Analysis

  • max time kernel
    2724972s
  • max time network
    146s
  • platform
    android_x86
  • resource
    android-x86-arm-20231215-en
  • resource tags

    androidarch:armarch:x86image:android-x86-arm-20231215-enlocale:en-usos:android-9-x86system
  • submitted
    23/12/2023, 16:14

General

  • Target

    46e1a9b2e22e62d75078b37672b5b546f570b8406e23fe4946a304b03f036e6a.apk

  • Size

    14.5MB

  • MD5

    23c81a9e403eee3421cd19e9fdec3a6b

  • SHA1

    087687f936a99f4f2965bf59a1df076807d0ec08

  • SHA256

    46e1a9b2e22e62d75078b37672b5b546f570b8406e23fe4946a304b03f036e6a

  • SHA512

    5c02b61899e06775e9d5131c373ec9246ea112f6faec568d866ea4261c7469a36b90aef7184bb78ce9b3ddb8f112cc4e004e419c94d837e42b0c9824fdf0a1c6

  • SSDEEP

    196608:l8tpNrIxRoOeJVrDiryGzS+u5sRNz6k46Zd/Q8qQc2Ple7h0AeUxotyjhzQ74JLE:0KeDivUet/QQc2NAOXUxayF8742cL+d

Score
7/10

Malware Config

Signatures

  • Loads dropped Dex/Jar 6 IoCs

    Runs executable file dropped to the device during analysis.

  • Reads information about phone network operator.
  • Requests cell location 1 IoCs

    Uses Android APIs to to get current cell information.

  • Uses Crypto APIs (Might try to encrypt user data) 1 IoCs

Processes

  • com.renying.matchu
    1⤵
    • Loads dropped Dex/Jar
    PID:4247
  • com.renying.matchu:pushcore
    1⤵
    • Loads dropped Dex/Jar
    • Requests cell location
    • Uses Crypto APIs (Might try to encrypt user data)
    PID:4310
    • ps
      2⤵
        PID:4676
      • ps
        2⤵
          PID:4696

      Network

            MITRE ATT&CK Matrix

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            • /data/data/com.renying.matchu/.jiagu/classes.dex

              Filesize

              6.0MB

              MD5

              847d89f1cc414c97e9b083fad375e76c

              SHA1

              f74d579e77f617c3cb23109ac59491e86e40259c

              SHA256

              f395bfb76670a0b29f57c4305d82feafae2b428583090c8702b64369cfcfa1ec

              SHA512

              93788b595da0d80c035ec0bfade82189e49c19ed23d6f6f56003e296e1761de238794c31c667e8a7958f88b346b71d440616bc1f92fbecd26f1fbc6a15831bc2

            • /data/data/com.renying.matchu/.jiagu/classes.dex!classes2.dex

              Filesize

              6.9MB

              MD5

              69ed15bdcb7f3959259457504c2befde

              SHA1

              52741d43c0887232f87a7350fa8342e108276b8d

              SHA256

              bbce4712fdfa3a3f42631dfe748bfdec921e46693992dc6468dff8f952d82437

              SHA512

              83e2827f24825e460b1aee8411ea5a643dadf171ee85084bf51834d88f1d0aee89d782d0060655adcddc8ac16156ac19b36424d49093dd0bfe8a8c3b6adfd020

            • /data/data/com.renying.matchu/.jiagu/classes.dex!classes3.dex

              Filesize

              1.3MB

              MD5

              4d19bd0c260f7f0ab659cab0b128e4c8

              SHA1

              d4ea9c1f19717e1d6de354163c8b32b412c70f0a

              SHA256

              4a562033ed6522d079ab01a0a0c99b07524e0f34a93dd4afd1456af932f26e83

              SHA512

              eb71ae5f1e8f3fc65fb115c6144bdaa0f482444bb6ca2113142ff83575bb4e7ad283b71be9283d3bb0d6dcef73c8415f151a502c570ce2f0d2d7b1c4b1b65b44

            • /data/data/com.renying.matchu/.jiagu/libjiagu.so

              Filesize

              497KB

              MD5

              e102893683a16d223c852ac584155d58

              SHA1

              5560d79d71fb1951d6ab0a464af87429a4933c2b

              SHA256

              41c76fbc6aabf843f22a1cf49a457bb99a7579b7260e46b2841c30afd82523c8

              SHA512

              3129498f917661361bc9a0eaba6b7b6490c2216e19dd7cc802b1f2f22fc16ae43b86a7ca97273cd2e2504a7e7e08a173daac34f5085a21ffd4ac1d84e76cb8ab

            • /data/data/com.renying.matchu/app_crashrecord/1002

              Filesize

              228B

              MD5

              6b8f633dcb471beb17996c3e4aebee0d

              SHA1

              663d2c503051f3271be502c0eeff799e63c1dfd5

              SHA256

              e682c73f34b265889cb3ba3805e2d6d32bb362673b75bb417635449af302c89e

              SHA512

              c1a41265600df44509a78f24b13e256eda8b0760e94f8217ffed2b653d395ae9f0d3093a4f8fe9d909fe5960c401aa33aa004e7359b9018199522f1b2c939f59

            • /data/data/com.renying.matchu/app_crashrecord/1004

              Filesize

              228B

              MD5

              afa3a86c4f3ad0f098f6fece992720e6

              SHA1

              39b957a609153ee8aaa30c730c41e28ed3f59504

              SHA256

              62746c03bf5b7c42da60aaac9abec3b72819223b8a2913676fe590ebf8fd42bf

              SHA512

              13618356062a7f2561f33bc499e3e40152fab7b4b556d95b533577cc0e8e8a68a357270893f116d7359772a2750bb7f6ef3768113d5e91af601b0a8fedd1969c

            • /data/data/com.renying.matchu/app_crashrecord/1004

              Filesize

              58B

              MD5

              0d210bfb2a0e1f1b4c082a6a0f79de07

              SHA1

              bb8ed9e364db79d1d9f2fcde3f15091893222faa

              SHA256

              988722c23d78a46021d0e7ca9deee7aa8bb83288269174ffacb7316f381cca1d

              SHA512

              536e9867b0df29b15b789f8949be6ab37fcdeccb9d39ded981da7dc2052c9533d0ec0e6f9a5444132977605d372e1463d91bdde41b528ff2ca3f65ab152325c1

            • /data/data/com.renying.matchu/databases/bugly_db_-journal

              Filesize

              512B

              MD5

              0dcbed3696b17e5abd7ca7f4d76ff4a2

              SHA1

              c2fd8628a7939d8622ec5d1a415bd6a96ace5350

              SHA256

              3ab2b250fea440a668d93a3835dbee3275bc57c6d86e117333bf85f82afb87f5

              SHA512

              800daef72ff8f513a5a41532e582deab89d30b1156bea413fb0c1318105eb0694f21611c4b919702bcaface99a78861cca224b16a630cb4591d9948255aa64d3

            • /data/data/com.renying.matchu/databases/bugly_db_-wal

              Filesize

              68KB

              MD5

              d12fd3a5b7b625bf8859ae4119da2f7a

              SHA1

              28fb781936b184e49138be9a7b3cfd018c45a8e8

              SHA256

              5b0da9c7e41c07711efb257ad12c1fc5fb304cb3731b609dc789037d1b76337d

              SHA512

              08f3f0fb504bd5beacf68f1653a9e47958015b53035b169212fea5ba75bcc1bf7edc0ca2d4043f2869ad12de7cdf312b4cc2ae9e5479bf304fb3fd4c4bbb5fbd

            • /data/data/com.renying.matchu/databases/jpush_statistics.db

              Filesize

              16KB

              MD5

              5fcfeef86395edd5c2f8f34a72978d21

              SHA1

              73b09fe06cb49973597ad24eee931087880f218b

              SHA256

              1e11cef36f82f27fbc5b2adef60ac5ac4151c8ae8d303b55eeca17bd517a1e66

              SHA512

              eaa3bd15de38f17d3f02c0b9dfcd948894b1a6daf36572316f714b1a992e2432d21124beedc34bac8ce12c40646ab5ee7e3012472366af26dc9842fc44516417

            • /data/data/com.renying.matchu/databases/jpush_statistics.db

              Filesize

              20KB

              MD5

              14c143bf03622c50535f1f002409c3a7

              SHA1

              682633f6920704f9ecd40568dcb442d2257ac7fc

              SHA256

              65f416824f23eeea229a19b4634920d3a502ed41b6e67d58728b68d4f03bc817

              SHA512

              b9da03b744c15ea05f3182821b103652319e38a8592535ea32e88a83f297ba6316ba398ffe36cfd10c5803497fad7fb248d9d63ce1d93bc1f80b6429a454a77c

            • /data/data/com.renying.matchu/databases/jpush_statistics.db

              Filesize

              20KB

              MD5

              1a21cc0eb45dbbbf42a49912161489e8

              SHA1

              e2851fcef3c9e115d47d12c43cb5cc7b72b2aec0

              SHA256

              94b40283d0f06e5ddf99d20b378944b53e2c12e558b9f9b2173ab24cbce098ab

              SHA512

              326fe11e5061a1ac33f8c4baeda59557bd5ea10519d5c93db650ef9ec20d99d63a4d81358751ff2949c7228545a0a3c946ece85475d001fa2bd9a732e437bcc3

            • /data/data/com.renying.matchu/databases/jpush_statistics.db-journal

              Filesize

              512B

              MD5

              2ad83e58a067baf2ab4ab7e3b660d2be

              SHA1

              59e9a75f535c9c1e5b9a42969f4438f6b39d372c

              SHA256

              b93c6c7885ae35f200d73e2621a22cccb4d773b80ff45deb56864b2667091e5e

              SHA512

              97771a57414ed925a4b202a18c03e3cddc967fb22ba165adc99e4591df0e4aaeb19621e28f676205f2553815d1d65a4649e74491c337ed5249a52bf11c71a294

            • /data/data/com.renying.matchu/databases/jpush_statistics.db-shm

              Filesize

              28KB

              MD5

              e8fe133ae8ac197ff76e2273bf6fde81

              SHA1

              62d0ea9a961475546c754941750b95e5265e8f91

              SHA256

              15406c03f184dad9fd0f2fbf3677a0a3d5b8686aa0a625c5655dc6ceba90c833

              SHA512

              a9b4286f6b1913d8753f208405767a825694584fe73097f6a117d0503d9cfd3c79cb4dff3ce48d3d3a96ae4a8b60398201812de2cfd865018b11235f0dd15291

            • /data/data/com.renying.matchu/databases/jpush_statistics.db-wal

              Filesize

              32KB

              MD5

              747930f6c00046707cbff547e21ccff6

              SHA1

              7b3d2f0fc0ed43566bfde09d395739c3fad213e2

              SHA256

              7f87c8389e0b6722bf6d29f6f41edb3a537ee0e3d58dcb774e56fc0eca27d053

              SHA512

              2c0585df7e9637455022e4e79357a5268ffe35a4ab455de7ec85f17370d9913e81a003746759110871756739221716df800f82ea0c1f9d93fe851d299b3a2c4b

            • /data/data/com.renying.matchu/databases/jpush_statistics.db-wal

              Filesize

              8KB

              MD5

              fa76bfc5c60e6c5ce859e6b58596de48

              SHA1

              bfe93ae1d99d0821f5b8f4330cc91dc62cf8c447

              SHA256

              477ff5d4422faf0cd0929d8c2648b39fcc969e834389b0fe0a2dc772781fa5bd

              SHA512

              61fa1228f3d794b8eb81c657205f54f3c772beb146ee8a615d32a20b621daef785f05af4c5fe0dcbb97d63a12e030fe6af6d2b2e0100341f0bc1b43a218102cc

            • /data/data/com.renying.matchu/databases/jpush_statistics.db-wal

              Filesize

              4KB

              MD5

              11a1ff8bd1ee856560474dd066de4a98

              SHA1

              0b354a3e4c686dbf9a77afb56651926b61ff9fc3

              SHA256

              d175432b63f278fc8531c049697141c23ab004926867582ef65a60b4f5343b38

              SHA512

              392890e4e00fa7eb319cdc9c2cdfd62aa224e0d46ab7c3048869bef9c92880f27cf4b81fe0adc20ed344e712432fc7b66f3caa3e2344b5c20da8fe9f055d6b5f

            • /data/data/com.renying.matchu/databases/match_u.db

              Filesize

              4KB

              MD5

              f2b4b0190b9f384ca885f0c8c9b14700

              SHA1

              934ff2646757b5b6e7f20f6a0aa76c7f995d9361

              SHA256

              0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514

              SHA512

              ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1

            • /data/data/com.renying.matchu/databases/match_u.db-journal

              Filesize

              512B

              MD5

              7228342ee7d2281a7f230a7a45c2d2f8

              SHA1

              d2d989336cc711ff9964698a0442d7c226223645

              SHA256

              33be00b682a68858085821f77351f0f98456e472d8923f2ed945d28da625e82f

              SHA512

              c8f4a5c9f612216f83948e21f4778ba840410fcea3a483967407a86b2c2d50c9d54c31dd3309b507a8ee979da2178969a7987b448ffb44b2c535fadcabf44acc

            • /data/data/com.renying.matchu/databases/match_u.db-shm

              Filesize

              28KB

              MD5

              cf845a781c107ec1346e849c9dd1b7e8

              SHA1

              b44ccc7f7d519352422e59ee8b0bdbac881768a7

              SHA256

              18619b678a5c207a971a0aa931604f48162e307c57ecdec450d5f095fe9f32c7

              SHA512

              4802861ea06dc7fb85229a3c8f04e707a084f1ba516510c6f269821b33c8ee4ebf495258fe5bee4850668a5aac1a45f0edf51580da13b7ee160a29d067c67612

            • /data/data/com.renying.matchu/databases/match_u.db-wal

              Filesize

              28KB

              MD5

              af682785a21eb512b7464956af74a000

              SHA1

              7e47b56068bc7a147c9e933ca617c62c973e832f

              SHA256

              e3bc9838c3775d7fb8c7547ee632b9e790ac6551f058fb7d45b4d3187f37055d

              SHA512

              11c2aa8f1fde4c3e3c6d3b878b7e2d3466d3a09970e6bf88b478435f3ee63f1bf18ea8167eafc433271706d597ba6ccb3546c2012b8a9941468f26b2cf4658c0

            • /data/data/com.renying.matchu/files/.jglogs/.jg.ac

              Filesize

              32B

              MD5

              2ba0801d8d41981377116c0f74924ca8

              SHA1

              e5d3dabef59770f0c4d24617a196d487507d7204

              SHA256

              763f1a6497f8303e32667d1a9c6029c609e0db88025e0e6e7eae61572ff8ebdd

              SHA512

              c1560fbda3c6b42ae592889162a9aa2995c022923d5f24da14981b01b9ff929acdd7d62e51e39c8b3b023ee06b96eb164f5608b33c165bcf2ecca8f3ccbf9162

            • /data/data/com.renying.matchu/files/.jglogs/.jg.di

              Filesize

              340B

              MD5

              37d03408487c889658b12bf63d95f3e8

              SHA1

              dc7e826731add8c84e7dcf14a83923df44b5873a

              SHA256

              16d57bc8cea652ee339a611759ece73cef0e34c30172073ad01bc26925257249

              SHA512

              24511a8a979ed3e0fb76a4f4ee6e6be26d74f74e2b3bd555f22e03784e4519217a051bef5d0143d6a1932ecde28008a9b48dccfab5a8d4b47992c579214fc952

            • /data/data/com.renying.matchu/files/.jglogs/.jg.ic

              Filesize

              32B

              MD5

              f07a868980b8f8407e44c189a74cf582

              SHA1

              6611dfa09cc88e333e67062113b9a635c3162cff

              SHA256

              d25054e5cd47e67ec940819efaf466294cd07970b4ae8576b15b241b1274637f

              SHA512

              715bd7bf6a87fad2dec0e137c80aeec113922f2c544bc21c95317f8c16119611bbcfc3f3c8a286ed111ceee317be29d41d3b104cb02822901fe96dcd6cea14b7

            • /data/data/com.renying.matchu/files/.jglogs/.jg.rd

              Filesize

              73B

              MD5

              214fb1029d52a7d4d74bc962a1239d4c

              SHA1

              35167c4e87bdae873e7ea7b042ee1f2ce8bc0bf9

              SHA256

              514e576431f4d6a4481a17b87b3f38b9772cbb385e0e026f758731ae893fbb05

              SHA512

              3cfffd1cce0b00e7c939f458b7dace63de9bec8a13b98246357f7461281f5edf785336f3f8f8d3f76ff89ce008d26994e2a73c200258e132332c0eb1579a0809

            • /data/data/com.renying.matchu/files/.jglogs/.jg.ri

              Filesize

              314B

              MD5

              65b8a2843feb6c32af643a27526d5025

              SHA1

              3d81bf77108e8d1481e56f9590838cf14d8a2437

              SHA256

              81c09b6577d08106ac0ddbd5c148a0e42e1929872c85190eedc8d8bc2a123e68

              SHA512

              48721318cece2d267d4967d9079772407bb69cf5ccf6a8baa43b1a5f6d4376257d33fd050b9704198c796c16754a6239a6dacf3aef2346cfe18c9724bdc87192

            • /data/data/com.renying.matchu/files/.jiagu.lock

              Filesize

              27B

              MD5

              4f04a185da015f4c307bbb3f6c2f14fb

              SHA1

              c2a12656ff9ccccddeb5fbd6048e67c24bfcdce0

              SHA256

              9e3ed0a9f5e5c93f87ccd7e073d3c9c5a44edd7808411e5edfcd4a2a61cf157a

              SHA512

              d91632133522ffc458e0a2129712bbc2849399550f9900347c5365d1f89c936a65d801fb75590a619d42827f8507e94d3a8b99f1d0296733d2428fd1d9f81999

            • /data/data/com.renying.matchu/files/appPackageNames_v2

              Filesize

              3KB

              MD5

              3d2f7e9f6a67a35e0ab8b055462d6958

              SHA1

              f77abcfb57e3b44b6ae4408f0e885fa0400f56db

              SHA256

              3bff203674cdfc43023094b05f48240132ad4a3b4356970d288ae9d18751d64b

              SHA512

              e635566dc585e247e3ce01706ae52e639b0900f6d697f95fe1c6cacac5b5ee682d80f03b4d49a85c52744533440db4a38665f536ac7d7a05a1fad09bed780273

            • /data/data/com.renying.matchu/files/jpush_stat_history_pushcore/normal/nowrap/d438425c-cf51-4f13-a7ef-0a5bb3e09ff3

              Filesize

              28KB

              MD5

              647260cad354c19b8315ddfdb906d2ea

              SHA1

              afbc77977b4be04f38e13dd795bddb89811a0389

              SHA256

              c8c9eaca8471c3f9e535006411f4f5b78afaec4ae8e1264890b4680508d4e573

              SHA512

              de18b8b1e5a15f67851015483ca6fc7ae4d245f47e8d53226251a8827903bf8663e220b6c8d70de683d7cf050579fc678a6b08df5690cc7e951f20a7d77ea7e7

            • /data/data/com.renying.matchu/files/jpush_stat_history_pushcore/normal/nowrap/d438425c-cf51-4f13-a7ef-0a5bb3e09ff3

              Filesize

              314B

              MD5

              67f307a1f606f88fd0dd2cdb6089b1bc

              SHA1

              78c77dfbbec14a1a7663772ef1a674ed3bee14c4

              SHA256

              b7f5daf700480960167c48b644717d897734ba7bda71f89dab7d104ce4202b08

              SHA512

              7619753eeebe49a262b1e72ce33975e7553ad31e197b51691d841df39f638d92b228ee05e64dca92a4dd43a87e6c1092648e96b3f776fe03f669e994d8a729c3

            • /data/data/com.renying.matchu/files/jpush_stat_history_pushcore/normal/tmp/0bd279f8-c010-4406-b3fa-5528969b1471

              Filesize

              28KB

              MD5

              d0c358699d3aac67730559f2cd7a5f2d

              SHA1

              06c204334fb0d6f13f65271087f9c917ce15caf3

              SHA256

              e662c3e6995dcb9ec5649ee3f59fc8c63b737adfc7a4774641b6af90967d20b5

              SHA512

              231fd0b3be7c63292f684437973331846e27f30c1ef5784072ee36f5becbf58aa39cb390f02c3eac5dc450c7cc4f63f4950f7eb1c75e0a401ee181b36b84d6b2

            • /data/data/com.renying.matchu/files/jpush_stat_history_pushcore/normal/tmp/3ff8c602-1e9a-40e0-b7b5-ff39375c5d66

              Filesize

              12KB

              MD5

              2e2db6f36053ca7ae33da6104fbb2e2b

              SHA1

              4248aa9b54f2191b89b79bafc1e154810cae8588

              SHA256

              7e36d98e09156a61c5792b7cc5070e9dcd30de246aacb5c34ff1f145ba3dd894

              SHA512

              b155879bc739bdfa7d7b8cd5c64a33171fc5561be12c7e84843412ca3558b84ba98e9fb5c6c252879fc56288cc890e9c80cde8f9c067c0be672fd65c2368bd60

            • /data/data/com.renying.matchu/files/jpush_stat_history_pushcore/normal/tmp/51a4bd01-b92a-44e8-bbb3-1466a7688cd4

              Filesize

              759B

              MD5

              dfe5370a3c7a66c1a48e5e9b6cf6f995

              SHA1

              dae1a8c44a1b4f280da0e301292b1be5c283107f

              SHA256

              8479222a71e232d954e6c1ec6cacfe21a162f88d19e775b172d2204e0e19dccc

              SHA512

              0cb704747dedf412d7430b499f43138dabd29d57718288efc5ee44fb1aec79a18780bcbac60869dcac2884f3b8bd65172fbf9e1d125e601a799080a99e7b6de2

            • /data/data/com.renying.matchu/files/jpush_stat_history_pushcore/normal/tmp/84bd3c66-ebe1-4915-addd-4ae16ee63f6a

              Filesize

              571B

              MD5

              6152d07b1888a712d0a7d1763bf6aa82

              SHA1

              f0b82b64bab2669ca17b185870724ac253d5c8bf

              SHA256

              9c1c596db35b73e2dce8a4a7d04c7a1834e9fb79e475d4b80e5213f7bf920f07

              SHA512

              c47aeb698161caf5bc55d6a4ceb758882854a9c6d16f9eeaff6c6d9f9fecc40f039802d880a3640760c88c7c2b46ac33c0d1d30082f615956b1bbbc511db3f17

            • /data/data/com.renying.matchu/files/jpush_stat_history_pushcore/normal/tmp/89a54676-43a1-4bcc-b257-e9a03d785bd9

              Filesize

              358B

              MD5

              07310f80e58fa7be46895e1111484b8c

              SHA1

              b1d3b6aad220c511f9ae552c447f298f7482b2f4

              SHA256

              e39079d5108e90792c5763849255bd18b59f2fc4a5a17ce7499cac88fc6b0713

              SHA512

              e5c02eac80df0ba6d3cee04d86028fcd5ad1188bb5949696ce47a3f2eaead41de61836e4bd48f2a5114419ce8caeb70247846bde6647392b1702ca430964863d

            • /storage/emulated/0/360/.deviceId

              Filesize

              48B

              MD5

              1d8d16c4e3b19ebf18988530d9b9a757

              SHA1

              bc94c1cce05cd848a53271ecb9c5311e27ffebf5

              SHA256

              abd87140da8de3d0aa39a24a8d52bfe7b2eb28f7a3d505f205471c7e8f4964d7

              SHA512

              4562d1eedbc5c2dd7f25cd1c70343053fd451026403585182b142a64f17016c1bd0bf6ad51667b439b220e425640e55fbbda08517e7106376cdc220a4555da82

            • /storage/emulated/0/360/.iddata

              Filesize

              32B

              MD5

              388380a6f3408b06d393ccc8e423cfad

              SHA1

              e24e13e7a649f2e1fc0a4ca2c24f4a545ca574c1

              SHA256

              00ea82fe945f4a5445592cd578191ee1d4aeb9fe27f5582494a1150cfd81f5f5

              SHA512

              06b9cdcd34e8852be2bde2886475078950cacd0f69b5aa5cae1d1863d497e649dd8da23aa20ecc345146e55069b35e48f7ca24575d9461ad2ff073b0e552a6a3