f9ee68e91578afbde8321463396f1274
SHA51230f45fe9954215d6adafcc8f0a060a7ff41963a64f9b849a37f0d18fe045038d429ec13bf15226769c4ba78dad3c52f3d9e0dbbb4fcdea4828a1efe956e48f56
-
Filesize
5.4MB
MD5d6e445942c33d2de3cf7db4cf4cb9e5d
SHA1c5d7eaac17a230dfe7e15407a72ab81d68da23c0
SHA25684211081c4660e9ed89918ae6ed40191f18ac6546466f926746dd9085b9c79ba
SHA5123cfd6a5d3b853a3625f28d72c1e93acb6baab2631b69f807266c2e03f2f5779284a72e6541ac963bd14d203e1fd8bccf6cbf917d84e3d5f2b93aa04257cadc9c
-
Filesize
1.8MB
MD5eaf2c828fe26eb33a000ddf7db8e99ef
SHA1e13397f46790407d5530957816d999b23efd682d
SHA25609bc00d642a26708cd8db701e16ff875af8f5d2d499675b0dca473784a3ad095
SHA5123cbc97ce1212324651f1d6ece75333192a90ba6ef48d33c0046de5e7a0b9bce2c5c092577a09dcff455445efe15302cac2790fd2a2d274b6d66ed0c396f3ad17
-
Filesize
453KB
MD58c13553ca168b0e70fa02a154efe147e
SHA1f8724c92f5415afc4b1e7b0e2e04018f0efa4836
SHA2568f50aee0b345688b7239aa4a9b1e6c138c442b5dc167cfc6c943132bfc5bb19f
SHA51222af723f7dd1e3d429e362c4d0f1b1e56387cf3bbb577edb40600d828d9e1c09748887035d1bb8a0df60e9ee8bdb1d293af6395ae735f5bd056b7be6e2a8524d
-
Filesize
232KB
MD523b00fe86a75762999ff6a542a88e050
SHA1c8588d1ced63d2a0aecb3060b9a9f9a943f0eb8d
SHA2560865a78f504ce9b1d2859659a4d2d91cbc29b35ba47f1aed8efe122cdff1a544
SHA512a03d3ee0629196502f2bbd673d1086f8ca1d69e653acd2383979c6d28139a345409cec419fd000114cbbd956aabb390288c8b7970fead0c1b70b0b3a7e6456f9
-
Filesize
3.9MB
MD5f337469863dcb44c4d06919815823149
SHA166aca4bda6daa9e0d181747a2de3f627d9f2ed18
SHA256866ac47014e36be925283c77de840fecee5a096d8a270ee7d560acd76dc35cf5
SHA512b517b01426fa84750925eeb4119518194c5a05ad70fbc7fb288d47803b05177a7e7f1ab492acde868e99d3b27ceeb353cd7920a5b4e306e56f27dcf9082c07d5
-
Filesize
2.8MB
MD593b6482530714375c686e71a046546df
SHA10f796692936ceaf8aced4257beae5b0a42535cc6
SHA256aa61cf55783bc0ae58768544f49ebd132bf37986b4989e44f09917c24340d45b
SHA512e55cbe94bf9c7a36668c62b5aa67d83715c5fd1c5ffa8952469acd19a7b51e74208d72351353eda382e049af0992b9f362d41bd33c694a949a28a4ed54a43c0c
-
Filesize
537KB
MD57869d5f28c808b7dbe00a93477db1c23
SHA130cdfdf96a20270e7614d4d117840693dfd0a6d9
SHA256a4fdde8ec2430027167d1b1be6febf64434fc63ea3e02d932306112e77fdfab7
SHA51261dea52cdc44d2163cf36e52e700c3345ac83351b07bbc74835afa3fde0a2845b3ca733be4351c6c215356747e36f1b4ef847412cbf21375f46a4bddd519ae8f
-
Filesize
296KB
MD575b1ce714096c8de0b341ed9d7c7a01a
SHA11ca48796beda58f025208468ceb8eaed4fd023ad
SHA2566fcc1ed7a0ccceb7599b06cf8ea259e1e8926b4f2e90ce74956ee831df3bf56b
SHA512f923b3851cfe53369e0b8648ccb6d75cc83245185265e3c6b5e8a91b0fb4ec53c10adb615b4e31ff551852f9ceb719489da905b6ef5c232fbb9647202da4a5f8
-
Filesize
656KB
MD58b2aba36ab97e3066e8e64810b834de6
SHA12359a19f8db2da97bbfcc79b6cbb58b37ff30435
SHA256f97638b454a85c1ebb99e5b423367cd75fb6c9994fef2be1a2bbb7b36b0371fc
SHA51257708eb9dc03738fe33e86b30cd3dc2bf8e387c9d0ff74983f5f0c6ba1d22eca2b62528817bc795df20925a761136360c136b462c11b2630f3a3e5a921f1fb42
-
Filesize
2B
MD5d751713988987e9331980363e24189ce
SHA197d170e1550eee4afc0af065b78cda302a97674c
SHA2564f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
SHA512b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
-
Filesize
25B
MD52d805b13f2f28dc3ca9bbcc000f49bb5
SHA19eac165b4d81258fd3967cde5cc53b53b1dabcb1
SHA256c8a6624f390568f0ddcb9841336aec6a564460fdaf6624e562b32935b8956f19
SHA5125db8c57bab36bcf9db698c1dce70318cbffc156dd1d1c1e09e5b7ba60aff07b598ebbf26c4bd8a2b03bd6e59ef2dde2d944a22a8d8a19ecc8378e83afb7c83b0
-
Filesize
732B
MD53945bbc5fd978c7bae8c7cc317ee1ef2
SHA131d85fde0b426237e09aecae641d53123cfc5588
SHA256968b42fd43ee976e320e1c84a022f7a9188668be55d60153e67507703defbcf0
SHA51243cfea29c2ee041bd57d44bd3ae0b90f484ec3179073337e5a9935ded6b2cb74c3e41ca29c4ff94edd0585c1ec4a0a07d78c1a877388fbd42df689cb6111781a