Analysis

  • max time kernel
    2727237s
  • max time network
    156s
  • platform
    android_x86
  • resource
    android-x86-arm-20231215-en
  • resource tags

    androidarch:armarch:x86image:android-x86-arm-20231215-enlocale:en-usos:android-9-x86system
  • submitted
    23-12-2023 16:15

General

  • Target

    4761395d6a09d687f914773363e1b38a573449876308e36d404f8ed4b215393c.apk

  • Size

    28.3MB

  • MD5

    68f8bd0ef2abf9165a03f434808b91d3

  • SHA1

    51d2c69f7865143b737b1c5a87b8290c11200c7a

  • SHA256

    4761395d6a09d687f914773363e1b38a573449876308e36d404f8ed4b215393c

  • SHA512

    94a5ea72f8531404aa380c18972ce9cdf07eaab476845179304db5e2c34b55a601bbbc5cf59c8d00207cccfa7cb7a01d8cc19d59c888f39d50cd73105c21791a

  • SSDEEP

    393216:k7wr2Vi2u0oyKyhWK6LJi2pqXm2gj5ff0IBeL2+gQHdfRM5YMDsKg0egTYAb31pq:gV5u0oyojcGqX+j3dpQdGYAjphMiPWNv

Score
8/10

Malware Config

Signatures

  • Requests cell location 2 IoCs

    Uses Android APIs to to get current cell location.

  • Loads dropped Dex/Jar 9 IoCs

    Runs executable file dropped to the device during analysis.

  • Reads information about phone network operator.
  • Uses Crypto APIs (Might try to encrypt user data) 1 IoCs

Processes

  • com.zhonghuan.quruo
    1⤵
    • Loads dropped Dex/Jar
    PID:4244
    • /system/bin/dex2oat --debuggable --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --debuggable --generate-mini-debug-info --dex-file=/data/data/com.zhonghuan.quruo/.jiagu/tmp.dex --output-vdex-fd=43 --oat-fd=44 --oat-location=/data/data/com.zhonghuan.quruo/.jiagu/oat/x86/tmp.odex --compiler-filter=quicken --class-loader-context=&
      2⤵
      • Loads dropped Dex/Jar
      PID:4275
    • sh -c ps -ef
      2⤵
        PID:4449
      • ps -ef
        2⤵
          PID:4449
      • com.zhonghuan.quruo:pushcore
        1⤵
        • Requests cell location
        • Loads dropped Dex/Jar
        • Uses Crypto APIs (Might try to encrypt user data)
        PID:4326

      Network

      MITRE ATT&CK Matrix

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • /data/data/com.zhonghuan.quruo/.jiagu/classes.dex

        Filesize

        7.1MB

        MD5

        14fd5b1e189677646fdf57389e282702

        SHA1

        5633830d1d06acc623c242271bf832dac2a6f2b6

        SHA256

        c09ea156baa1e440f2f69ff984207e8e5c245c29172c6e380a30d180b3ee81ae

        SHA512

        46c9c36698e81f1d187597e41564426830ce479bb2890a5dfe979b069a7d6b67983a55d72fd0b7e7d005ec1a6607474bdcb7e07e775b9d78f94e1111494801d3

      • /data/data/com.zhonghuan.quruo/.jiagu/classes.dex!classes2.dex

        Filesize

        6.9MB

        MD5

        0ae03355398d1c298027f6be40a72017

        SHA1

        8849c46abff9496a1088a28dfd28e2ae48f146c1

        SHA256

        2209594e7f36e1e49a3652ee493e9ec73574165fec5c878bc4ef8cf1b33bc915

        SHA512

        97e8a2aaefccb3eef53be1bcffa587e6f303c306753e2d77fc3365e7e24514eedeff05aa8e5284611b117a9e2110635650293c230aee0cdbd4f80a1f3c7aab02

      • /data/data/com.zhonghuan.quruo/.jiagu/libjiagu.so

        Filesize

        562KB

        MD5

        d141f6661f27d70822c7021d752d8af6

        SHA1

        e545f7442dca4490cb67b745f6f13ed782b1971c

        SHA256

        e0313c66404c4fb7d023824265ae5a922079d422509d4b59c6fe45632c60146a

        SHA512

        0b2a4c540c077ed93561f249baa75a65344e75dbfaefdb3a68c0d653d79bb5152fcd42c13f34a87b09583f33f1a40231b4f31416b73c323859885374ca0667f6

      • /data/data/com.zhonghuan.quruo/.jiagu/tmp.dex

        Filesize

        284B

        MD5

        f1771b68f5f9b168b79ff59ae2daabe4

        SHA1

        0df6a835559f5c99670214a12700e7d8c28e5a42

        SHA256

        9f8898ce35a47aeafced99ea0d17c33e73037bb2307c7688e50819966f4ae939

        SHA512

        dae27d19727b89bec49398503baa6801640540355688dfabbe689c97545295c2c2d9b0f0dcd7cbc4cfbf701d0c0c3289e647a152f49ff242d1ecc741efe4145d

      • /data/data/com.zhonghuan.quruo/databases/jpush_local_notification.db-journal

        Filesize

        512B

        MD5

        bf947aabf3f64f489771df2947105663

        SHA1

        ffa7db019453cc727fa311a27e191555414873e0

        SHA256

        dade39f683800b4310a3b4f27a1c3c81e09947cea586763654974aa5eb39894f

        SHA512

        aa263670e119a4cd5e0448105d5b9187a885236c0376ce2bc21b0e580d8d132414fe5a3ec6262c264fa25856d9d0e60b8a17006af5ba05742e22db94fa138d4e

      • /data/data/com.zhonghuan.quruo/databases/jpush_local_notification.db-wal

        Filesize

        32KB

        MD5

        c9091bb8698b0418b959fadf29468e28

        SHA1

        9b9d8631e803f942132792673124dfa3c7262b7c

        SHA256

        77d2ec007f3073a22d0bce3e0ad8dd5c80e9a1ed7b923aaf40943ef1e2d7dbf2

        SHA512

        fd529301c6f8739deb703d995628621244ff15e700a24cf2e68ad6e0ddc5457a5d89ad1fbb669d4e5902c5a708f99bfd567e853cd76a64429fe9021d3c9c2fba

      • /data/data/com.zhonghuan.quruo/databases/jpush_statistics.db

        Filesize

        20KB

        MD5

        1dcc3a76157b7eb66c104b82e70f824d

        SHA1

        43724f461415f7266770c6b20b018f37b2a852a6

        SHA256

        62b87af84536b074d977b72aad3f254b8132dc465bb193dc09f91df7649be288

        SHA512

        8fdfdf9f3b034b15100d61548c2cdbd5b95808f11d2b89bbe93531ba7ffc9478a1fd7f2f8b677634c609d5add067178190da9f52495a2e95d602fdfee7280a92

      • /data/data/com.zhonghuan.quruo/databases/jpush_statistics.db

        Filesize

        16KB

        MD5

        829d6cc8f10eb02b626f2b5990ade69c

        SHA1

        156c79b33f494e7cf8e4a1c61fee7c751918a15c

        SHA256

        8ba154719fc85de040fb293c26adddc2fdfbc898a96908736dadd43165bc2cba

        SHA512

        9f1ac611d13fa02df1bd6d41b3a8d67e443436060720274373525d7d54ee35458bcf51d289f69218a985b9d4b0c85acf72200719c7cd3d808be87bc704c2a13e

      • /data/data/com.zhonghuan.quruo/databases/jpush_statistics.db

        Filesize

        4KB

        MD5

        f2b4b0190b9f384ca885f0c8c9b14700

        SHA1

        934ff2646757b5b6e7f20f6a0aa76c7f995d9361

        SHA256

        0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514

        SHA512

        ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1

      • /data/data/com.zhonghuan.quruo/databases/jpush_statistics.db-journal

        Filesize

        512B

        MD5

        856a11922993fe53469a974f1d41c0fe

        SHA1

        37402ba623694d768d2d034985f54ff7f7cc3ab9

        SHA256

        99b70efa372dbc6cf0679c5f88f90ed0357e4f038d3bdef6dd86e0c47c497a53

        SHA512

        989934e6702735dac9e8d95f361e9171681614c19f19e4495a53eed4b6b230bedee21409c9f630a1ea988ab41a7a32ef78f3fd640d37941c20bc8f3ddf776588

      • /data/data/com.zhonghuan.quruo/databases/jpush_statistics.db-wal

        Filesize

        8KB

        MD5

        060b797b8bf444c752054417fe73c416

        SHA1

        ceaf6ef54cbec7dfb47c641ae1de864534fa8c96

        SHA256

        5cd62193b701eb5d0e23c7ffaac4c8beb67bdc843557b9895125952fcf446dc7

        SHA512

        5c39490743b5ef2831b7be01533fa017488d3d4e0837853483932c13cac494f987741d86bb95300539382baefa262aedcb717cb81d7605ee652b1f882706ae85

      • /data/data/com.zhonghuan.quruo/databases/jpush_statistics.db-wal

        Filesize

        4KB

        MD5

        1fece5d490a429216552b204fcc44d3c

        SHA1

        041dd717dd742555a4f6188b17335076323e9be8

        SHA256

        da9e3b83f18144add03967e1fd68370df461040705abb0e8679135f812a0e76d

        SHA512

        546077e8ce278d0564a29355d0475619ed179b57bff88f37ff5fe079e0d0cd466580408159f61f8ada3195bc171da5dfd6a77194e784a020fdb9b155af7a88ef

      • /data/data/com.zhonghuan.quruo/databases/jpush_statistics.db-wal

        Filesize

        32KB

        MD5

        5eeca91f4399be2104f4697da1625feb

        SHA1

        162c1521316a0421b0df1f5bba4746c6e10c80bb

        SHA256

        c082c8e0adc45dc9e58acc550c6b3c748f805ee60544a9dea06e99323984507c

        SHA512

        a10df2e4af25c3ec99156d5b1e484ecb244a6f1099bf4f21df92be9f5aaeceed736c79ba785ee002a6301bd17208d9c2838abed3a6d1d2a92ce80af7cc8aa2fc

      • /data/data/com.zhonghuan.quruo/databases/project.db

        Filesize

        24KB

        MD5

        256c69e5fa794d6be12ecd687cb3f7dc

        SHA1

        5cacdce4c2e9add3bc3f413f89f9d475624c22a8

        SHA256

        1afd47a7cd4750bc0832e8c525d2068b4d531a2c045047e5d485ec0152e2a419

        SHA512

        65e7e6d7dd8df2b3268125e3d3b0e75b6cfccc1dba7fe716f4847eb2e2166f237cdf5298fb647f79a0ffad63d09496ce87c63ba92be2b78d4da9d5c552c38600

      • /data/data/com.zhonghuan.quruo/databases/project.db

        Filesize

        20KB

        MD5

        c419189610dc90199060814098d26850

        SHA1

        9c03f6901191489bfd1373f66951e06b06f3be1b

        SHA256

        69dc249114d19a748cc61df118e7e01daad52b5f43785ca78aef67b5a3c42a6e

        SHA512

        9d10b09df28be72e573c5ced89d76bd7a4e72a662288422f7aab6ca2287e7d9dd3faae7de5c30ca4b6dddf847cd3755f6fa6dbbaedbcd478fd11ce93209f7e28

      • /data/data/com.zhonghuan.quruo/databases/project.db-journal

        Filesize

        512B

        MD5

        4729e7a0ef656292c7ae05d7c41b4290

        SHA1

        1017d5875f966df4316114f6388530ccfe460e9b

        SHA256

        efae67f01194d1636ee3da87f5adf26a5519df56505f1a50578fb37c032b5b36

        SHA512

        f37dc11d9128135246ea62a6bd172c922b791e884eed36c40f32108de1cb0b0f7740a9001b144665a6ff396e2e894638ac14faa928edba7f643b0402767e5e7a

      • /data/data/com.zhonghuan.quruo/databases/project.db-shm

        Filesize

        28KB

        MD5

        cf845a781c107ec1346e849c9dd1b7e8

        SHA1

        b44ccc7f7d519352422e59ee8b0bdbac881768a7

        SHA256

        18619b678a5c207a971a0aa931604f48162e307c57ecdec450d5f095fe9f32c7

        SHA512

        4802861ea06dc7fb85229a3c8f04e707a084f1ba516510c6f269821b33c8ee4ebf495258fe5bee4850668a5aac1a45f0edf51580da13b7ee160a29d067c67612

      • /data/data/com.zhonghuan.quruo/databases/project.db-wal

        Filesize

        36KB

        MD5

        feb0b34fd75567601280adf7e863d39c

        SHA1

        9fad4b1ddc85213d02500e3187158bb244376d74

        SHA256

        93ea62887b85e8ceae02f36b956d41398a0c4fcf28525154774d0f3392b87e23

        SHA512

        e8f9cee7a9775aff2352965dfef9dd5c1a13b5b5d2b563363324af2e9d525f748006aa494cec9863ba147738437fb97e93c4c2046802d34ee4ee117e35f6cce1

      • /data/data/com.zhonghuan.quruo/databases/project.db-wal

        Filesize

        8KB

        MD5

        5fdea04c1cfba13429b7a96392591e93

        SHA1

        5dc70c114231ca58ce04fe2766460c5bc9fbfc0f

        SHA256

        6978f03923a5c7e677174929f4f7b77b0be99248de86eba701c3c3d3b63d4909

        SHA512

        db28cc86e024df075f3c5123accee500e4a72c3c708bf7cf2c8c50123c010840b0744182c69810f453399ecbd696b1d55a6984e730075a107eb015f44099b849

      • /data/data/com.zhonghuan.quruo/files/.jglogs/.cl

        Filesize

        32B

        MD5

        d179d8bff6e4693b5cb9aacdbe053118

        SHA1

        80bf00f351fd3899ed4cb736062a31a61fe87f86

        SHA256

        f8f900854442905bc7176c2105dcc3cb140eaa4517cbde86ca9b5dab8b7e795c

        SHA512

        9c331284a2e92ba8a5a1b01d0c66b9a785e281c49a84774ef8ce647cc4804638a9cef3b6935f9417fc9ebbe133c8afa2b995809e8043da6acda22e5946a37c25

      • /data/data/com.zhonghuan.quruo/files/.jglogs/.jg.ac

        Filesize

        32B

        MD5

        5c3790064806f211e9f3be03363d09cf

        SHA1

        73ed83a086df3533d4723d9072557edbf28ca006

        SHA256

        17323acec75af9b8c10c2b5a972c2dbe5e73bba85688835713245c2f2fb822b1

        SHA512

        3ca6273ca57f7430552a07145af16501a722c82f1d08fe868b24c5efe979d805ca0aab542ce448c26968c1c2c518cd2c1d62165848d0b03786c4e300b224931e

      • /data/data/com.zhonghuan.quruo/files/.jglogs/.jg.ic

        Filesize

        32B

        MD5

        fae6a66153d48c570d8698f2b13fe5b7

        SHA1

        1eb90693d15a3a7ba1c54df539ae5587667286f9

        SHA256

        90c64cafe40bb31497407f4c4326abac48542ec4bedae1125b6f53d96b54ec46

        SHA512

        80b8de0e450b816bfd2db16dd72f216fdb03bcda9c31901543457e4b970f99fe7d3d98bb35eab748df4e4c3f6ea614be0000aaf96d6177464ad5a4f6b3651e43

      • /data/data/com.zhonghuan.quruo/files/.jglogs/.jg.rd

        Filesize

        32B

        MD5

        ebf40619f7f7d32ed0870337bb1551cd

        SHA1

        9902360a4879e919acf61868680800c49768a511

        SHA256

        7161063152e352ea078fe2b48109427e0ce9bf97013214d7343700fa62a80cda

        SHA512

        cb50ad76dea50bbe7a66a1463b7679583bad3ce469fef094cefbdb381c8d2eb3914f2dcea82db361ec0c0a9d3f2c54d067d613f063254de79f4a904655cf87da

      • /data/data/com.zhonghuan.quruo/files/.jglogs/.jg.ri

        Filesize

        314B

        MD5

        0925daa9e1426f69df3f76048e51d83a

        SHA1

        d30d495a92b5f88c0656f7e9e789aadca46b712b

        SHA256

        1e938fcf1341785ede85f025ce9db8e59b264f0bb8f5add4f33f356e6c188307

        SHA512

        7264df7354060248bc41cc011058161354240df6b0b79142d9c1149bedba6611d78149cdac206d4ad69a8c3dbe9f7b27380d8cb8703e551492b9248d931e6ffd

      • /data/data/com.zhonghuan.quruo/files/.jglogs/.jg.ri

        Filesize

        307B

        MD5

        5f061a93113349e1eba9313959839743

        SHA1

        d2a80d1fa462e4bae09abc24bd456c4df188b723

        SHA256

        cae7ee42ae341eb1c79c1c40cbc6e3414104c820e5dbc9a46085efce26f63c16

        SHA512

        1b0849779e20ba507a3ff8f665daa12bbb1fabf1ca8dada39413b94ef40e0b766f338853f2bdeed35654c14f42b00fa254dbaae37c0dd5a25bd149fde57b85a9

      • /data/data/com.zhonghuan.quruo/files/.jglogs/.jg.ri

        Filesize

        307B

        MD5

        94e05dfec277ce88bb8c7b1bd97e6c4b

        SHA1

        69f2e7bcc45f777522aa2e801b3dd7e25bea35b7

        SHA256

        67106c012a17c7bd05c3bb5259c8fbcd73a622e64409515246e81e950a76d27d

        SHA512

        ee281817979ad99ed57275f64fe85d36d5450d7883e8268d928ee078e6c524c59353c912da985fecb224b5a43088b4dec7dcd7f15e0e4707e86d8848f5d9c3b9

      • /data/data/com.zhonghuan.quruo/files/.jglogs/.jg.store.report_cf

        Filesize

        32B

        MD5

        3ca7ab94ae989b6124dca0d74ab4d56c

        SHA1

        3ac30142aab845cbac5017a36a0760c60659de32

        SHA256

        43b625d0e4bc42fb120bf2a98d429b7f65d81f66042c66271a354b8c0a059338

        SHA512

        425ee234927e4a2ab667bc0b9d1e57ce1ce6ed88960b6b368966cf6cb66e0db08cdbedac5b0ddbc62e5f50bdc0e2c13c08d556f6ec6cb3d51716d320a388a243

      • /data/data/com.zhonghuan.quruo/files/.jglogs/.jg.store.report_pid

        Filesize

        32B

        MD5

        efb7b52b4867e0fecb08f2330d00fb49

        SHA1

        8f8d4df9e3ffc016fe748a56226c5c156e9518b5

        SHA256

        573bbd2b44b208e65c99c37b429241af19f360563cb46c9459febfd45e7fc47b

        SHA512

        e4c02188980c4c02110db98e9a34100ab4862fcdd54dd10aa4ae724e993fb8d687ae1ee2097618a57398e0158e3d058ca3b98bc77655a91150cfd91c6dcf089c

      • /data/data/com.zhonghuan.quruo/files/.jiagu.lock

        Filesize

        27B

        MD5

        35a82ff644b67aa8913214a87ec032a5

        SHA1

        b7d8c31d4fe3422edeebb74db3d394f4b21d2437

        SHA256

        e6d275aeae2af67628e090febc6a27ddc20576c27a083562c9dd5b8999a75500

        SHA512

        33015a2e5ebb7208b34327b99c8a965e73dcde2a8bd966c256779744f7ba4bb6165cae8269a9e995c77625fddc7ca3c794000b9ff8d63b47cc0536f8ae91435e

      • /data/data/com.zhonghuan.quruo/files/appPackageNames_v2

        Filesize

        3KB

        MD5

        5c43a4c1d5f80399ac5e72421f2a9c01

        SHA1

        128343988611f15f66bfdf0dca8cbb6ca69e1bf0

        SHA256

        b260e54f506613d173bf3fc093bb73a742143aa0b8c9e32565177737ade97e7d

        SHA512

        5d966e9c1571fd79686bfc40a96efb5ae0e9d55fec1b3a76a55491bc7d4790c692df537600a8a0db4db08522508ad26c520eabd9052b98aceb9701cbf3ee5f93

      • /data/data/com.zhonghuan.quruo/files/jpush_stat_cache_history.json

        Filesize

        174B

        MD5

        21a8a5e14dab7b41e235e5301efcd585

        SHA1

        353590b44693ea9e64bd7c5b8b7c17c77159ac72

        SHA256

        e6bfeff7901eb44bdcdb5d65dcd8d655bf409999fdf2c00fd9132313df20455d

        SHA512

        dc9426ee360cdfd9168c398c3441acfbdf5e0573044561dcb6187a6c8b14b3895d1025ce85b89379801cb92a7a2257556e410a89f2b72cd29667fe6ed5969d51

      • /data/data/com.zhonghuan.quruo/files/jpush_stat_cache_history.json

        Filesize

        160B

        MD5

        fdbf13f4d9156561b4344cceba4418fd

        SHA1

        a4b6ea00cad00b2c3546c9c7ff0b3ac87f2d88b8

        SHA256

        b83986013dd3fe44bae47a9e231f4e15dd5053e25f0c59ef1831270e7cb96e73

        SHA512

        d1fd45e6305e732656c634421913610af34da65471398b4be8daa11f6d410fdd3ae0988cb4805510af244ad767397f004c098f7a0a0f92b65cefc6df1c9ddcc1

      • /data/data/com.zhonghuan.quruo/files/jpush_stat_cache_history.json

        Filesize

        349B

        MD5

        f2d24ebec361481a3a187e3e796ebeed

        SHA1

        286f10d87cec70ae3f3c5f957de15f2b114edabc

        SHA256

        93feac7c4fca6815e0dceb26390b60aafda863289e6dc96e12d9d515168b9e7e

        SHA512

        f7da0df7d03340f3a60317b125fdad3107c190ee1f772b106b9482fe1b4b7be93032c1fb33005f4d1ad252641949d22f7ab644ce7ec2ff44638b5e433e7b91e0

      • /storage/emulated/0/data/.push_deviceid

        Filesize

        32B

        MD5

        cbe4af5a18aee6987862cb82ecf83d5e

        SHA1

        9f8ef1531cbdd071dea2d8c14de8cb539687bf9d

        SHA256

        bbe9f0479bea9c43d1f4d2abd59ddacc7f8ff2fd7974bb8b5e6ea48c163c9a85

        SHA512

        cb03baac9f01e3fc651447a936f372dbb48f3c48efccc0f6e50396481927f19238788fb8d981f069d8ee608e15a6362c872c254dbeb855182186c2a9313be27c