61a6fe435d81ba07c5628fc9a5507e9c04cb9044f98529c0b1abdb577c11d609

Analysis

max time kernel
2582450s
max time network
165s
platform
android_x64
resource
android-x64-20231215-en
resource tags

androidarch:x64arch:x86image:android-x64-20231215-enlocale:en-usos:android-10-x64system
submitted
23/12/2023, 18:09

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
61a6fe435d81ba07c5628fc9a5507e9c04cb9044f98529c0b1abdb577c11d609.apk
Size 9.2MB
Sample231223-wrnpwsedf9
SHA256 61a6fe435d81ba07c5628fc9a5507e9c04cb9044f98529c0b1abdb577c11d609
MD5 f24a4dcb7979897a5b03e876a5ef5554
SHA1 8851cf53448b3ded8fc1182209d9557eae58ea9d
SHA512 02b5b658e531a3d43dd4ecb5f54948b77ea61dd3c4160ecbe04de9fa285c75afe62b0c491d38851eaf93c9dcc6cbbe5881ca6818a4b1508cff1e794eb6952f55
SSDEEP 196608:YZoiKhR/SLYKGaNqCNcVl0Q//aHY9UzcT0++j46IIkipmN:YZq4LBGboud3aHhcT0n4JIkxN
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

Malware Config

Signatures

Requests cell location 2 IoCs

Uses Android APIs to to get current cell location.

description	ioc	Process
Framework service call	com.android.internal.telephony.ITelephony.getCellLocation	com.myzaker.ZAKER_Phone
Framework service call	com.android.internal.telephony.ITelephony.getCellLocation	com.myzaker.ZAKER_Phone:remote

Acquires the wake lock 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.myzaker.ZAKER_Phone:v1

Uses Crypto APIs (Might try to encrypt user data) 1 IoCs

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	com.myzaker.ZAKER_Phone

com.myzaker.ZAKER_Phone
1⤵
- Requests cell location
- Uses Crypto APIs (Might try to encrypt user data)
PID:4959

com.myzaker.ZAKER_Phone:remote
1⤵
- Requests cell location
PID:5013

com.myzaker.ZAKER_Phone:v1
1⤵
- Acquires the wake lock
PID:5144

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

ZAKER_DB.db

Path /data/data/com.myzaker.ZAKER_Phone/databases/ZAKER_DB.db
Size 12KB
SHA256 465e45f489734e36d07ab8e681f1e94feb01c489114649c382cc254e2f716ed2
MD5 8baaf42902f2eef26fe5d6dca27a5a02
SHA1 611ca88d5784e5ead70b4c1a6485f399a531b424
SHA512 85974eb7ba551ba5843faaaa89890ab9d532f44fc2763076a9e1aeada2351fe977f66e6c3201946b44acabc391bfb31199cd2f56307c88a8327372312dd43063
SSDEEP 6:l9bNFlqhEtwlOERX4PBX4ogLugMBX4suuKTqiOw2:TLmEt6RmBEyPbsOw2
MD5 SHA1 SHA512 SSDEEP

Submit Download

ZAKER_DB.db-journal

Path /data/data/com.myzaker.ZAKER_Phone/databases/ZAKER_DB.db-journal
Size 512B
SHA256 04d3d574f9cbc9b23376b8baa29b846ac260416d326b37afbfca524caedac9ec
MD5 0500e05d8d901c90dd9ec230d6512602
SHA1 904cb067acc5264c156435157df2f455de6e336e
SHA512 2c3413750a2b6c4af094a18abe0b110f0ff30d686215eb46b805e47478d2b6ef5bf3c14eddfc32d541b3b804613ee811a8b750facb5ab518b736950954344894
MD5 SHA1 SHA512

Submit Download

ZAKER_DB.db-journal

Path /data/data/com.myzaker.ZAKER_Phone/databases/ZAKER_DB.db-journal
Size 8KB
SHA256 4218192e6d92329aa2aac580de62f5d1f3101ca030e8ee20f52cad6945f4d5ae
MD5 e21a9dcb889bf67aa9fb7dfa53571f25
SHA1 f6066ac9ce2748adec6a2a71b36de40b0214f261
SHA512 7193ae21c9137dfca281c89fd64dde263cc585db8c199107bfb73182b25012a983c396174cfddece83640030e180aec9300eb648997d2c3f3cb3c2777f327c2c
SSDEEP 6:7+/l9aOHn1S9WWg9bNFlEuWdOlOERX4PBX4ogLugMBX4suuKBn:7+tUOWRqLiuWdwRmBEyPbOn
MD5 SHA1 SHA512 SSDEEP

Submit Download

ZAKER_DB.db-journal

Path /data/data/com.myzaker.ZAKER_Phone/databases/ZAKER_DB.db-journal
Size 4KB
SHA256 550ab7ffa822ad23a8e90c515445d962cb15a3000e3f3e30fefc11ddbe19d393
MD5 6140616d8b3ff345c85877c19a24f0c0
SHA1 d27e47420f16e11fa741801c8d9ba7ae220dd44c
SHA512 9745668ee70cfcb0f736cf61ce9013af6f0f50354f45f4948106acfcc2b0b2c1d96e12f6536e25f5b34dec5e062b94573a8ef7a21daa15557e5b2747619f5f1b
SSDEEP 6:7+/lFFvGPg9bNFlLdrlOERX4PBX4ogLugMBX4suuKL:7+tP6qLJdTRmBEyPbQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

push-toggle

Path /data/data/com.myzaker.ZAKER_Phone/files/ZAKER/DataStr/push-toggle
Size 1015B
SHA256 f3be00f4f133bdc155795c97a3a78eff266c0d63986dd0467299c91ce148bb8b
MD5 3b6cb04e8a804b62c18cdad52acfcf70
SHA1 931cb48ab47752fe9012a6157ff40a501c600ce5
SHA512 989e06dbb14871726e4e402f92dbfd0038c6204f3c276a4ec0da08b21e8377d9272422e51bc1925b416a3eb9973d2b4db9394872e8cfb2551f25fc06c30ed35d
MD5 SHA1 SHA512

Submit Download

__local_ap_info_cache.json

Path /data/data/com.myzaker.ZAKER_Phone/files/__local_ap_info_cache.json
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

__local_stat_cache.json

Path /data/data/com.myzaker.ZAKER_Phone/files/__local_stat_cache.json
Size 25B
SHA256 c8a6624f390568f0ddcb9841336aec6a564460fdaf6624e562b32935b8956f19
MD5 2d805b13f2f28dc3ca9bbcc000f49bb5
SHA1 9eac165b4d81258fd3967cde5cc53b53b1dabcb1
SHA512 5db8c57bab36bcf9db698c1dce70318cbffc156dd1d1c1e09e5b7ba60aff07b598ebbf26c4bd8a2b03bd6e59ef2dde2d944a22a8d8a19ecc8378e83afb7c83b0
MD5 SHA1 SHA512

Submit Download

firll.dat

Path /data/data/com.myzaker.ZAKER_Phone/files/lldt/firll.dat
Size 12KB
SHA256 a6e55430723b81e1e9ab76ed977e1df6376659a8ea9b95c328c817f071b48d1e
MD5 0bec2b6b0594d709bd6f4608cfe8defe
SHA1 f72c177c94d055a46463911f4b81160adeff936e
SHA512 658f4a13703e8913dfb7efc10c0f5c013172092033076883bb09463a266dda1c2669c53d9e6e0eb2aad8ad0a1edb67d989c26901d0143cf4b93075c51e0ceffa
SSDEEP 6:l9bNFlqLitwlOERX4PBX4ogLugMBX4suuKTqiOw2:TL7t6RmBEyPbsOw2
MD5 SHA1 SHA512 SSDEEP

Submit Download

zkid

Path /storage/emulated/0/Android/data/com.myzaker.ZAKER_Phone/cache/zksys/zkid
Size 29B
SHA256 c00ba95544a9147c3dcdc1b3230b2874d829bebb800fb6d6faef8657b701102a
MD5 b30c7d3e392afb478fcf9bf6acf700fb
SHA1 c062bd385a44cfcda44f703cd4c348444c4afe88
SHA512 0d2caece78bd570c5dfbd707ecb9e8e20421f76d0502b6a6f5874214e58690ee0a7e5e15ea7452b750d70b64eb817db365420c05d517065afe27fff3f03ffa11
MD5 SHA1 SHA512

Submit Download

statisticuuid

Path /storage/emulated/0/ZAKER/DataStr/statisticuuid
Size 16B
SHA256 30f8fe20694d29f9a31a57c1b7231d302f4899533f8243c967ffa4f138942081
MD5 724cace3de37fafb74047e5825424416
SHA1 f5ac5f6d2216ab021784c7e2be15e450321b8903
SHA512 a8590675b41e28a870a6b3bd5b8750e5b5f44a3489f3adeb17e3c2494058704fbce2a2f99fca71316be3f62c8e4021ba263af1395425a6cdcda72d2ed12c95ff
MD5 SHA1 SHA512

Submit Download

.confd

Path /storage/emulated/0/backups/system/.confd
Size 20KB
SHA256 02b08eaa05ce1f2ddb0fc8d74382f4fbf8ef420f0b6f6df10d57ee9f94c5fdb6
MD5 9774053c4fbe06ac186b88a1e4fa075d
SHA1 caaf8669e5338be941c478f56eaaeef587218df4
SHA512 3b4e4c938735f999e8dc9ab19fa6cf002a7196c98507560478635d8fe93db5952de8240c4b706283f23bc1cc167bfc5e1b2e7d026628d22039c151d7a81b1b80
SSDEEP 12:TLWROv/UyNTSFbyRxw59YERmBEyPbAVOwlN2Dl3LXMtkem:TLZHBSrY/GSE72DRLc4
MD5 SHA1 SHA512 SSDEEP

Submit Download

.confd

Path /storage/emulated/0/backups/system/.confd
Size 24KB
SHA256 5f2d77e220164d51a57138f4d9c9c6e2825e0a3513c4bf83fbaf23729f0917a5
MD5 52a50ffbe1f0cebe1d515dd8a39c78a1
SHA1 ef0f04f25ad9c512edaf5f622b68b0344c532f3f
SHA512 da962f85f49b92d6191cb4f7f12fba64236a412af4793aced0762a76b8d6403fe90e5ea9484b18d7f948db7a6e0f83624007cd38e9a3f2e3b363857ed9c6c118
SSDEEP 12:TLi0QrR0y359YurNTSFbyRxw59YERmBEyPbD/Dv0Numo2it:TLiBXrYuBSrY/GSfyuvh
MD5 SHA1 SHA512 SSDEEP

Submit Download

.confd-journal

Path /storage/emulated/0/backups/system/.confd-journal
Size 512B
SHA256 9d076b314c6f2912afed183a705b5c95e781fc31e03d089b534633194a05a481
MD5 b50847a1e1dd9dc8d30f01a8811f0c40
SHA1 b5cf5967e6ac576e306679188fede42309978db2
SHA512 d586fb418b65c844b6a38855555bc2dc1ab5c83daac654de059ccff8b8ae0e64c8055d1d390217e4170953b19b68d2b35c3a2bfbd487e32c8a6843375f4ff454
MD5 SHA1 SHA512

Submit Download

.confd-journal

Path /storage/emulated/0/backups/system/.confd-journal
Size 8KB
SHA256 a4e25debbf54c160912692a1a0ed95ea7c2630b4208b75d4441e3037d8c9e88d
MD5 9015f58e8915f2ef2c804599c35d0aa7
SHA1 fdec69851b7d225c280982cc2946b21620e1f98a
SHA512 d947dd42e4fb2380f183d04e3243a098c8d370db55553e327157dd696e04e8b4ba466672ecbdcba699dbbc82cb517f64d3aabab390613693271124d6b9145ca8
SSDEEP 6:7+/l9F8Hn1/sWg9bNFlEuWdOlOERX4PBX4ogLugMBX4suuKQ:7+tgJfqLiuWdwRmBEyPb7
MD5 SHA1 SHA512 SSDEEP

Submit Download

.confd-journal

Path /storage/emulated/0/backups/system/.confd-journal
Size 4KB
SHA256 b01756b428c57a4912a1212f61053f39abb2c73f33ec739e1d79e6920ad8f0d2
MD5 a9a028009f9ce2698ddaa5eae7929527
SHA1 17df15c18b9fd7b6144192c693f1da13258aa9fb
SHA512 2f6d1afff5da898716c6435b84bde297bf938f80b7367d99da465c84cfaa8dcc360a64fa9051967f999526340cdfb45b82a9881fb973202a9728e412c3552a38
SSDEEP 6:7+/lzPg9bNFlLdrlOERX4PBX4ogLugMBX4suuK49:7+trqLJdTRmBEyPb/
MD5 SHA1 SHA512 SSDEEP

Submit Download

.confd-journal

Path /storage/emulated/0/backups/system/.confd-journal
Size 8KB
SHA256 8da5d9871f1093d849c20a711805ced32e89d6c6a889633ff91372307f08916a
MD5 60a25bd34b2c41019585907b1b828bb5
SHA1 4eed2c3cb2c27123d3bf9eabc4c9aa297a4ee34f
SHA512 c6eb92bf29d10cc47bedfee1e860064628e1af26dd910fd64b4b4464eb127d1be657746ce6861af3f55b03e07134ab5e084c04686131f36b586390846a62e974
SSDEEP 6:7+/l9ILHPg9bNFlqhO1IlOERX4PBX4ogLugMBX4suuKgl0//OfI:7+t0vqLmqCRmBEyPbPqwI
MD5 SHA1 SHA512 SSDEEP

Submit Download

.confd-journal

Path /storage/emulated/0/backups/system/.confd-journal
Size 12KB
SHA256 2c41e69030202f7efb3ff7c9dd93be904dc64a8394ef0fde46cb63e09194cbf2
MD5 81eb591491f19655a454dabfbcadbd80
SHA1 4d9b294625430d6574f181bd63ade76bc0021a86
SHA512 740cd1acfc8fbbabadd17d0cf6ab94e2a2a4bcda6407cbf8b07d6e99616204527c1ecea5df35eaf8dddbbe9fa03c344d2b378db7ffa6d275e2b3c7bc7d1e9379
SSDEEP 12:7+t090qLyKEg/UyNTSFbyRxw59YERmBEyPbXs:7+t0GqLy9gBSrY/GSXs
MD5 SHA1 SHA512 SSDEEP

Submit Download

.confd-journal

Path /storage/emulated/0/backups/system/.confd-journal
Size 12KB
SHA256 43aebca52876926e642be45e2b918c6383eb97aa338ccfdd346cc30f0d870126
MD5 0f68dbf24b84182d8f5c282230f4ffb3
SHA1 9389abc0c7f71c4f3d5a6f48893b01ae830c9f14
SHA512 6d5318cb4d75c287b34ac140648889fc64c3f68086bdc4b88177307a3210a314cc4b65aca7766afd2e22219bc2b44cac5feab4fe50924a07e3016a1bdc9917a6
SSDEEP 12:7+tzHHbvqLSlrR0y359YurNTSFbyRxw59YERmBEyPbV:7+tzTqL0XrYuBSrY/GSV
MD5 SHA1 SHA512 SSDEEP

Submit Download

.config

Path /storage/emulated/0/backups/system/.config
Size 25B
SHA256 f14dec881e6f532eebc025e4d3a756a63992e7785ef6f63c8f55585ff68d8804
MD5 50d6526be5a93fd98904ce506d509711
SHA1 f5473907fe18b56b2e604abe0415ee496d8190a9
SHA512 572ba98ac96e405086a5d5ceccbebc1cda653179196d5760491db251a9f84944e0a486650923fbc9bc3e71cecd58c8643746e6685534abec7907596fa357e979
MD5 SHA1 SHA512

Submit Download

.config

Path /storage/emulated/0/backups/system/.config
Size 50B
SHA256 49f34d8eeb9dfe3343c9554e2c3988d2b71c07b8b6e5865d10fc86f725dbe7e7
MD5 176b8f9396feeded702efaca16a1dd38
SHA1 dc9908efc3e7e91ea92d83aca9ce9b0a013e090a
SHA512 0409e5a05564565b45ec8c42c81001c9b9579deae895a97d1a04627e01a258d48fdb48518c96eedf9de7188b57e12bfa296643ee84577c1e41f187eaa356a8ea
MD5 SHA1 SHA512

Submit Download

conlts.dat

Path /storage/emulated/0/baidu/tempdata/conlts.dat
Size 12B
SHA256 f52db31332534833414abd5e870f78c810b8ebbe5b134bbf599506beecfd1b93
MD5 8d80bc8ea90e9cac010d3ddf97bda5f5
SHA1 f063bc0d356e6ba9ab1eb9a851131ffbefd8fa07
SHA512 9ea732dd572a9a4ba91b70891972230a09576687ca1bc19e62d5a98b5b84e0f2ae11985108008bc9fbccf357219b8bd3dbf146bb70752f618f70dc5d0c46a7c7
MD5 SHA1 SHA512

Submit Download

conlts.dat

Path /storage/emulated/0/baidu/tempdata/conlts.dat
Size 512B
SHA256 2d6f236eefa72d0c779eb15607e256149071f2aa09c438d61ccee709845c5e9b
MD5 0c410a53f50d535f340b90fa6156bc1a
SHA1 7946531ec28e1c2b5094b9108f92429dfbd83d7e
SHA512 0cee6a838acd0d7470c0868b525d6b155e683c1e566358866f5b264b481a439df3fd07e18431089876a7619de2dae9a0ff323d0e3d0dabb54e4b859322537cb2
MD5 SHA1 SHA512

Submit Download

lcvif.dat

Path /storage/emulated/0/baidu/tempdata/lcvif.dat
Size 8KB
SHA256 4d5cca995163f3fdaa80f65202d079e691fe8d8dbbb172ab3fe1f8ed0982a3e1
MD5 000dca13c78561dd6b9a30e0b6354c5b
SHA1 4ba87fd3ba2f9223aef62ad6f31aa7a1ab301f60
SHA512 951217b029b1917ef9d0bcc378d41b2eeada1ee85bbc290af559428494f1f837d5204a33036bb367161bce7366b7e5f1b54ef8a26cc9be1416fb171f4396c351
SSDEEP 6:kUXxp9Bp9+rcxX1n1S9WWg9bNFlEuWdOlOERX4PBX4ogLugMBX4suuKBn:kUuroF2RqLiuWdwRmBEyPbOn
MD5 SHA1 SHA512 SSDEEP

Submit Download

ls.db

Path /storage/emulated/0/baidu/tempdata/ls.db
Size 28KB
SHA256 5f266f7cf5a44a3cfcc9bfbba94735081851edc224cb071fa6e650227e214279
MD5 2cd47ada17ad7a4e3d5e2717cb2762c6
SHA1 7cb844672cec4a3bce75c8cf81e80e8ad7cc49e5
SHA512 c25229cca649bc8ef54c0770a976034801c0a300d181c107c41879d7f6b7056c6282210c98661428078381032dc6fb0872112dde7e8efb1a9f9b333877f18dae
SSDEEP 6:l9bNFl4/msW1O+9v5puKx/zrAvH8i8PQtLu8iqPqqLGf2OJRHXF/XWERX4PBX4oJ:TLWeO+9CNUTN8iqPs3RmBEyPbGtOwI
MD5 SHA1 SHA512 SSDEEP

Submit Download

ls.db-journal

Path /storage/emulated/0/baidu/tempdata/ls.db-journal
Size 512B
SHA256 382bf596388643ea922a29331e930f6b2deb4d24d085cfa09431538e311a42d8
MD5 1624b3c808ea8f248c1dc46466ae547c
SHA1 f67534e755e80157fcad5f752fa635998cdb635d
SHA512 a057bafc4f101ba6d2d9f95f1bca76eb704fe75cf024483bf1bb317e94ab551d60f7a86bbe78ca545cadfd2d6b3e8c2a70f0c55ba7ae63f782ed85b26cd178ed
MD5 SHA1 SHA512

Submit Download

ls.db-journal

Path /storage/emulated/0/baidu/tempdata/ls.db-journal
Size 8KB
SHA256 207380fd34c26641e996e874406d053e2df414ae350c001b0b9d94eab17447b0
MD5 f15b8ec4a77788873871340ed41dc73f
SHA1 9fb5ea144cb065107d436d3bdcd4cc59376b0e2d
SHA512 85761d752543836b359533cf936217e6f5408fbcf5c7e44a1383c550fc43984762e81e96688f3048cd5741903a4efc6355178e101ffcc272a61ff6869653c6b2
SSDEEP 6:7+/l9vUXGn12pg9bNFlEuWdOlOERX4PBX4ogLugMBX4suuK0Bc:7+tNiqLiuWdwRmBEyPb7c
MD5 SHA1 SHA512 SSDEEP

Submit Download

ls.db-journal

Path /storage/emulated/0/baidu/tempdata/ls.db-journal
Size 8KB
SHA256 bf55a113c2bea9f4f23ebb1bb5fecce14f3336ae19c290e069428e673efffefd
MD5 6c69137ee91e5ed349ef94e44bc261b9
SHA1 253686d5c459692ec80e62527c6349154934b1ec
SHA512 00d1247f6ce2b94fa90e7b27b76dffd32e996eab86e7f3248cdca77e722e60f2465844f6dbd6c910fb24b31a7a2f76a3966815fd325d33b490c30e88d3f9f7a4
SSDEEP 6:7+/l9wDPg9bNFlLdrlOERX4PBX4ogLugMBX4suuKuC/L:7+tIqLJdTRmBEyPbkL
MD5 SHA1 SHA512 SSDEEP

Submit Download

ls.db-journal

Path /storage/emulated/0/baidu/tempdata/ls.db-journal
Size 8KB
SHA256 56add31849d478ab1db343ffa7cc17171defc4591997e9d1897a0eab324bd4d5
MD5 9eac40e2cc99fe6a955d4d74647c1707
SHA1 18732b67178c77e17b7b23bffa70b86f6649a00f
SHA512 34fb483ffa4b8cdbe4f32b639b81236289e32cb537e4ce4e7f70b47ce8f97d10a96bc046a93a6516a6b5b7b9b35072a0563c8328d4a8b4d92efbd2250613aa7b
SSDEEP 6:7+/l9May6ng9bNFlq4ys+bvH8i8PQtLu8iqPqqLGf2OJRHXF/XWERX4PBX4ogLu1:7+tY6nqLZ+ATN8iqPs3RmBEyPbJabG
MD5 SHA1 SHA512 SSDEEP

Submit Download

ls.db-journal

Path /storage/emulated/0/baidu/tempdata/ls.db-journal
Size 4KB
SHA256 d6a8903917e8dd3540b1ac6a504ba6fb5512a6fb25c8abc15bb738ec72011874
MD5 4600873d380bcfba1ea63b7e0ade8ffa
SHA1 98c78134d914ca93464b5f86a8ef96ef8b58be25
SHA512 b6484929a45d8f98fd16965fee68063e259a309f48ae76ea343ea9f349ba712e6624f01e01814715fe4a2f739fa6647ee6681c4614c707a1dbcc371151405508
SSDEEP 6:7+/l/Ejg9bNFl+lXs10Z9v5puKx/zrAvH8i8PQtLu8iqPqqLGf2OJRHXF/XWERXk:7+tcqLEy0Z9CNUTN8iqPs3RmBEyPbV
MD5 SHA1 SHA512 SSDEEP

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads