38af68e1e634689d02469179ec840c2cfa0a8355f41ff41f98ba3eb52989d277

Analysis

max time kernel
2870865s
max time network
159s
platform
android_x86
resource
android-x86-arm-20231215-en
resource tags

androidarch:armarch:x86image:android-x86-arm-20231215-enlocale:en-usos:android-9-x86system
submitted
23/12/2023, 15:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

38af68e1e634689d02469179ec840c2cfa0a8355f41ff41f98ba3eb52989d277.apk
Size

17.5MB
MD5

1f1d7a0bc559fe9322607ea247b54aea
SHA1

57ea4d274e5b166726e1d7e95f3dfce9a4bac111
SHA256

38af68e1e634689d02469179ec840c2cfa0a8355f41ff41f98ba3eb52989d277
SHA512

5991a55fc7e2aa7a71b979a019da5bee92b1de18615840233a180d194d66cb45d7884e611821c4c0a9e0ae52874db92563a9b47eed037679aac3ceadf5c7afa6
SSDEEP

393216:OjGEK9GQFGCbja/g1lfgAQ43fpaRdaosDuZxqTYTp3q4OhFmQtTUhg:0K9GPCbUAb3fWdaNqqTMjEmDg

Score

8^/10

banker evasion

Malware Config

Signatures

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 IoCs

banker

description	ioc	Process
Framework service call	android.content.pm.IPackageManager.getInstalledApplications	com.huncheji.ars

Requests cell location 2 IoCs

Uses Android APIs to to get current cell location.

description	ioc	Process
Framework service call	com.android.internal.telephony.ITelephony.getCellLocation	com.huncheji.ars
Framework service call	com.android.internal.telephony.ITelephony.getAllCellInfo	com.huncheji.ars:remote

Reads information about phone network operator.

Listens for changes in the sensor environment (might be used to detect emulation) 1 IoCs

evasion

description	ioc	Process
Framework API call	android.hardware.SensorManager.registerListener	com.huncheji.ars:remote

Uses Crypto APIs (Might try to encrypt user data) 2 IoCs

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	com.huncheji.ars
Framework API call	javax.crypto.Cipher.doFinal	com.huncheji.ars:remote

com.huncheji.ars
1⤵
- Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)
- Requests cell location
- Uses Crypto APIs (Might try to encrypt user data)
PID:4478

com.huncheji.ars:remote
1⤵
- Requests cell location
- Listens for changes in the sensor environment (might be used to detect emulation)
- Uses Crypto APIs (Might try to encrypt user data)
PID:4600

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.huncheji.ars/files/customConfigdir/blackNight/custom_config

Filesize
2KB

MD5
1aa5e2663dd6c6f08b60b0461758d1e3

SHA1
0345413f496acf37fd3dd37cac1a3678e7bb49c3

SHA256
21799a1a187da799d62d4bc0831585aff0d5b9392dd76dfc6276c176d06a4160

SHA512
0e41e3911c25b2125344dacf1c3ad0ab1007c879b51aa3c4326cf73a83aa25386e69333e6ecb658254f46bc37de483c8b826e9f49d338c85920ed9dca5bf490a

Download Submit
/data/data/com.huncheji.ars/files/customConfigdir/freshBlue/custom_config

Filesize
1KB

MD5
7d53282e76c3f4bcec580896bbc660c0

SHA1
49946ae6a66c8cb024abfc053443fc987e15bb41

SHA256
3039ea5064f590e5d078ee01e9b00a1d3316c542236ac0bd4fbb8ebe084f1fb6

SHA512
05726c3f1f45b9d90f81ca107ad9294187698013ddd411fc13fafc65843c060075acad4e878b5b268d536499e7a87160a3b614bdb55c8e11b91070022144a01d

Download Submit
/data/data/com.huncheji.ars/files/customConfigdir/midnightBlue/custom_config

Filesize
3KB

MD5
65437cc6c868ebb7d60b235bc6babe1a

SHA1
7ec6fa59589421ca585e704180a879101e901fd9

SHA256
c4a9282866f01881677847b4bc0337f528444f2638f33cacb72f6b974124b5bb

SHA512
22a6dfa234206f2fe45300d60585bc360f80212b1056c6d504e2ca63b0ec01b8dfd8a99a241a5264c8638952b6a62926be7156b14438255ea0669974d23131e4

Download Submit
/data/data/com.huncheji.ars/files/libcuid.so

Filesize
129B

MD5
ab73ac729bf60a6fd5e0005fae273f3a

SHA1
bff13711fbf8a758b27623d3ac0daeaf419aac90

SHA256
1153129316fd5fccead2539d5ff348fd745c4283bac4e5df1eec89f39e434cb6

SHA512
aa37e0181d1f5cc025c93d087d9f62623f618f676282ddc80fc8b8b8f0d9e2352f88182d81d6d1b8ef774189a970191f974d19448ed515ffdef93b3524eac3f6

Download Submit
/data/data/com.huncheji.ars/files/lldt/hst.db

Filesize
4KB

MD5
f2b4b0190b9f384ca885f0c8c9b14700

SHA1
934ff2646757b5b6e7f20f6a0aa76c7f995d9361

SHA256
0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514

SHA512
ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1

Download Submit
/data/data/com.huncheji.ars/files/lldt/hst.db-journal

Filesize
512B

MD5
035d5836d3edafb95456795e90ced212

SHA1
047477d8eff7d4eccdbcc13a7425f6604c5d3e5b

SHA256
990c7eaf88edce4942614c4211c5c76acc8db8b1080817ba14a0558d44548fd0

SHA512
56748f2db4711e6cdf98afa2486db29f3fcfe97c34cbfb49c08e584cfdefc58abe5da8bd06134a46dcd3da90c882bb19ecc66a982c44a53a9258c69f7f5d111d

Download Submit
/data/data/com.huncheji.ars/files/lldt/hst.db-shm

Filesize
28KB

MD5
2a93570932d54f12142fb7b5b830e866

SHA1
c141ab0a0b097607c20cf620848654021bff15b8

SHA256
df2582413658147deccb367fda6eb559ed64602e1843d7b1f813bef1f3364661

SHA512
8b998cdae3fea18fa0ee80aff2cc3896aeb8b40ac4a542a0e632ef541b8c21dc84805d7279781be1706f6146307d576d0efff39521b90bd25fb6559b9bedd582

Download Submit
/data/data/com.huncheji.ars/files/lldt/hst.db-wal

Filesize
36KB

MD5
656f499657dc71bb5583444620ea3364

SHA1
07fdc791e82d2e4b93b186ea58ff482711f0972e

SHA256
35b4648016aa9fac7989d9f8b7bcf6193d171aa39117c1376c81df832d6ec282

SHA512
76020f5c9c4c6ba0b4ded3a2d654bfce01102cc0506f7e01f084b72acd2977075dc02050013e62ade59de2580996a6cf7828b0fa8943f89a0abbc059c3e4c53f

Download Submit
/storage/emulated/0/baidu/tempdata/lcvif.dat

Filesize
96B

MD5
3d8cadd1d2ad101d00250de559fe3107

SHA1
f33641cefb51c9ae5af27ce34d292024feedf0e4

SHA256
f0ea0e468154198e8361ec1b36701b62935e6be74ab5064079679b2faebdc302

SHA512
3f102586d5d32533da4b4f60e5c127fdb2eba2a5c081bff861e8484f07f2fa6ecc6e5ea795dc43e38338ef12273bcae1120c572820c04d02812ac6869157cde6

Download Submit