62d57f28272dec15ac7e9ceb48431431c0a2a8c7ed10f539d91b3d4f50a2880d

Analysis

max time kernel
2626415s
max time network
163s
platform
android_x86
resource
android-x86-arm-20231215-en
resource tags

androidarch:armarch:x86image:android-x86-arm-20231215-enlocale:en-usos:android-9-x86system
submitted
23/12/2023, 18:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

62d57f28272dec15ac7e9ceb48431431c0a2a8c7ed10f539d91b3d4f50a2880d.apk
Size

25.3MB
MD5

cedd548ed2e93ce4a267f01cc16c087d
SHA1

64e5685a770a41225a5598066148294ce286ced3
SHA256

62d57f28272dec15ac7e9ceb48431431c0a2a8c7ed10f539d91b3d4f50a2880d
SHA512

17904e877fa0b0ec9802bc61d4e04aa7dc837bfd073d3402c3ed69172b92c3e80fed60bf1333585e5c3d595f07d89048285f41adf3ec868ea317bbf42929c00b
SSDEEP

786432:iasnGSHVVV+gNJhS7i6FcSzQl8Iat/RqIqbUoPMmNHwT:0GS1n+iPS26Ff6O/6Nk

Score

8^/10

evasion

Malware Config

Signatures

Requests cell location 4 IoCs

Uses Android APIs to to get current cell location.

description	ioc	Process
Framework service call	com.android.internal.telephony.ITelephony.getCellLocation	cn.com.qlwb.qiluyidian
Framework service call	com.android.internal.telephony.ITelephony.getCellLocation	cn.com.qlwb.qiluyidian:pushservice
Framework service call	com.android.internal.telephony.ITelephony.getCellLocation	cn.com.qlwb.qiluyidian:remote
Framework service call	com.android.internal.telephony.ITelephony.getAllCellInfo	cn.com.qlwb.qiluyidian:remote

Reads information about phone network operator.
Checks the presence of a debugger
evasion

Uses Crypto APIs (Might try to encrypt user data) 3 IoCs

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	cn.com.qlwb.qiluyidian
Framework API call	javax.crypto.Cipher.doFinal	cn.com.qlwb.qiluyidian:pushservice
Framework API call	javax.crypto.Cipher.doFinal	cn.com.qlwb.qiluyidian:remote

cn.com.qlwb.qiluyidian
1⤵
- Requests cell location
- Uses Crypto APIs (Might try to encrypt user data)
PID:4259

cn.com.qlwb.qiluyidian:pushservice
1⤵
- Requests cell location
- Uses Crypto APIs (Might try to encrypt user data)
PID:4314

cn.com.qlwb.qiluyidian:remote
1⤵
- Requests cell location
- Uses Crypto APIs (Might try to encrypt user data)
PID:4401

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/cn.com.qlwb.qiluyidian/cache/_KStore_/cache_http_api/journal.tmp

Filesize
31B

MD5
fa79244c9fe70f6cc813c4bece0d1bd2

SHA1
becc80a0d952cd02e9ab07408136498dbc82774b

SHA256
aafeabed5f0062912cd9016f90617308e1d8e320f09ac7dd65383498dc868371

SHA512
049bff76881d28a757bb8a573d9bd75ad15b6a93e9ece52b90cf29b433aba855bd6b0c39b5dd56bd86abeeae13654aa58c29f9e9483ace0963dbe5c7c8f05a55

Download Submit
/data/data/cn.com.qlwb.qiluyidian/databases/mwsdk_analytics.db-journal

Filesize
512B

MD5
06323cbd6e5c758181e64f515cc1ef65

SHA1
96d2e9d7c8241689df8e9eb51dd8a68c9b2e41f6

SHA256
0bb8db0e645a9de944b2b95c16a69476c7daa2efb64769b5c8aa356e4f5117a7

SHA512
e5a305e9906f80dbff602474fbcd5ddaab8e37e30e2ff2611ce49f132af6b42a7a605bd4b77594aa007937cce9f5dc5e3a7ca8d605c85f62985cd9125d578e6e

Download Submit
/data/data/cn.com.qlwb.qiluyidian/databases/newsfeeds_sdk.sqlite

Filesize
28KB

MD5
2c61c2650f07b464f9feeaea06740b22

SHA1
37c3d8622eec8a8d8ff24503db4df0ed9ad99aa4

SHA256
d7bf3271bb6de858b808722a2c06d1bfd7d2db801ca81915f1bb0ebb1fa9042b

SHA512
6d17165e86015352c3566a53af929fcf541d0ceefa2c7ea98feaf0a269b5cf9694402aa13a8c8cac4b260b0d5beed67b98e664fedd32d88c6836c72f732585f3

Download Submit
/data/data/cn.com.qlwb.qiluyidian/databases/newsfeeds_sdk.sqlite-journal

Filesize
512B

MD5
9cab0ec5e003a475bafa24214cd23e9d

SHA1
8c6aca0bee679f8d158bc9229cdc13a2f24eb81d

SHA256
9ec3542b36d9554b6470cc06aa5b19b615044966dadc000a611538c15e12f043

SHA512
a4b7362d77bb555f480dc4c75e41d77fb915552caafdfb3a5652f840425f67c194576f0e90b95ea58bc38233a94ecc4746f5198fcd0ece631e122a30c60b86ce

Download Submit
/data/data/cn.com.qlwb.qiluyidian/databases/newsfeeds_sdk.sqlite-wal

Filesize
40KB

MD5
4e6de14b844d6eda67444a239f397a87

SHA1
bdf951ff85dd88ea1f4817a4b59f9b717624181e

SHA256
778fcc0173c473bf0bc5f8cca24e3bf1787912cbd1ae168a8c6510fd8fe8c7a4

SHA512
9a228b06da573f96bbc8e5be37628b046e48643713e57dbe846172b0e2a04e76f6da4e9f2390fccfeb7f5fa2509bb285a89b7e7bb62755bb5bd6c8b9d59a174d

Download Submit
/data/data/cn.com.qlwb.qiluyidian/databases/pushsdk.db-journal

Filesize
512B

MD5
385957322f1262768e3e7896edbf81c3

SHA1
d1f9a8c0413b8b5e97b0c62b7fcfe5d6354f935e

SHA256
4670c3db1123b1e517a81774578233add7dd2bf9c6b105f2a0794dd7334c420d

SHA512
2fc315693a0b40ae9b12713d98ecd04ba436cfd83ceabffde794cc7a60a23c1784eaa9e5c3dfce1e624bdd7ba2f420281c31b8499f0ee07ea9019bd6cc4a4179

Download Submit
/data/data/cn.com.qlwb.qiluyidian/databases/pushsdk.db-shm

Filesize
28KB

MD5
b00ba9222cad9c794e7edb86c61ca308

SHA1
7c4771dce84eb18b260623fed893d5695f90230b

SHA256
64019a854e3081f0765544655da8b7928fd2f4a0624535c899882f27ddfb1f19

SHA512
77a3ec08f8aecb720058d6610dd54c931728226284ec154f6fe4cae5887872445013ad43ee7d6401cd58a7a1588f36482602c1b2357e7433befa1f5d2adc28e3

Download Submit
/data/data/cn.com.qlwb.qiluyidian/databases/pushsdk.db-wal

Filesize
16KB

MD5
cdb0dcda22c960938231be4bc284182f

SHA1
d01e2c83a1954d27d5b398a6cd6e0e971baa08c4

SHA256
3cdaf068805acf6d96206de9b5ac29af25ed9672061b0befa143ba592dbc06c7

SHA512
5de7b9190bb47a6535d8159ea7471b649b02778d7177f973ddf0fb9d2c485ecd562041fa937b2451a9d67982dc32ef39c9fd43297f7c861461617529db6a9c9d

Download Submit
/data/data/cn.com.qlwb.qiluyidian/databases/qiluyidian

Filesize
4KB

MD5
f2b4b0190b9f384ca885f0c8c9b14700

SHA1
934ff2646757b5b6e7f20f6a0aa76c7f995d9361

SHA256
0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514

SHA512
ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1

Download Submit
/data/data/cn.com.qlwb.qiluyidian/databases/qiluyidian-journal

Filesize
512B

MD5
9d43f8c2939dadce59f8913807605fe4

SHA1
b8fd82979453ff677f1e32a1c57030090671d526

SHA256
531e5f1a05f8da891f2f6484263cb06b22fd164b34d0905a4d7e5b760358c7de

SHA512
8ed018aa3b6a89ecc59d656c6b51ace5d27c233f32a08e052639b293b9fd4c219e2de4d763321affd81f5f796f914757d6060ebcd3108d5861498902454bd23e

Download Submit
/data/data/cn.com.qlwb.qiluyidian/databases/qiluyidian-shm

Filesize
28KB

MD5
cf845a781c107ec1346e849c9dd1b7e8

SHA1
b44ccc7f7d519352422e59ee8b0bdbac881768a7

SHA256
18619b678a5c207a971a0aa931604f48162e307c57ecdec450d5f095fe9f32c7

SHA512
4802861ea06dc7fb85229a3c8f04e707a084f1ba516510c6f269821b33c8ee4ebf495258fe5bee4850668a5aac1a45f0edf51580da13b7ee160a29d067c67612

Download Submit
/data/data/cn.com.qlwb.qiluyidian/databases/qiluyidian-wal

Filesize
20KB

MD5
2c39bed10ef2207f8f42d4b67c3aaa52

SHA1
829c2f8adafbd5edaec3bc547ad88c2bcd753d68

SHA256
fac343a04cfe890bd6df2a8e17f51c0e29bcbd0ba3466ccedc2f8c15c28a5823

SHA512
e5165912f68058e5eaa2b6eb9927d0399103b9d2524be3e33ae4568f4082f6e72f0c68cc1a0862e9bd152ff0b8e48a829449f28de393a22467ea7efc4fdd87d3

Download Submit
/data/data/cn.com.qlwb.qiluyidian/files/init_c1.pid

Filesize
89B

MD5
ead10624f1cab69ab1ee13118b60178c

SHA1
ebd1068203088fc15e28695bf096788e4935fe4f

SHA256
3139411cb66e8472eb6cf46bc0d544cd06c3b7f8d1bda42536dc4b5d06c3674b

SHA512
56901469a29b79fe065a3f24ce18438aa0a5344b55c12d2d80eb35e712f644f66bbdc8436262ff1c6d57d9303d4cfea4001c2c7201e3b43ec48be2293c6066a1

Download Submit
/data/data/cn.com.qlwb.qiluyidian/files/init_c1.pid

Filesize
14B

MD5
e4a34329a7839ed45f821098f7610178

SHA1
dca92ca0beebaa2b858f3b1f0218c29bae14b6b3

SHA256
febbda6a72c075354b29c9c38ea655b96dd46aabaddcddf1576dda30d5b47c3c

SHA512
8825f2ad276474e1b5e200032ceb98a9578ca935395b2f8ebdfbf2ec9fadd32fce53b6b901029a571cd86c29a127975e2fb9a9ad0d52fef30f4296588cacb048

Download Submit
/data/data/cn.com.qlwb.qiluyidian/files/libcuid.so

Filesize
129B

MD5
73b3e433321b97613bed1715bb9cb419

SHA1
c8f4fba315c888ab4c0537f3666ed674084a7daa

SHA256
5fe95ff073da21f87c47ac14f42e36930c813c5292ca94c409266ac7b06af4c6

SHA512
941f41209cb0561d8773f7b996743b63d8c827f78500e7c173c8f2a1e7a940517ebdfeb1224cf6cefbe78103df4cdef831a918365052ec5fa47a10e90118b77d

Download Submit
/data/data/cn.com.qlwb.qiluyidian/files/ofld/ofl.config

Filesize
235B

MD5
adb6ea341c999dd0256edc09b54995d1

SHA1
c3e7946502c384626b5c1b7f90ab076afd99052b

SHA256
220861bef2ac2282ebf0579a778ab1ca5789ae7960d88a0cc85d8ea3ee40b3f7

SHA512
dfe6fe9fee6bd3b76fb1f15b3500164d57f1b92166eade9a7a608678523314a1a3e1899415f2bd810aae661b66029ad1f86ad1bca654edde28553c583ee9370a

Download Submit
/data/data/cn.com.qlwb.qiluyidian/files/ofld/ofl_location.db

Filesize
40KB

MD5
18c7bb0873905fec4212a3a04db19e16

SHA1
a1628f978ab635858a054f94b7ed34fc1fc10322

SHA256
c9fe30cd3fc827e210f402dd7ba1b453a337c3295abed5ddbbd71937c858fc18

SHA512
53ec7e56c71b155abca43f82187eb4a3eca701655f379f5d2fb7da09a66c75348c5caaa4d4f5161359cb578537328e5cba38e2f1defd1b91b18d4c91f6b2cc28

Download Submit
/data/data/cn.com.qlwb.qiluyidian/files/ofld/ofl_location.db-journal

Filesize
512B

MD5
38b1815cc966a86bcbbded1ceb7ea5f6

SHA1
8cd456a33bb419d5e554edef236ad7cfd3853b70

SHA256
001a8a5101e094123cd3fab4bf26f772577979573707d344a0d90c597a92ffe9

SHA512
19436187ad13cccff7599c2282563862e2a4750bacfd83dd136f8e68e1e186cfe32508d3369d4443b7e89d6b2f36c48c36923864d2ba76fc618b1946a9f269f4

Download Submit
/data/data/cn.com.qlwb.qiluyidian/files/ofld/ofl_location.db-shm

Filesize
28KB

MD5
670d8bc46551c40a1fb9ff8ec4b72092

SHA1
82253b089122b4d8c7ae61dbbeabd9d037ddd49c

SHA256
ca2684e4da544d08c906c70f147d8dbc91da3a7972d255e6a00e1c99419f78e2

SHA512
4977d35230c533e26162cb0e4da38345a23a87ff41510685e755a52152fc78d0b027e8e8942fe10ae28fe332b16bb9a7ba0c0644ec0efd635d579515c3d5df67

Download Submit
/data/data/cn.com.qlwb.qiluyidian/files/ofld/ofl_location.db-wal

Filesize
48KB

MD5
248946b409646709b0c1ae2b28b61e49

SHA1
ac547137f07746dfca747f556b15eef3242bdd36

SHA256
a823a80e3b03261c1d9c1dbbd5f6033094bef67e5d45fa8dc55745bc56468335

SHA512
5b29c1d008b66f03ab6f7a74cedf92559f0ee92e07cdd90291c235c3d146f064fed313a2d0101bd7982f81941cda7b9394db218aa01c3f086cd901c10450fa1f

Download Submit
/data/data/cn.com.qlwb.qiluyidian/files/ofld/ofl_statistics.db-wal

Filesize
112KB

MD5
328227f25deb1c9930b3eb5753388c20

SHA1
d966d41e326f860788179027f239be75a6f6531b

SHA256
6a04f04939c05d4c39012a15a7c62004f630c57f974579ba42204ff60fc0ab54

SHA512
ab49cea98c63fe17fe473a05073fa204e3bb6a928aa1f6cb0c4156719a056b59fdce31dcdb31dc2026b486621e142dbec6bcca98b3a8470ba3c012511d73db82

Download Submit
/storage/emulated/0/Android/data/cn.com.qlwb.qiluyidian/files/baidu/tempdata/conlts.dat

Filesize
12B

MD5
8d80bc8ea90e9cac010d3ddf97bda5f5

SHA1
f063bc0d356e6ba9ab1eb9a851131ffbefd8fa07

SHA256
f52db31332534833414abd5e870f78c810b8ebbe5b134bbf599506beecfd1b93

SHA512
9ea732dd572a9a4ba91b70891972230a09576687ca1bc19e62d5a98b5b84e0f2ae11985108008bc9fbccf357219b8bd3dbf146bb70752f618f70dc5d0c46a7c7

Download Submit
/storage/emulated/0/Android/data/cn.com.qlwb.qiluyidian/files/baidu/tempdata/conlts.dat

Filesize
159B

MD5
254b501bc78f59bc997206e44a702dc6

SHA1
273b9287f01c75286efaeaa515b491401b3b8f71

SHA256
69a4e84a7876c2ae57e48ec9c0fb51058c3425486d052ac620a6e193429a9281

SHA512
abbfc5199cfdd7198b86d0789fd3265dd6dd6981f6f396c570d1399366555c0ab6bbd3b499a6ea440050b1ebc60e8ae919ccc33290461e3f21a51432a7e8ea04

Download Submit
/storage/emulated/0/Android/data/cn.com.qlwb.qiluyidian/files/baidu/tempdata/llg.dat

Filesize
24B

MD5
161557b06b4a4d3ce095528dea370eb7

SHA1
8bfe9c4d916fe58d856b5a6ecaf8cd9ea4df2c9f

SHA256
f054ef19481234ee5b2db1d1c681839dab235a857ed3a4bc02efa8f785f478d4

SHA512
96ce8aedbdbb387438efc86aaabd13a6378628bfae203d2bc25ea1cd7daa6ddbd6dd2c81d631fbdc9b653a93011d3c80f0c085580275b683d5e0bce077e6e449

Download Submit
/storage/emulated/0/Android/data/cn.com.qlwb.qiluyidian/files/baidu/tempdata/llg.dat

Filesize
446B

MD5
2da20d9ea16496752ad01b236fd72706

SHA1
5a699f49e7e8dccb04b5fcf81955783d284ea1d6

SHA256
7bcc42bab7d180dfe7bfb5895d3d571f9d3a127635d22976f239c1ff95789279

SHA512
83dee1bafdb946dc43c233f0de8376189a937a27c2aa0489ffdb286e0fd544061340965931f74de8e51aed57ba04d5d8d4c7ddfdc984aeed1adca97c43f3d53d

Download Submit
/storage/emulated/0/Android/data/cn.com.qlwb.qiluyidian/files/baidu/tempdata/llg.dat

Filesize
1KB

MD5
e21a7b597f8b599b12ded276f4418acd

SHA1
093102556a99a0ac69985db641964f3bff0796cf

SHA256
706e21825cf6dafbb234d0690b6a0b823aaadded5728eeebcdbc5da232758701

SHA512
e45686f8df9c573c5cb22ec1abbbd75050e86b3db2f481afafd64471ee81dfb456561b76f2d9f956a4ade0feb2ae8e53f5a25c47986f21d9d98514bd99399d79

Download Submit
/storage/emulated/0/Android/data/cn.com.qlwb.qiluyidian/files/baidu/tempdata/llg.dat

Filesize
2KB

MD5
e1139e49b491d459d110b0d342aca882

SHA1
6be4e7621bc30d4e965fbc70c0ff1310ad7abd85

SHA256
4147abb8b93852e359e01978d9e9416896df4717cad1f3ba181b7b3c7b55de44

SHA512
56730681b40ef08bd98ec440167958ffbd99dce22b682b784f4052885058107cbd33c5083b476f34d159d5238cf86d9f1a1a20c8a60b7551ac69cf85ae1e9be6

Download Submit
/storage/emulated/0/Android/data/cn.com.qlwb.qiluyidian/files/baidu/tempdata/llg.dat

Filesize
4KB

MD5
6a7c4a081c8cf4fa54bfc172d753094a

SHA1
54ccc920a6558ee00ac1d263b736f235e4befbaa

SHA256
e517d41a60bbe759f2a929b5b9c597df126f6610f93fe8f5eed9c6ca237cf9db

SHA512
104df135d04a9c9015958ce0d7305a33b66013ca21cfd481aa468a8cd1be6ed765aa802e7fc8081db5db1f6f8d22995830c52d8d5ecf0b4b82b268d7456be266

Download Submit
/storage/emulated/0/baidu/.cuid

Filesize
89B

MD5
87fba37aced5bbf4c52e1d2cc900c189

SHA1
8cc378b68b7f316fd4d75a5027d64e137f51056e

SHA256
d875a77766cc63dca68a069345f4d7954347a1180b5546183d688f43925de1de

SHA512
43b2ba7afb658a0f8a5a5f28cbf2a375ef82208fa836d150100aa43803f38d554ade0ca5f49849d2479ed6281d55c683febe3f684863ab22ff6df2420b6b0756

Download Submit
/storage/emulated/0/baidu/tempdata/ls.db

Filesize
28KB

MD5
0d3e99204c6401ea499fe9e6d9855497

SHA1
09829f00ca458eab7374d5079393a2cd69a2348a

SHA256
63ad014cb50908591939d6a1536f85eece807425af4f4e8a1f9b9eeab13cc5ca

SHA512
8d9a50aa9abd17e508ed3ac35a3033e8f9e550d1088baa951f53e6c4697c5ac026d22b90e36e27341d64baa3f0202bd89ca97583e99feb25f8c26b5776c59c68

Download Submit
/storage/emulated/0/baidu/tempdata/ls.db-journal

Filesize
512B

MD5
ff8e5f4dab66c44951b59cfd26664427

SHA1
3eef276a0258a8dd43a0617138342372b6cc94b7

SHA256
323fc8b0dbe20c26b994e93bab599824489b22a12e6105d509b4de56f62567fc

SHA512
d63bb02bf7e715d7f12686737e9f58de3c3d9a4ace89115e2f6ac5202e59eac1857ed5b104c65e436521698cf05905f825a551881c2cfe0813ec9046b4e2d92b

Download Submit
/storage/emulated/0/baidu/tempdata/ls.db-shm

Filesize
80KB

MD5
2d070c07d1b99a9dc958fddfedb287f9

SHA1
4e73ceb449cfd07c9e5900f9488d32c7eeacb8c7

SHA256
86f17f3432a60eaebb9f48a61299fce4f9378b6a67c8d19e340b9179f37e0fbd

SHA512
efa22714f249878ab195611f038f042cb0a256f1461a705e4adea9e85885315662f3b2d22594f1861b39984ed97819c776e615d99240f391f5344def63e47d1d

Download Submit
/storage/emulated/0/baidu/tempdata/ls.db-wal

Filesize
52KB

MD5
507cc74543730d63ef733f2432e80b41

SHA1
02eafac1f1ac49f47f7d53e16b5fdb5c072df28a

SHA256
c90d4ca094c2db15402ceeb127efbcc211b3f750e72566df2ec631c0768157c1

SHA512
94e691c35bd92094918c794127a5b0f5c43e77f9639f7f39277648e95c9bbd985a3aa7e9e2fe7c268aeb5dc06a78f1c121400f137afd9ef69dc26e96122c4efd

Download Submit
/storage/emulated/0/libs/cn.com.qlwb.qiluyidian.bin

Filesize
512B

MD5
07e158edb17236fb2c18422ab35572f9

SHA1
709014edd5816d371380b62028e2d23d382891e1

SHA256
3701b636b4e98b49b94ef23d52d0f300386a4657fc1ed51e06e37b95b4e703c6

SHA512
51caf4a3ba67d0a841b5938832d19f05609688715f1ceb99784cf4392415e4e91e4e0c7741da231ba1d2ec4aa3083fe318a0860d5e157bae0e1b6425a9b1c4b1

Download Submit
/storage/emulated/0/libs/cn.com.qlwb.qiluyidian.bin

Filesize
40KB

MD5
bcbed2a0ccff7d6308328abb7395482d

SHA1
b902cbe388d827b49510ceb5e88463c197acf916

SHA256
7decd3916afed36795cbeaadbc86da2c99cf9e293a91a3bbd2a2360d7853a599

SHA512
39489efcc07dab4c256c4259c008c1930bf8e87b7427b377e5452ff64c1abe1311a18ca6cf359d04bf107e05fd786bef90aa908c4a2eb49f1cfc006f501be545

Download Submit
/storage/emulated/0/libs/cn.com.qlwb.qiluyidian.bin

Filesize
32KB

MD5
1c4274aa7a9a5cac8c6d1df71e4588c6

SHA1
abaecd685e01cc68801292e3dc7085654a22feba

SHA256
3f6cd5f480ae69859b7841450f3d032c528ba385ebf9f371b9c8fdc6eb4231be

SHA512
1adb95935798607bd36cedcd183924d3068f50097d017b278da7caee7771532b61ec3606f6189b6dec8426eb038fe40be75079ce35894b1a8e0d1d815261150c

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads