Overview
overview
8Static
static
84761395d6a...3c.apk
android-9-x86
84761395d6a...3c.apk
android-10-x64
1amap_resou..._0.apk
android-9-x86
amap_resou..._0.apk
android-10-x64
amap_resou..._0.apk
android-11-x64
autonavi_R..._0.apk
android-9-x86
autonavi_R..._0.apk
android-10-x64
autonavi_R..._0.apk
android-11-x64
Analysis
-
max time kernel
2727237s -
max time network
156s -
platform
android_x86 -
resource
android-x86-arm-20231215-en -
resource tags
androidarch:armarch:x86image:android-x86-arm-20231215-enlocale:en-usos:android-9-x86system -
submitted
23-12-2023 16:15
Behavioral task
behavioral1
Sample
4761395d6a09d687f914773363e1b38a573449876308e36d404f8ed4b215393c.apk
Resource
android-x86-arm-20231215-en
Behavioral task
behavioral2
Sample
4761395d6a09d687f914773363e1b38a573449876308e36d404f8ed4b215393c.apk
Resource
android-x64-20231215-en
Behavioral task
behavioral3
Sample
amap_resource1_0_0.apk
Resource
android-x86-arm-20231215-en
Behavioral task
behavioral4
Sample
amap_resource1_0_0.apk
Resource
android-x64-20231215-en
Behavioral task
behavioral5
Sample
amap_resource1_0_0.apk
Resource
android-x64-arm64-20231215-en
Behavioral task
behavioral6
Sample
autonavi_Resource1_1_0.apk
Resource
android-x86-arm-20231215-en
Behavioral task
behavioral7
Sample
autonavi_Resource1_1_0.apk
Resource
android-x64-20231215-en
Behavioral task
behavioral8
Sample
autonavi_Resource1_1_0.apk
Resource
android-x64-arm64-20231215-en
General
-
Target
4761395d6a09d687f914773363e1b38a573449876308e36d404f8ed4b215393c.apk
-
Size
28.3MB
-
MD5
68f8bd0ef2abf9165a03f434808b91d3
-
SHA1
51d2c69f7865143b737b1c5a87b8290c11200c7a
-
SHA256
4761395d6a09d687f914773363e1b38a573449876308e36d404f8ed4b215393c
-
SHA512
94a5ea72f8531404aa380c18972ce9cdf07eaab476845179304db5e2c34b55a601bbbc5cf59c8d00207cccfa7cb7a01d8cc19d59c888f39d50cd73105c21791a
-
SSDEEP
393216:k7wr2Vi2u0oyKyhWK6LJi2pqXm2gj5ff0IBeL2+gQHdfRM5YMDsKg0egTYAb31pq:gV5u0oyojcGqX+j3dpQdGYAjphMiPWNv
Malware Config
Signatures
-
Requests cell location 2 IoCs
Uses Android APIs to to get current cell location.
description ioc Process Framework service call com.android.internal.telephony.ITelephony.getCellLocation com.zhonghuan.quruo:pushcore Framework service call com.android.internal.telephony.ITelephony.getAllCellInfo com.zhonghuan.quruo:pushcore -
Loads dropped Dex/Jar 9 IoCs
Runs executable file dropped to the device during analysis.
ioc pid Process /data/data/com.zhonghuan.quruo/.jiagu/classes.dex 4244 com.zhonghuan.quruo /data/data/com.zhonghuan.quruo/.jiagu/classes.dex!classes2.dex 4244 com.zhonghuan.quruo /data/data/com.zhonghuan.quruo/.jiagu/tmp.dex 4244 com.zhonghuan.quruo /data/data/com.zhonghuan.quruo/.jiagu/tmp.dex 4275 /system/bin/dex2oat --debuggable --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --debuggable --generate-mini-debug-info --dex-file=/data/data/com.zhonghuan.quruo/.jiagu/tmp.dex --output-vdex-fd=43 --oat-fd=44 --oat-location=/data/data/com.zhonghuan.quruo/.jiagu/oat/x86/tmp.odex --compiler-filter=quicken --class-loader-context=& /data/data/com.zhonghuan.quruo/.jiagu/tmp.dex 4244 com.zhonghuan.quruo /data/data/com.zhonghuan.quruo/.jiagu/classes.dex 4326 com.zhonghuan.quruo:pushcore /data/data/com.zhonghuan.quruo/.jiagu/classes.dex!classes2.dex 4326 com.zhonghuan.quruo:pushcore /data/data/com.zhonghuan.quruo/.jiagu/tmp.dex 4326 com.zhonghuan.quruo:pushcore /data/data/com.zhonghuan.quruo/.jiagu/tmp.dex 4326 com.zhonghuan.quruo:pushcore -
Reads information about phone network operator.
-
Uses Crypto APIs (Might try to encrypt user data) 1 IoCs
description ioc Process Framework API call javax.crypto.Cipher.doFinal com.zhonghuan.quruo:pushcore
Processes
-
com.zhonghuan.quruo1⤵
- Loads dropped Dex/Jar
PID:4244 -
/system/bin/dex2oat --debuggable --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --debuggable --generate-mini-debug-info --dex-file=/data/data/com.zhonghuan.quruo/.jiagu/tmp.dex --output-vdex-fd=43 --oat-fd=44 --oat-location=/data/data/com.zhonghuan.quruo/.jiagu/oat/x86/tmp.odex --compiler-filter=quicken --class-loader-context=&2⤵
- Loads dropped Dex/Jar
PID:4275
-
-
sh -c ps -ef2⤵PID:4449
-
-
ps -ef2⤵PID:4449
-
-
com.zhonghuan.quruo:pushcore1⤵
- Requests cell location
- Loads dropped Dex/Jar
- Uses Crypto APIs (Might try to encrypt user data)
PID:4326
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
7.1MB
MD514fd5b1e189677646fdf57389e282702
SHA15633830d1d06acc623c242271bf832dac2a6f2b6
SHA256c09ea156baa1e440f2f69ff984207e8e5c245c29172c6e380a30d180b3ee81ae
SHA51246c9c36698e81f1d187597e41564426830ce479bb2890a5dfe979b069a7d6b67983a55d72fd0b7e7d005ec1a6607474bdcb7e07e775b9d78f94e1111494801d3
-
Filesize
6.9MB
MD50ae03355398d1c298027f6be40a72017
SHA18849c46abff9496a1088a28dfd28e2ae48f146c1
SHA2562209594e7f36e1e49a3652ee493e9ec73574165fec5c878bc4ef8cf1b33bc915
SHA51297e8a2aaefccb3eef53be1bcffa587e6f303c306753e2d77fc3365e7e24514eedeff05aa8e5284611b117a9e2110635650293c230aee0cdbd4f80a1f3c7aab02
-
Filesize
562KB
MD5d141f6661f27d70822c7021d752d8af6
SHA1e545f7442dca4490cb67b745f6f13ed782b1971c
SHA256e0313c66404c4fb7d023824265ae5a922079d422509d4b59c6fe45632c60146a
SHA5120b2a4c540c077ed93561f249baa75a65344e75dbfaefdb3a68c0d653d79bb5152fcd42c13f34a87b09583f33f1a40231b4f31416b73c323859885374ca0667f6
-
Filesize
284B
MD5f1771b68f5f9b168b79ff59ae2daabe4
SHA10df6a835559f5c99670214a12700e7d8c28e5a42
SHA2569f8898ce35a47aeafced99ea0d17c33e73037bb2307c7688e50819966f4ae939
SHA512dae27d19727b89bec49398503baa6801640540355688dfabbe689c97545295c2c2d9b0f0dcd7cbc4cfbf701d0c0c3289e647a152f49ff242d1ecc741efe4145d
-
Filesize
512B
MD5bf947aabf3f64f489771df2947105663
SHA1ffa7db019453cc727fa311a27e191555414873e0
SHA256dade39f683800b4310a3b4f27a1c3c81e09947cea586763654974aa5eb39894f
SHA512aa263670e119a4cd5e0448105d5b9187a885236c0376ce2bc21b0e580d8d132414fe5a3ec6262c264fa25856d9d0e60b8a17006af5ba05742e22db94fa138d4e
-
Filesize
32KB
MD5c9091bb8698b0418b959fadf29468e28
SHA19b9d8631e803f942132792673124dfa3c7262b7c
SHA25677d2ec007f3073a22d0bce3e0ad8dd5c80e9a1ed7b923aaf40943ef1e2d7dbf2
SHA512fd529301c6f8739deb703d995628621244ff15e700a24cf2e68ad6e0ddc5457a5d89ad1fbb669d4e5902c5a708f99bfd567e853cd76a64429fe9021d3c9c2fba
-
Filesize
20KB
MD51dcc3a76157b7eb66c104b82e70f824d
SHA143724f461415f7266770c6b20b018f37b2a852a6
SHA25662b87af84536b074d977b72aad3f254b8132dc465bb193dc09f91df7649be288
SHA5128fdfdf9f3b034b15100d61548c2cdbd5b95808f11d2b89bbe93531ba7ffc9478a1fd7f2f8b677634c609d5add067178190da9f52495a2e95d602fdfee7280a92
-
Filesize
16KB
MD5829d6cc8f10eb02b626f2b5990ade69c
SHA1156c79b33f494e7cf8e4a1c61fee7c751918a15c
SHA2568ba154719fc85de040fb293c26adddc2fdfbc898a96908736dadd43165bc2cba
SHA5129f1ac611d13fa02df1bd6d41b3a8d67e443436060720274373525d7d54ee35458bcf51d289f69218a985b9d4b0c85acf72200719c7cd3d808be87bc704c2a13e
-
Filesize
4KB
MD5f2b4b0190b9f384ca885f0c8c9b14700
SHA1934ff2646757b5b6e7f20f6a0aa76c7f995d9361
SHA2560a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514
SHA512ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1
-
Filesize
512B
MD5856a11922993fe53469a974f1d41c0fe
SHA137402ba623694d768d2d034985f54ff7f7cc3ab9
SHA25699b70efa372dbc6cf0679c5f88f90ed0357e4f038d3bdef6dd86e0c47c497a53
SHA512989934e6702735dac9e8d95f361e9171681614c19f19e4495a53eed4b6b230bedee21409c9f630a1ea988ab41a7a32ef78f3fd640d37941c20bc8f3ddf776588
-
Filesize
8KB
MD5060b797b8bf444c752054417fe73c416
SHA1ceaf6ef54cbec7dfb47c641ae1de864534fa8c96
SHA2565cd62193b701eb5d0e23c7ffaac4c8beb67bdc843557b9895125952fcf446dc7
SHA5125c39490743b5ef2831b7be01533fa017488d3d4e0837853483932c13cac494f987741d86bb95300539382baefa262aedcb717cb81d7605ee652b1f882706ae85
-
Filesize
4KB
MD51fece5d490a429216552b204fcc44d3c
SHA1041dd717dd742555a4f6188b17335076323e9be8
SHA256da9e3b83f18144add03967e1fd68370df461040705abb0e8679135f812a0e76d
SHA512546077e8ce278d0564a29355d0475619ed179b57bff88f37ff5fe079e0d0cd466580408159f61f8ada3195bc171da5dfd6a77194e784a020fdb9b155af7a88ef
-
Filesize
32KB
MD55eeca91f4399be2104f4697da1625feb
SHA1162c1521316a0421b0df1f5bba4746c6e10c80bb
SHA256c082c8e0adc45dc9e58acc550c6b3c748f805ee60544a9dea06e99323984507c
SHA512a10df2e4af25c3ec99156d5b1e484ecb244a6f1099bf4f21df92be9f5aaeceed736c79ba785ee002a6301bd17208d9c2838abed3a6d1d2a92ce80af7cc8aa2fc
-
Filesize
24KB
MD5256c69e5fa794d6be12ecd687cb3f7dc
SHA15cacdce4c2e9add3bc3f413f89f9d475624c22a8
SHA2561afd47a7cd4750bc0832e8c525d2068b4d531a2c045047e5d485ec0152e2a419
SHA51265e7e6d7dd8df2b3268125e3d3b0e75b6cfccc1dba7fe716f4847eb2e2166f237cdf5298fb647f79a0ffad63d09496ce87c63ba92be2b78d4da9d5c552c38600
-
Filesize
20KB
MD5c419189610dc90199060814098d26850
SHA19c03f6901191489bfd1373f66951e06b06f3be1b
SHA25669dc249114d19a748cc61df118e7e01daad52b5f43785ca78aef67b5a3c42a6e
SHA5129d10b09df28be72e573c5ced89d76bd7a4e72a662288422f7aab6ca2287e7d9dd3faae7de5c30ca4b6dddf847cd3755f6fa6dbbaedbcd478fd11ce93209f7e28
-
Filesize
512B
MD54729e7a0ef656292c7ae05d7c41b4290
SHA11017d5875f966df4316114f6388530ccfe460e9b
SHA256efae67f01194d1636ee3da87f5adf26a5519df56505f1a50578fb37c032b5b36
SHA512f37dc11d9128135246ea62a6bd172c922b791e884eed36c40f32108de1cb0b0f7740a9001b144665a6ff396e2e894638ac14faa928edba7f643b0402767e5e7a
-
Filesize
28KB
MD5cf845a781c107ec1346e849c9dd1b7e8
SHA1b44ccc7f7d519352422e59ee8b0bdbac881768a7
SHA25618619b678a5c207a971a0aa931604f48162e307c57ecdec450d5f095fe9f32c7
SHA5124802861ea06dc7fb85229a3c8f04e707a084f1ba516510c6f269821b33c8ee4ebf495258fe5bee4850668a5aac1a45f0edf51580da13b7ee160a29d067c67612
-
Filesize
36KB
MD5feb0b34fd75567601280adf7e863d39c
SHA19fad4b1ddc85213d02500e3187158bb244376d74
SHA25693ea62887b85e8ceae02f36b956d41398a0c4fcf28525154774d0f3392b87e23
SHA512e8f9cee7a9775aff2352965dfef9dd5c1a13b5b5d2b563363324af2e9d525f748006aa494cec9863ba147738437fb97e93c4c2046802d34ee4ee117e35f6cce1
-
Filesize
8KB
MD55fdea04c1cfba13429b7a96392591e93
SHA15dc70c114231ca58ce04fe2766460c5bc9fbfc0f
SHA2566978f03923a5c7e677174929f4f7b77b0be99248de86eba701c3c3d3b63d4909
SHA512db28cc86e024df075f3c5123accee500e4a72c3c708bf7cf2c8c50123c010840b0744182c69810f453399ecbd696b1d55a6984e730075a107eb015f44099b849
-
Filesize
32B
MD5d179d8bff6e4693b5cb9aacdbe053118
SHA180bf00f351fd3899ed4cb736062a31a61fe87f86
SHA256f8f900854442905bc7176c2105dcc3cb140eaa4517cbde86ca9b5dab8b7e795c
SHA5129c331284a2e92ba8a5a1b01d0c66b9a785e281c49a84774ef8ce647cc4804638a9cef3b6935f9417fc9ebbe133c8afa2b995809e8043da6acda22e5946a37c25
-
Filesize
32B
MD55c3790064806f211e9f3be03363d09cf
SHA173ed83a086df3533d4723d9072557edbf28ca006
SHA25617323acec75af9b8c10c2b5a972c2dbe5e73bba85688835713245c2f2fb822b1
SHA5123ca6273ca57f7430552a07145af16501a722c82f1d08fe868b24c5efe979d805ca0aab542ce448c26968c1c2c518cd2c1d62165848d0b03786c4e300b224931e
-
Filesize
32B
MD5fae6a66153d48c570d8698f2b13fe5b7
SHA11eb90693d15a3a7ba1c54df539ae5587667286f9
SHA25690c64cafe40bb31497407f4c4326abac48542ec4bedae1125b6f53d96b54ec46
SHA51280b8de0e450b816bfd2db16dd72f216fdb03bcda9c31901543457e4b970f99fe7d3d98bb35eab748df4e4c3f6ea614be0000aaf96d6177464ad5a4f6b3651e43
-
Filesize
32B
MD5ebf40619f7f7d32ed0870337bb1551cd
SHA19902360a4879e919acf61868680800c49768a511
SHA2567161063152e352ea078fe2b48109427e0ce9bf97013214d7343700fa62a80cda
SHA512cb50ad76dea50bbe7a66a1463b7679583bad3ce469fef094cefbdb381c8d2eb3914f2dcea82db361ec0c0a9d3f2c54d067d613f063254de79f4a904655cf87da
-
Filesize
314B
MD50925daa9e1426f69df3f76048e51d83a
SHA1d30d495a92b5f88c0656f7e9e789aadca46b712b
SHA2561e938fcf1341785ede85f025ce9db8e59b264f0bb8f5add4f33f356e6c188307
SHA5127264df7354060248bc41cc011058161354240df6b0b79142d9c1149bedba6611d78149cdac206d4ad69a8c3dbe9f7b27380d8cb8703e551492b9248d931e6ffd
-
Filesize
307B
MD55f061a93113349e1eba9313959839743
SHA1d2a80d1fa462e4bae09abc24bd456c4df188b723
SHA256cae7ee42ae341eb1c79c1c40cbc6e3414104c820e5dbc9a46085efce26f63c16
SHA5121b0849779e20ba507a3ff8f665daa12bbb1fabf1ca8dada39413b94ef40e0b766f338853f2bdeed35654c14f42b00fa254dbaae37c0dd5a25bd149fde57b85a9
-
Filesize
307B
MD594e05dfec277ce88bb8c7b1bd97e6c4b
SHA169f2e7bcc45f777522aa2e801b3dd7e25bea35b7
SHA25667106c012a17c7bd05c3bb5259c8fbcd73a622e64409515246e81e950a76d27d
SHA512ee281817979ad99ed57275f64fe85d36d5450d7883e8268d928ee078e6c524c59353c912da985fecb224b5a43088b4dec7dcd7f15e0e4707e86d8848f5d9c3b9
-
Filesize
32B
MD53ca7ab94ae989b6124dca0d74ab4d56c
SHA13ac30142aab845cbac5017a36a0760c60659de32
SHA25643b625d0e4bc42fb120bf2a98d429b7f65d81f66042c66271a354b8c0a059338
SHA512425ee234927e4a2ab667bc0b9d1e57ce1ce6ed88960b6b368966cf6cb66e0db08cdbedac5b0ddbc62e5f50bdc0e2c13c08d556f6ec6cb3d51716d320a388a243
-
Filesize
32B
MD5efb7b52b4867e0fecb08f2330d00fb49
SHA18f8d4df9e3ffc016fe748a56226c5c156e9518b5
SHA256573bbd2b44b208e65c99c37b429241af19f360563cb46c9459febfd45e7fc47b
SHA512e4c02188980c4c02110db98e9a34100ab4862fcdd54dd10aa4ae724e993fb8d687ae1ee2097618a57398e0158e3d058ca3b98bc77655a91150cfd91c6dcf089c
-
Filesize
27B
MD535a82ff644b67aa8913214a87ec032a5
SHA1b7d8c31d4fe3422edeebb74db3d394f4b21d2437
SHA256e6d275aeae2af67628e090febc6a27ddc20576c27a083562c9dd5b8999a75500
SHA51233015a2e5ebb7208b34327b99c8a965e73dcde2a8bd966c256779744f7ba4bb6165cae8269a9e995c77625fddc7ca3c794000b9ff8d63b47cc0536f8ae91435e
-
Filesize
3KB
MD55c43a4c1d5f80399ac5e72421f2a9c01
SHA1128343988611f15f66bfdf0dca8cbb6ca69e1bf0
SHA256b260e54f506613d173bf3fc093bb73a742143aa0b8c9e32565177737ade97e7d
SHA5125d966e9c1571fd79686bfc40a96efb5ae0e9d55fec1b3a76a55491bc7d4790c692df537600a8a0db4db08522508ad26c520eabd9052b98aceb9701cbf3ee5f93
-
Filesize
174B
MD521a8a5e14dab7b41e235e5301efcd585
SHA1353590b44693ea9e64bd7c5b8b7c17c77159ac72
SHA256e6bfeff7901eb44bdcdb5d65dcd8d655bf409999fdf2c00fd9132313df20455d
SHA512dc9426ee360cdfd9168c398c3441acfbdf5e0573044561dcb6187a6c8b14b3895d1025ce85b89379801cb92a7a2257556e410a89f2b72cd29667fe6ed5969d51
-
Filesize
160B
MD5fdbf13f4d9156561b4344cceba4418fd
SHA1a4b6ea00cad00b2c3546c9c7ff0b3ac87f2d88b8
SHA256b83986013dd3fe44bae47a9e231f4e15dd5053e25f0c59ef1831270e7cb96e73
SHA512d1fd45e6305e732656c634421913610af34da65471398b4be8daa11f6d410fdd3ae0988cb4805510af244ad767397f004c098f7a0a0f92b65cefc6df1c9ddcc1
-
Filesize
349B
MD5f2d24ebec361481a3a187e3e796ebeed
SHA1286f10d87cec70ae3f3c5f957de15f2b114edabc
SHA25693feac7c4fca6815e0dceb26390b60aafda863289e6dc96e12d9d515168b9e7e
SHA512f7da0df7d03340f3a60317b125fdad3107c190ee1f772b106b9482fe1b4b7be93032c1fb33005f4d1ad252641949d22f7ab644ce7ec2ff44638b5e433e7b91e0
-
Filesize
32B
MD5cbe4af5a18aee6987862cb82ecf83d5e
SHA19f8ef1531cbdd071dea2d8c14de8cb539687bf9d
SHA256bbe9f0479bea9c43d1f4d2abd59ddacc7f8ff2fd7974bb8b5e6ea48c163c9a85
SHA512cb03baac9f01e3fc651447a936f372dbb48f3c48efccc0f6e50396481927f19238788fb8d981f069d8ee608e15a6362c872c254dbeb855182186c2a9313be27c