Analysis

  • max time kernel
    2554084s
  • max time network
    159s
  • platform
    android_x86
  • resource
    android-x86-arm-20231215-en
  • resource tags

    androidarch:armarch:x86image:android-x86-arm-20231215-enlocale:en-usos:android-9-x86system
  • submitted
    23-12-2023 16:30

General

  • Target

    4aa88d6e35e3d3a697f39f84d7dcd2dc79f6222510a7995a5bda6ad154297774.apk

  • Size

    15.2MB

  • MD5

    a327b5c03365c07d6a9da2575345f204

  • SHA1

    8f3ff98e24eb8fa6a4b414b874b3a16f6ca90d70

  • SHA256

    4aa88d6e35e3d3a697f39f84d7dcd2dc79f6222510a7995a5bda6ad154297774

  • SHA512

    dfead5d0e3fc7fcf589c1200ed74063dd2b453257f69710634ab9018a45ca42bdb8e23c61ac8ec72b9f107d93236369fb7397eebc3237e9be62744d79d2921d0

  • SSDEEP

    393216:eDv0tjviqmsYqlcpZPc9w0uHNwcaXdIaeeUuIhaM62:eDvkDwsyZkHut5aNye2aD2

Score
4/10

Malware Config

Signatures

  • Uses Crypto APIs (Might try to encrypt user data) 1 IoCs

Processes

  • com.qdaily.ui
    1⤵
    • Uses Crypto APIs (Might try to encrypt user data)
    PID:4274
    • /system/bin/sh -c getprop ro.board.platform
      2⤵
        PID:4313
      • getprop ro.board.platform
        2⤵
          PID:4313
        • /system/bin/sh -c type su
          2⤵
            PID:4340
          • /system/bin/sh -c getprop ro.miui.ui.version.name
            2⤵
              PID:4359
            • getprop ro.miui.ui.version.name
              2⤵
                PID:4359
              • /system/bin/sh -c getprop ro.build.version.emui
                2⤵
                  PID:4384
                • getprop ro.build.version.emui
                  2⤵
                    PID:4384
                  • /system/bin/sh -c getprop ro.lenovo.series
                    2⤵
                      PID:4411
                    • getprop ro.lenovo.series
                      2⤵
                        PID:4411
                      • /system/bin/sh -c getprop ro.build.nubia.rom.name
                        2⤵
                          PID:4436
                        • getprop ro.build.nubia.rom.name
                          2⤵
                            PID:4436
                          • /system/bin/sh -c getprop ro.meizu.product.model
                            2⤵
                              PID:4461
                            • getprop ro.meizu.product.model
                              2⤵
                                PID:4461
                              • /system/bin/sh -c getprop ro.build.version.opporom
                                2⤵
                                  PID:4490
                                • getprop ro.build.version.opporom
                                  2⤵
                                    PID:4490
                                  • /system/bin/sh -c getprop ro.vivo.os.build.display.id
                                    2⤵
                                      PID:4516
                                    • getprop ro.vivo.os.build.display.id
                                      2⤵
                                        PID:4516
                                      • /system/bin/sh -c getprop ro.aa.romver
                                        2⤵
                                          PID:4541
                                        • getprop ro.aa.romver
                                          2⤵
                                            PID:4541
                                          • /system/bin/sh -c getprop ro.lewa.version
                                            2⤵
                                              PID:4565
                                            • getprop ro.lewa.version
                                              2⤵
                                                PID:4565
                                              • /system/bin/sh -c getprop ro.gn.gnromvernumber
                                                2⤵
                                                  PID:4590
                                                • getprop ro.gn.gnromvernumber
                                                  2⤵
                                                    PID:4590
                                                  • /system/bin/sh -c getprop ro.build.tyd.kbstyle_version
                                                    2⤵
                                                      PID:4615
                                                    • getprop ro.build.tyd.kbstyle_version
                                                      2⤵
                                                        PID:4615
                                                      • /system/bin/sh -c getprop ro.build.fingerprint
                                                        2⤵
                                                          PID:4642
                                                        • getprop ro.build.fingerprint
                                                          2⤵
                                                            PID:4642
                                                          • /system/bin/sh -c getprop ro.build.rom.id
                                                            2⤵
                                                              PID:4671
                                                            • getprop ro.build.rom.id
                                                              2⤵
                                                                PID:4671
                                                              • /system/bin/sh -c getprop ro.genymotion.version
                                                                2⤵
                                                                  PID:4695
                                                                • getprop ro.genymotion.version
                                                                  2⤵
                                                                    PID:4695
                                                                  • /system/bin/sh -c getprop androVM.vbox_dpi
                                                                    2⤵
                                                                      PID:4720
                                                                    • getprop androVM.vbox_dpi
                                                                      2⤵
                                                                        PID:4720
                                                                      • /system/bin/sh -c getprop qemu.sf.fake_camera
                                                                        2⤵
                                                                          PID:4745
                                                                        • getprop qemu.sf.fake_camera
                                                                          2⤵
                                                                            PID:4745
                                                                          • /system/bin/sh -c getprop ro.secure
                                                                            2⤵
                                                                              PID:4769
                                                                            • getprop ro.secure
                                                                              2⤵
                                                                                PID:4769
                                                                              • /system/bin/sh -c getprop ro.debuggable
                                                                                2⤵
                                                                                  PID:4793
                                                                                • getprop ro.debuggable
                                                                                  2⤵
                                                                                    PID:4793
                                                                                  • /system/bin/sh -c getprop gsm.sim.state
                                                                                    2⤵
                                                                                      PID:4818
                                                                                    • getprop gsm.sim.state
                                                                                      2⤵
                                                                                        PID:4818
                                                                                      • /system/bin/sh -c getprop gsm.sim.state2
                                                                                        2⤵
                                                                                          PID:4844
                                                                                        • getprop gsm.sim.state2
                                                                                          2⤵
                                                                                            PID:4844

                                                                                        Network

                                                                                        MITRE ATT&CK Matrix

                                                                                        Replay Monitor

                                                                                        Loading Replay Monitor...

                                                                                        Downloads

                                                                                        • /data/data/com.qdaily.ui/app_crashrecord/1004

                                                                                          Filesize

                                                                                          58B

                                                                                          MD5

                                                                                          0d210bfb2a0e1f1b4c082a6a0f79de07

                                                                                          SHA1

                                                                                          bb8ed9e364db79d1d9f2fcde3f15091893222faa

                                                                                          SHA256

                                                                                          988722c23d78a46021d0e7ca9deee7aa8bb83288269174ffacb7316f381cca1d

                                                                                          SHA512

                                                                                          536e9867b0df29b15b789f8949be6ab37fcdeccb9d39ded981da7dc2052c9533d0ec0e6f9a5444132977605d372e1463d91bdde41b528ff2ca3f65ab152325c1

                                                                                        • /data/data/com.qdaily.ui/app_crashrecord/1004

                                                                                          Filesize

                                                                                          224B

                                                                                          MD5

                                                                                          8fd577b540843a6ed80be097e62b5b50

                                                                                          SHA1

                                                                                          19afc0fa8ee7cf71b289ed89acc75001fa2500ee

                                                                                          SHA256

                                                                                          00d9d4b7c1f84602b70480e7ec329dbba9d2a1f231b32564ac605ec6463f3971

                                                                                          SHA512

                                                                                          84e37a43893bf61e161761673cac4e7afa2bedb45e26f5bfe020491a050daa7f31e567a674b0309efd13d270f28e6c7028d7f4883444c6b94343cd32a9496814

                                                                                        • /data/data/com.qdaily.ui/databases/bugly_db_

                                                                                          Filesize

                                                                                          4KB

                                                                                          MD5

                                                                                          f2b4b0190b9f384ca885f0c8c9b14700

                                                                                          SHA1

                                                                                          934ff2646757b5b6e7f20f6a0aa76c7f995d9361

                                                                                          SHA256

                                                                                          0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514

                                                                                          SHA512

                                                                                          ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1

                                                                                        • /data/data/com.qdaily.ui/databases/bugly_db_-journal

                                                                                          Filesize

                                                                                          512B

                                                                                          MD5

                                                                                          4d70398fb32253a7601c9e890c0ef221

                                                                                          SHA1

                                                                                          0aa82942ac849cdd942cd233f2a1004ad52ca9b6

                                                                                          SHA256

                                                                                          8c9f36beb7f3a464abfab00fffd2ebfc06c3bcdc3d347caf2e9911b9c85c329c

                                                                                          SHA512

                                                                                          fadbfec130ea22467163215ae956d5d869fd5c980597b9261818655b8c1cb2b097dbe39f51f728cbf95cc50946b18a977b6f0d28d0e409185c5f215420e9d861

                                                                                        • /data/data/com.qdaily.ui/databases/bugly_db_-shm

                                                                                          Filesize

                                                                                          28KB

                                                                                          MD5

                                                                                          cf845a781c107ec1346e849c9dd1b7e8

                                                                                          SHA1

                                                                                          b44ccc7f7d519352422e59ee8b0bdbac881768a7

                                                                                          SHA256

                                                                                          18619b678a5c207a971a0aa931604f48162e307c57ecdec450d5f095fe9f32c7

                                                                                          SHA512

                                                                                          4802861ea06dc7fb85229a3c8f04e707a084f1ba516510c6f269821b33c8ee4ebf495258fe5bee4850668a5aac1a45f0edf51580da13b7ee160a29d067c67612

                                                                                        • /data/data/com.qdaily.ui/databases/bugly_db_-wal

                                                                                          Filesize

                                                                                          76KB

                                                                                          MD5

                                                                                          f4c0512b043a43f846599ca95795c912

                                                                                          SHA1

                                                                                          233496d885c6df0dc46d0a60b9c254699d7e4b94

                                                                                          SHA256

                                                                                          533ba9f8f625c0dccff5be3426b4af280a606de240871bf2023ec06c32fc86cc

                                                                                          SHA512

                                                                                          a7497323831fbd941ccf52a46dfec2af188630006870f25cf0e69d86a8ac3b45c96a176b100598b8b33a472cda44914a842905bc5f8d2f78f0eaf852b361b2ed

                                                                                        • /data/data/com.qdaily.ui/databases/google_app_measurement.db-journal

                                                                                          Filesize

                                                                                          512B

                                                                                          MD5

                                                                                          4c460b9617bc5afb0c505123a8bff55f

                                                                                          SHA1

                                                                                          ec339196decc4fedb4c6b479acd50527630c5bfa

                                                                                          SHA256

                                                                                          573ef14f3a999e7bd8cebb001df26ff87c240a9760567048cd7b35267a481264

                                                                                          SHA512

                                                                                          e5e1c8c27be8c313db27f3c2da9b39a59dec6fa2bf5037924c014c6472670045a9b3a2d44bc29f6571ee017d5a5b813877f47a905b7b47db57ddbcfe30378e2e

                                                                                        • /data/data/com.qdaily.ui/databases/google_app_measurement.db-wal

                                                                                          Filesize

                                                                                          68KB

                                                                                          MD5

                                                                                          7fbb8af26d6004173d46e92505526358

                                                                                          SHA1

                                                                                          3e1498a7dfebef4f11f6c8de4d519883e090886e

                                                                                          SHA256

                                                                                          1c6315b75a4c6cde65ecf2b1c12c6bf5f8dd8ad4c99242ffbb7fdcb68d11ab13

                                                                                          SHA512

                                                                                          03462ed4146db94b46def0759301aa99de53d50ba04daac522bbb866b3b781ac29f7a94d88bec24a1406242b3a88318c4b3b23145e4304faca1b46f08d3a494e