Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
8Static
static
6512c61381d...07.apk
android-9-x86
8512c61381d...07.apk
android-13-x64
dmss_v2.apk
android-9-x86
dmss_v2.apk
android-10-x64
dmss_v2.apk
android-11-x64
dump.apk
android-9-x86
1dump.apk
android-10-x64
1dump.apk
android-11-x64
1dynamic.apk
android-9-x86
dynamic.apk
android-10-x64
dynamic.apk
android-11-x64
Analysis
-
max time kernel
2574332s -
max time network
159s -
platform
android_x86 -
resource
android-x86-arm-20231215-en -
resource tags
androidarch:armarch:x86image:android-x86-arm-20231215-enlocale:en-usos:android-9-x86system -
submitted
23/12/2023, 16:58
Static task
static1
Behavioral task
behavioral1
Sample
512c61381d71f601319c873f175491a00c118599992ec7bbb0622c9dbd6aba07.apk
Resource
android-x86-arm-20231215-en
Behavioral task
behavioral2
Sample
512c61381d71f601319c873f175491a00c118599992ec7bbb0622c9dbd6aba07.apk
Resource
android-33-x64-arm64-20231215-en
Behavioral task
behavioral3
Sample
dmss_v2.apk
Resource
android-x86-arm-20231215-en
Behavioral task
behavioral4
Sample
dmss_v2.apk
Resource
android-x64-20231215-en
Behavioral task
behavioral5
Sample
dmss_v2.apk
Resource
android-x64-arm64-20231215-en
Behavioral task
behavioral6
Sample
dump.apk
Resource
android-x86-arm-20231215-en
Behavioral task
behavioral7
Sample
dump.apk
Resource
android-x64-20231215-en
Behavioral task
behavioral8
Sample
dump.apk
Resource
android-x64-arm64-20231215-en
Behavioral task
behavioral9
Sample
dynamic.apk
Resource
android-x86-arm-20231215-en
Behavioral task
behavioral10
Sample
dynamic.apk
Resource
android-x64-20231215-en
Behavioral task
behavioral11
Sample
dynamic.apk
Resource
android-x64-arm64-20231215-en
General
-
Target
512c61381d71f601319c873f175491a00c118599992ec7bbb0622c9dbd6aba07.apk
-
Size
6.8MB
-
MD5
7a77082eef43c67bcbfc910cf54c18d6
-
SHA1
62fcaf7be5fb4b3abde728adc117d670e54c27aa
-
SHA256
512c61381d71f601319c873f175491a00c118599992ec7bbb0622c9dbd6aba07
-
SHA512
36dca149e65c8c910c7eb638cf63d35005c922f968c80f48b98aeb2cf89cdd440928711edf6f8c096581275c0b396e75adf50b4a4db21a25e6b04ac9e155b5c1
-
SSDEEP
98304:Gr761NF7mPgOA0bzmrxQuB7MmNnt1d/AYs/I09XfbCFXruTcECHD+/OxN566D6bG:GrsOtM2uxMGwJCFFZ+/jqguP3
Malware Config
Signatures
-
Requests cell location 2 IoCs
Uses Android APIs to to get current cell location.
description ioc Process Framework service call com.android.internal.telephony.ITelephony.getCellLocation com.qihoo.appstore Framework service call com.android.internal.telephony.ITelephony.getAllCellInfo com.qihoo.appstore -
Checks known Qemu files. 3 IoCs
Checks for known Qemu files that exist on Android virtual device images.
ioc Process /system/lib/libc_malloc_debug_qemu.so com.qihoo.appstore /sys/qemu_trace com.qihoo.appstore /system/bin/qemu-props com.qihoo.appstore -
Loads dropped Dex/Jar 1 IoCs
Runs executable file dropped to the device during analysis.
ioc pid Process /data/user/0/com.qihoo.appstore/files/sllak/opt/4270/finalcore.jar 4270 com.qihoo.appstore -
Acquires the wake lock 1 IoCs
description ioc Process Framework service call android.os.IPowerManager.acquireWakeLock com.qihoo.daemon -
Uses Crypto APIs (Might try to encrypt user data) 2 IoCs
description ioc Process Framework API call javax.crypto.Cipher.doFinal com.qihoo.appstore Framework API call javax.crypto.Cipher.doFinal com.qihoo.daemon
Processes
-
com.qihoo.appstore1⤵
- Requests cell location
- Checks known Qemu files.
- Loads dropped Dex/Jar
- Uses Crypto APIs (Might try to encrypt user data)
PID:4270 -
/system/bin/sh /system/bin/pm list packages2⤵PID:4703
-
cmd package list packages3⤵PID:4720
-
-
-
/system/bin/ping -i 0.5 -s 56 -w 10 -c 10 221.130.199.882⤵PID:4761
-
-
/system/bin/cat /sys/devices/system/cpu/cpu0/cpufreq/cpuinfo_max_freq2⤵PID:5012
-
-
/system/bin/ping -i 0.5 -s 56 -w 10 -c 10 221.130.199.882⤵PID:5087
-
-
/system/bin/ping -i 0.5 -s 56 -w 10 -c 10 221.130.199.882⤵PID:5126
-
-
/system/bin/ping -i 0.5 -s 56 -w 10 -c 10 221.130.199.882⤵PID:5184
-
-
com.qihoo.daemon1⤵
- Acquires the wake lock
- Uses Crypto APIs (Might try to encrypt user data)
PID:4300 -
/system/bin/sh2⤵PID:4477
-
-
com.qihoo.appstore:critical1⤵PID:4497
-
app_process32 / com.qihoo.appstore.rootcommand.persistent.CoreDaemon --nice-name=com.qihoo.appstore_CoreDaemon --daemon1⤵PID:4546
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
28KB
MD504183d28d08d24a5b03704e8a44f1e0e
SHA13710a7d4f4a50e9a8a14d1cd312291d99fadf7ff
SHA256cbcd94a175e1689d50dc1d42f20d9238dc71ff218539f8eab55da964e5190695
SHA512817f91475b63f1e8feb1a11cf55f0409b6728bfe8db1b6fc6db63a7dbb091a144c607b2f339993d79b0a7ab338d02c9612af63296624a1ba1f6de03b96fc245d
-
Filesize
512B
MD590991fc49d6c9e6a0932b8b2b1136d9a
SHA1eefda7bbb242531b76219858f0ded12d78ec75d1
SHA256f99caae7c4e1eba3d8f7908ab3220d3076a9bc0f5c9384610fe3390bba5b84f5
SHA512ed44e3b79ca94b216d3fcb55b3feb999c7a520595d98d95023d0671121ceca497c02b7fb5b84cf0b96144726ff012a573b5ff360a31b84ec621be84bd4be7d43
-
Filesize
16KB
MD55baecc4d5864495be283586eb560c596
SHA1048153aa6a5126b247492efaa8131fbd6a84de84
SHA25643432eeeed2ad5e61582828fba9d6055a8718f23c4389f380147296cff1a68b1
SHA512e9d4588a2e8472c00755791f290401a22fcb2ac936e5b9f0787077605335973a94bd281a5e6f167fc304528dfdf0c75de0d05e4fa8e70434d1cb506824b1e2ce
-
Filesize
8KB
MD5829cbc024847bb0d9cbf209cb128691c
SHA113d3b26e75cd897984c24a4641622a33187ead7e
SHA256e5d0454d6bce8f2a0d6b98c7bad7940014273107d3615f95d6cbea8d4f1a448c
SHA512a89da87d8c8699e2863d9ca8394f7e70a1b80e7939f2431fd9bc631c6068c7e0adca86a095431f4ee094524e99f5fd49caee4481fc746f393d0e381d839c9386
-
Filesize
512B
MD55e5150d61539b66a9950d8ef03f0b3c4
SHA1f051a53ca12d16cb6acf23829c32ee7c49884ab4
SHA256d965a2c0b7b1728ff4f319b655fa7b5eeff9ffd5a3caf6f89814eec8e0fdd296
SHA5128868ad1013ae9a7b4a3a3809bc38cc339647c94fa0b6ee887a0a93bc7de4bc5298d7b5356f5fa8cc87d28e5f4cbca552ec79468d4f13fb3d6f08ffd8cd4a1e82
-
Filesize
20KB
MD5dfc439d0e3283e79726a856f4244e56e
SHA157e681e8dcdb555b7f65326892e2e0793a2236c9
SHA256b3ed7b8a06aef8215c19b388fbe3971a3846dad3b2016e173a562b7c5d02f550
SHA512ce1e9fa188995ac072c710c38c87f909f9f2459f39640d41fe9ff609c2a2b4d0ac72d0c326195f2585897806ac4c3d61b8496d2a1f02db21beb255522adf047c
-
Filesize
28KB
MD5924e8d876830616bfc401ee5a5e64225
SHA11caaa4b15e0e9bdb7bb540c37f5518ceadf80214
SHA2566a912b040955c84b13cd3b7224673d8cf96746689840d2b3bbe6d5dbdb8c63b9
SHA512974f9e4d4bd724308a2a066bb8ccdd8355c69c327dc034f8a742d0cdb012e5f4d8544aae43ad8a2ede8e3d41c942262de3dd1c13399677447882fb394b168c1a
-
Filesize
512B
MD5df4ce15fd898e9ba0c52ee9c8bbc6789
SHA14553808c3d41e7edc90341d11d0c546270bb4480
SHA256e48314eec1acb289ac50f6a4f82e45c1ae0729b0f4ad203caef03d72b5d2a68a
SHA512a8484ef3ba322092ae83dc014867057ee6b4a367aadef6346b79395f772d3439e4500e1dcb6582d7bc237f1fd23c06d07b680f7a26284755de8ddd46f8589ceb
-
Filesize
40KB
MD5bffb2c8b6138317b35e59df77812c378
SHA1234f862e67a5d40165c3c52ff30a8743eb344293
SHA25643cc6d85730032bf201ad169763a248ff43677809e2be0a6d31dd41372f7424a
SHA5122385d0b75f029cf7201c2016207282b9a98dc9dd134fc672085c481d2c573918c451e6dea79b99e4980bf8fe7d6086ee71f899bb077a3ccc374134f8a2b04ec5
-
Filesize
4KB
MD5f2b4b0190b9f384ca885f0c8c9b14700
SHA1934ff2646757b5b6e7f20f6a0aa76c7f995d9361
SHA2560a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514
SHA512ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1
-
Filesize
512B
MD5a87dca7a96ad479084ffe495bd1fd488
SHA1307542d4913a89f4d965088ba342aaf2f05ae9e6
SHA2568fffaa5df2831bddc054ade1b9694ae488ff0c90e4aea30eb2c647eca86b8d27
SHA512099709c99735b1c3b47f5454a3bfcfac34e62c5ee4dc2d4ccefb6433343f25667c7466df52c41aacc7aaf15c79c93b7b92b7859cb5207a381165eab8646a5cef
-
Filesize
28KB
MD5cf845a781c107ec1346e849c9dd1b7e8
SHA1b44ccc7f7d519352422e59ee8b0bdbac881768a7
SHA25618619b678a5c207a971a0aa931604f48162e307c57ecdec450d5f095fe9f32c7
SHA5124802861ea06dc7fb85229a3c8f04e707a084f1ba516510c6f269821b33c8ee4ebf495258fe5bee4850668a5aac1a45f0edf51580da13b7ee160a29d067c67612
-
Filesize
32KB
MD5419f92c7433cd8ed83affa56219c8676
SHA12af463c69c54018e1fbe5b0e98e9dc405266134c
SHA256045b0b6d97bfcd2320360a46628f04fbe8b6e7f6fd11312f831644a9091a0081
SHA5128b85bbd32e31ea243a2b9fa93dbc5b3e0400f323b431c3fa415846b6b4494384b8af312cec6d4325b483401e09ed25f51796f1f610e33fe414230135c61308b3
-
Filesize
12KB
MD53fe30614d7e0d11db870b4624f6c50e0
SHA1053ff0fc621ab40f2afeddb3e7b4a73ee41ec533
SHA25667c532f0324228dd33b445cd399c1426e3a0e0cdc7b9358c66b402c5d40a838d
SHA512c7c09e97a408e88aacaf8099ad4d1fa604d58113393500a384eb3c2eb7c3c105af41314934b86eca2f088045cbab5a20d768bbb295448dc1ae6cb6c3f59821ae
-
Filesize
4KB
MD5599f63677b4ab65922bc0343e033cef0
SHA13823ecfcc5af9bd72936d429845ca98e407fd8bd
SHA256880f74a2db3b30b72392732e72bf4b7e1435c2906df0061ccb7cf6099d158575
SHA5129c84834f4abe4f27cf3e6c4c73f48dddfd0418924ef0aa458fbf329a3eb02876a4445af03ab8c9f7dac63a1fa87d0d331df5ac349acf817a9862e6f2d1f25193
-
Filesize
512B
MD545b255c5748c3a17c23a70412a2355ec
SHA18bbe97958900fb71a6a2da580e5d6b8b2b82e999
SHA2564a731c1df168c01fd9330a810b5d3f9b0851f21c917c0dfd614fa21634ba68e0
SHA512cbd94cf0fa4a887cdbc3182e3adb07049811d3dc4de41920d68dfa6f58d54e3613c40b2bdc92f9674324b8af032a0c8dad732533002d31a91f16b9f7ace9379f
-
Filesize
16KB
MD5e056139be369d4e8b0bb6c7d155c0f10
SHA16e70661da5857a91e13fe6d8b0626117dbf9c385
SHA2565748f62960985b17e80310a7a741600d4d37b2f747162da0cf59595312d29933
SHA512307ad06e3308fd08aa5269e842859497519c6e36ff968a90bc07261cdd4baf25fec62eb897fdd614b13b6acf20151afbb6770a6bed2984f320ecc5251a6fc60f
-
Filesize
20KB
MD53b9c3b0b9066f59f5e2b41fcf145aae4
SHA1f83539af4aaa176a89f174e8a1a0eda2ad67c668
SHA256b84ec70bf77d00d7dfea73473df2b111ae3d50cc437ac10fd6b6ff84badfa285
SHA512d559d7d86af729133fb9c6430190569b56abba27f2747e3946bb18c2cb665b4438cc137c44e5fb5829bacefa42c4217ce0ffd1523e47dbbcb4e1545d2352ed57
-
Filesize
16KB
MD568129d01a7662e4a8beb8f2c586c4421
SHA1042d1a386bcdd14e48e111b4c22fa913a431f848
SHA2562299706047d78a35fda804d3e6adfd471348238c269ae33228fbb98e393c32d6
SHA51235b7dec48f92b763de2bc325403bd111bc5b028bcae03a98af7d0ed3abcfab9c26a01127e45013fd6246270770f794dbf4c8a8ce0267712e8bde0601128e59e6
-
Filesize
20KB
MD5e0ddc29dccfd6312689ea105cf0434a8
SHA159191210f5a80bc047f8155ea92544f4095c38c5
SHA2563079b5c02af6b7ddced940086bf7095b1205bf0f396b87da0d5c5f6d8b5b6143
SHA512d5ec8a2bd21928c07ada4ab4df8e72b6905872533d01afe4eb243ef06674e630a9834a03dc5fc2f8d487c3cee8aa3b3117e73379ae64e6f4dcf3f8dd0145fdb5
-
Filesize
512B
MD515a78280261a858a2ec1033f6282dc1d
SHA1297db5b1afbda414f9f316ada00c6a039bacb93b
SHA2567b6b7fcdcf68895838cf90b6a13c6dfdf633cdd37502cddba00b7f3e74f68d0f
SHA512011e8ae0b2484bca5ee0c41733da0121bf2a05e3afd17b786a1b92533127d40c35d574f535ff611c3fb62c87945fd338c7c14f0a368513405516d50f1c353f7f
-
Filesize
32KB
MD56693c03a079f7cc504083ae16000fdff
SHA1efa21ac8d71c082162734b73df5cd93ccd8226a3
SHA2567d639cade88c15d0dd6690fe00ddcf0143a4ff5ac5cf9036e4597841fae14ef3
SHA51201a823399c7c69f4d77be07c3a719a516be2917f35f73db4c62af6d4f431c43aa6ef3e0c433f41d98f8a66544790f9c0705e415ad2180ed084427b7368203e2f
-
Filesize
512B
MD59179fa2a1c18774dcfae697cc5827853
SHA175f6c56f2d6ab7cd9081db371d6152f5fdadfd6f
SHA256ebef3ac9e2e83ea594378385f5c1c9e70e63d0172aa0a824088c3052415d77d6
SHA51238570b221c68fe194c783c41f5a55c65c6f04101b2a05b475f811f145380d3e8edf8ff187035e425ebf22035f023ab08ecda3d59b3c5a169dc23efcceb978213
-
Filesize
520B
MD571cb2d4c6366de4d8233549b67264c50
SHA151c3a7bc2fde9806e90ef52ae946057176d53797
SHA256a354773e305ee5a5f784b3640655830613823f3e1378505e4f0b26585380d8a0
SHA512efd70e5ba8f18a2f90d915f8151d23ce045a4e82238ddce43d1ab2e200f5c63825ad9c6f89e2c44305d1c2803e1728010d7f61f82ad4045cfdb46fb1750820ae
-
Filesize
540B
MD52c9e79dfa414b69227c9a02618275dae
SHA111a117f81cda7d0d6605671d20ae13a54394ec7d
SHA256bfc81532e2685cb7b8eff049f6a48b43147143987a33d020ca2ed446ff32cc64
SHA5122e109d84f4c53151db7088dcb6b5c9e4d7b9d191e6c37fc4eee67623cdd2364ffcb0d33b84ed9c2341dfeba91da105d3315657f72f7a06679b8c5e0da75c16d9
-
Filesize
1009B
MD5ccd6e1ac32930891dcbba32812ba468a
SHA107893b866769c80e85ebc7c31c1811f16ae29731
SHA256a615b47799b2dbe2c4cfed57ffe7197c2ae2946dda95401a9bc8fc8774937d04
SHA5122da74ea91e9ad9fa1a8a23316e486c794d5ea0a9a0ac0a1d87cd51631a7001a0eed08c5ab55d09f04755aaefab1203269602b230fd02198de0549cb40e1e69c9
-
Filesize
1KB
MD51ee730e37b89aa463dd0646fa7039cdc
SHA110a2b35eb6303d11b08d8630832b9b279474d132
SHA2561db7e3d0baaefdbff7d01a5f6c372ec964ad19e0c2569562af91b9becd0b2bd7
SHA5129ce08b696dfbd215a40c4aa50b9e19bff00e2b27114f08d11ec65c2dfb447ca03a9d09ae6ac7ebcb826a808b6081a5908a8a6d731e0f0559f3b94a51abf850ea
-
Filesize
1KB
MD5a37a5f8de4a271ddbf8ac6ef66e89c1c
SHA117e47901633a3df28b1f9218249a5fba5698ef5a
SHA25644cd3e628f1434ba944c844505660cfb1be18d8bb303c7c16860bd376614725b
SHA5125e5e05d4f341b01214ce3efa3217aec0742702fb01a3b29bf0da5ea1d0c40056bdbcd538eb5f12133c793586d7120642d941c25f43da7eb434b7f9c097746ede
-
Filesize
2KB
MD54985d5b55579c93eb140a99c3a1919c9
SHA11ac23e7e26a36334b3a539f650c3f6bc2ae16a27
SHA256e0016b560574c9d407c719a2024c77d4445d21a3138d6617c8eb6fc6ea4c9f22
SHA512ece41ff9d668499611f26480dbf2d5378d9c360e377640e337b57ca1012d1f8849a411039a2398d039819c4b0add450111a1d87eec07d75d1ebbe1654b38d7e4
-
Filesize
596B
MD5e2eb17c414245ffb16628b3cb02ed278
SHA1c48b7a474be5048b1b48788533ee8c37c1fd3a26
SHA2563bf975e28bb2d109546a727801dc3dfd130a0d95e82c7451980bb4e681071aeb
SHA5129ad53a547e4e0b79aa4cfd7fa93ad07c3e2be4e4e3c49a4b38145e214a2205118a83c3d51baa8135da2358240dceab9a59d6325caf0cf85c1eca41c102e0033f
-
Filesize
77KB
MD5c14c8a2f5d3a7c47eb2ca8c1b6e69adb
SHA14e57b3c0f34427aba8a5be40c2e9b627172a89c8
SHA2567d7ada76ea057847b5c47ed0f16a6d0e52cdbebbbdb08c1a9519acf70a1a4107
SHA5122be420b849c0fa84d3c594ab6bc85255eb54915e05aac5fd3d711e8dc93f484c5a2add2c662a858d4c2ce316a716c9e930122e9cb1047be7482c495242d766e4
-
Filesize
562B
MD5e4ba2658c8047570b8507bfff38deb38
SHA1685020dd79c548af8c9be057c1f247986ade24ee
SHA256cca74ccc54d06daaf97fee6132f2f07e517084d70ce3dc03e55649168ff83750
SHA512fe072e901cfe3e6c364c26eae429ee8eea681990075cde662a71d27f3f2198b5f185b0aed287b56c185bad37da9d2da003ace7e9c3d24cbeef26136ebf7ca5a1
-
Filesize
57KB
MD519558116ca554fed36b02e1608f512f3
SHA128cdd2d9edb817298c26f9596d34323d15031fcf
SHA25620b747f62598a44018daa7b7f3a2b5675e74a2151fcb126edb58dcbc3371efb6
SHA512c19fc5836e216ee509064721068edd98c0482edfdbaa06cffc92eb56ceac79c21a8521b5a5bbdc154b636bc754e7ce1fe3b39cb72036ddecd49fcbf574e3ac25
-
Filesize
176KB
MD5b667ca71e42bbeb899566c8834ed085e
SHA1053a3f889e326efdfa0d3ae7e5b2655f0b7376d2
SHA256536678202267f95d80480f15065e784d7ec609922a0963d935e9c5a4b0f62bef
SHA51252255d3d7066d01bd47a9da788f86c707af14e7666a918737fa5ffb4bb003e97b28dd84a7cead3439ee39e10b568c97e80174a80bf776c7dd58335b06656f8f2
-
Filesize
83B
MD5f9e29713ea9cd9f873f084463c2cf30e
SHA15ccb4d08bcbe65fc7497a122e2a98b6f74bd8e0f
SHA2562ad72c1d1a954aa12865d8ff5a6ab272194c99fb6cacb86d77c9dc2e2c932b49
SHA51253baba5e196840273f4fac03f797f9260d4a7a40359991483e84502caeb33fd1522175fd9d91c661b6b0ddc9aa4e58ee20600348035db55688894e4fb13f1d3b