Analysis
-
max time kernel
2643146s -
max time network
165s -
platform
android_x64 -
resource
android-x64-20231215-en -
resource tags
androidarch:x64arch:x86image:android-x64-20231215-enlocale:en-usos:android-10-x64system -
submitted
23/12/2023, 20:19
Static task
static1
Behavioral task
behavioral1
Sample
88643916b39fa7340be73e68361d5e73b674d0f8ea17de7a3739c7e94b3e073a.apk
Resource
android-x86-arm-20231215-en
Behavioral task
behavioral2
Sample
88643916b39fa7340be73e68361d5e73b674d0f8ea17de7a3739c7e94b3e073a.apk
Resource
android-x64-20231215-en
Behavioral task
behavioral3
Sample
gdtadv2.apk
Resource
android-x86-arm-20231215-en
General
-
Target
88643916b39fa7340be73e68361d5e73b674d0f8ea17de7a3739c7e94b3e073a.apk
-
Size
17.3MB
-
MD5
77b90396810c6b5cc7f8f20b758e7f88
-
SHA1
423cbc2f4790ea78a105c74dc39bae44cf2742da
-
SHA256
88643916b39fa7340be73e68361d5e73b674d0f8ea17de7a3739c7e94b3e073a
-
SHA512
130544102eec2a294cf9a51e67c41d30683cc58f4b1364ae9ddb0824a494338482f833277233bee931d1a890d64b393b231d84cf0db778029114b4c4c6e71f0f
-
SSDEEP
393216:JZ/PKAf5Jj6SmegAYnMZNWL6jaU1YZNWL6jaU1a/LdR82YUgR:fKK5wpdMn4SYn4Sa/LI2+
Malware Config
Signatures
-
Requests cell location 1 IoCs
Uses Android APIs to to get current cell location.
description ioc Process Framework service call com.android.internal.telephony.ITelephony.getCellLocation cc.ibooker.ibookereditor -
Loads dropped Dex/Jar 9 IoCs
Runs executable file dropped to the device during analysis.
ioc pid Process /data/user/0/cc.ibooker.ibookereditor/[email protected] 5076 cc.ibooker.ibookereditor /data/user/0/cc.ibooker.ibookereditor/[email protected]!classes2.dex 5076 cc.ibooker.ibookereditor /data/user/0/cc.ibooker.ibookereditor/app_e_qq_com_plugin/gdt_plugin.jar 5076 cc.ibooker.ibookereditor /data/user/0/cc.ibooker.ibookereditor/[email protected] 5339 cc.ibooker.ibookereditor:alarm_service /data/user/0/cc.ibooker.ibookereditor/[email protected] 5353 cc.ibooker.ibookereditor:remote_service /data/user/0/cc.ibooker.ibookereditor/[email protected]!classes2.dex 5339 cc.ibooker.ibookereditor:alarm_service /data/user/0/cc.ibooker.ibookereditor/[email protected]!classes2.dex 5353 cc.ibooker.ibookereditor:remote_service /data/user/0/cc.ibooker.ibookereditor/[email protected] 5690 cc.ibooker.ibookereditor:channel /data/user/0/cc.ibooker.ibookereditor/[email protected]!classes2.dex 5690 cc.ibooker.ibookereditor:channel -
Reads information about phone network operator.
-
Listens for changes in the sensor environment (might be used to detect emulation) 1 IoCs
description ioc Process Framework API call android.hardware.SensorManager.registerListener cc.ibooker.ibookereditor -
Uses Crypto APIs (Might try to encrypt user data) 2 IoCs
description ioc Process Framework API call javax.crypto.Cipher.doFinal cc.ibooker.ibookereditor Framework API call javax.crypto.Cipher.doFinal cc.ibooker.ibookereditor:channel
Processes
-
cc.ibooker.ibookereditor1⤵
- Requests cell location
- Loads dropped Dex/Jar
- Listens for changes in the sensor environment (might be used to detect emulation)
- Uses Crypto APIs (Might try to encrypt user data)
PID:5076
-
cc.ibooker.ibookereditor:remote_service1⤵
- Loads dropped Dex/Jar
PID:5353
-
cc.ibooker.ibookereditor:alarm_service1⤵
- Loads dropped Dex/Jar
PID:5339
-
cc.ibooker.ibookereditor:channel1⤵
- Loads dropped Dex/Jar
- Uses Crypto APIs (Might try to encrypt user data)
PID:5690
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
485KB
MD51da618896802fdb4b6f17c92703424f4
SHA1b48aa81ac014a5a7f6e95e618e4f951ee12d34c3
SHA2562cbf986b5e1357e00347d75d6f631539c0f368208079df36bb44603ac4e6973f
SHA512620a06d8df24597467318582a12bce45e2e2cb66069ffbd6fa27ac5a164c58398ddb9c2348e6ef443272a22ca85fcfa03439d0f0f22109a93708d562e0737cb6
-
Filesize
233B
MD5a58c0f43db3fcf7449b121cb0e357014
SHA139530ba5eaa25c3e35afc13c9bce21a50c3b6885
SHA256585a8dbae3a94c2f8682d8c60cd5e7882b1c372550eef6ffa0ff13db310ebeb6
SHA51214530a138998341122574fe001432458f38a8498344334982e4894c227c88e333c57351623e959590aba4b3b919b2face51c95f2fb6877ab62ea00284639e0a2
-
Filesize
468KB
MD56bfe094580c89ba696ef8772de47a552
SHA1210bc4afce84b6e6bb36f97f68f9d3d9d3432643
SHA256a884e386bf4ec066c9a82518c354be513182add87107552b1f4cf33dc80bddd4
SHA5127ae8c9210957f06eb177fa0472ac1fcf80f0e6b1f308ec1906fe059c38623e404b37c34d9e8702cab66efc7ebfdc5400f1506db89b75a5fd1dd915ec2c2086a5
-
Filesize
180B
MD571f1fe7ba0e414fd233f7ae92e328803
SHA1b42aeb1be13ab429f0150c50351d43af5c17d99d
SHA2562766621a98b9c58bf7131ae3658dbaf36336b9b893b2325877550c75555cfbba
SHA5125939aac6f0cfb02c5ddbe5a4b26627c1bf7a82421c7c6d269a9fc2b4bea6f0e9920f103e685d60fbf7da5a4ea96f7411f26f3a3b24fb03cd78ad3ab3a74e8a09
-
Filesize
4B
MD5dce7c4174ce9323904a934a486c41288
SHA1e117797422d35ce52f036963c7e9603e9955b5c7
SHA2560c030586945fe504b604ecc2e875c38ede400cd5cd73da9730302162e6b02c6f
SHA512d570ab6a8f4a7b54d426b0481219074b5277ace37d88438d87ab97eb387938eca1cf7b09fa42d596c56ada860710d2a7385d2a96e1cedff58ad6ed8900f1b143
-
Filesize
12KB
MD5ea628e04765adaf4238a5dcdff4bbd51
SHA1a801947619ea8c368efe9c006a324dc6339ac60b
SHA256885e337c2156e4dbf2176a9677ade50418740532d222ccae5ad4aa371b54c6a4
SHA512c0287b0e7b690a7231a37d1745c49f3d861b22aa65dd769ba6a8b5ab9da55443f749957781ee05a405019c39e1be45d37a971b821bffd62a1d5620bc39119abe
-
Filesize
512B
MD5e6a298b3643ae3fa0b9cc89752be885a
SHA1ec5c6bfb87367e39b612b1319b96eaaf74d47eb5
SHA25649b3d4a002c3e2723d44c3748d19793a931a3440579af83196551a915e732c99
SHA5127ee187f7070be213886df70aff540e22f4006e6f7e120ec54600494b1179e8207b4f0219a8fddcf045a3960d66de7e312cfd5d6ac5b2dcb787e29436202815b1
-
Filesize
8KB
MD5be40e46da264290a693f8597c40e5a7f
SHA17ef28fbd424094c9f185ad8881cf25359201c4ea
SHA256674830eac1b5638aa5c5033e5eae12ea70e1d984e740e067bd4911aac2b56792
SHA512eb861a22887c9efb754504a1ac72032685ade1ab2f91dbb3d9cf65fbc7e50b47aecc1c8270a7e3e98be4d3033db8239a6a2d9377b87a49fe0df7897399939193
-
Filesize
8KB
MD5c31fd7828c578615fe157e04c301929f
SHA1db69ad5dc04da2788118014d81e1d0b74c92ee05
SHA25625f71e95da05666bd4a17b3ed664602ce2e791abcaa3d74d434b9683cb97e9e3
SHA512d8f454629c22c20cd9e8bb89a6c4494865572a76b32a21981e7f0c5fb2d2ba94410e94a27d5ad072df7d16296ed734a17e69a32e897229a83d36979588f8f679
-
Filesize
12KB
MD54a31656c7fc276d757cf2d39ba2ec757
SHA15fd954d6d3542a11f32ddb89b5896f69158b89b3
SHA2564b9edb96bac859abf39b60e1ee1f03f724a6903a37eafec10a40378285a65a08
SHA5124be982b1d94b55800e3ea8a29500bb977f5cbac0fedd6166becd25b6da34bea7f1750af73d4e2d7393c5520c49ec2413120e696859468886f3e4cb6e34e8a1bc
-
Filesize
512B
MD5125b0bee176e0036b46b3bc0245de3bf
SHA162e982b19df7fb05ff18bb11519674749c11286b
SHA256a0edc9e9edfd5fd7c75ea2f13facfe4fd53e8ed0fafcd668410405c71c028929
SHA51226badee16d68320e88c44e7ca55a967ca8af56ce61a0c200d15a03b64e35a290ef6ea4be1dee729c01a77c0087297572295f4db1d3146c2932534b5bbb5aa874
-
Filesize
8KB
MD5bda60cab89bce55983873bd0b0582401
SHA1a26bc59d3272fa4c0a27f46c18e61fd74b7db220
SHA256d5a42c7f7618a7b3116588044bf98848c7200e4003165fd46289dca5352963bd
SHA512dc8433a409dc5a5bd8900afe6e5b4f6e6b5737e326ab7779a518f490dc122cae9ec467aae657932ff0c43b8b7e5b4f6906934d50c0a08d1204564db88d3aaf95
-
Filesize
8KB
MD5228fd8f17c6875a08153ef30c804fd97
SHA12cfecdb749f09b6b99f9a46185cbc6068aa50d03
SHA2562de48d3f635ae7fd5a1f4319ece4ca59925187cbfd825e83f810e15f423fbb13
SHA5121f213c546a209bbcf470e61cc2e25314c5ad9b03d2eaa66a00be90259196172ebed1d877e8cf6bfd68f3c3b7431fb59d8dddad4082659fa98c31b50454ea4dcc
-
Filesize
12KB
MD5163b0e3f017becbc89b9d7f330b78f09
SHA11ef9cd8ac8655190468d0ccece0a4738634ab0f9
SHA256cf01452c3b494692386f6c5faac340eb3eb894bd416391002d56645aa8a9ea36
SHA5126a85a30d16fa58a4fbbb05d469778ee69ca79deaa74316ccb5be3ee07fdf78dde22e95db3edb1b88b18478e8747047445f85baaf9556b9a1e55d9a02a80baffd
-
Filesize
512B
MD5c0c977ac3d12e3b5e6190021ac0f3192
SHA12341017ba5d6ea8eb6b3a07f107e43a8b4cb8426
SHA256ac293738094750a8b7c80c79c74526bfa0e6aa7b2834144a1795d4e138b088c3
SHA512de20f41f033cd873ad8a231f6b78d01e549d7e371c63537630431a037fe54371d642a35afc2119aae34a152937cc5c21b0b6dfe82a6a8d6c86b1843e8a7a24bb
-
Filesize
8KB
MD528a18b131a891f2dc0f4685a275d82a4
SHA10d7a805cb07cd208c83be3230ff6b6eaf99e685f
SHA25652c23a9897a608f332d101f6470579243b5994a59201aac1c4f20ed46d7bbed7
SHA5124ec5f6c1746e09bf0990e47d12c2ece300039d700a98d32f13f1724c9c5c3d0e03d880925658cb670beb1072eb075930575879184840cda54ab74ae95cc17073
-
Filesize
8KB
MD52374f30d80e0bed667232c3c2f5b921c
SHA18677cc79db9320db7d9d2897b70f551f18d10045
SHA256277920eee5e4b4b5f42066276961d95fc26983ce5e115eefa33645fbadae7aed
SHA5125d38a66bd38c03c5be4ce70c854e0b3add53fada5f461b17852ec1dd341a2b5e781b3737eb7cfa83d2b50f62936bfc0a9c158c78bb319a271343241d9b1f6105
-
Filesize
8KB
MD5db63d48bcf0d2d90ee5cfb5d7c06da7b
SHA180c355680f8774c0d09ac7edd89f6a97a48af105
SHA2562f9446746c9433ddce6bca60312730c318d1906ff225a9901d52c1d116f00637
SHA512d757de5c77d20d97bd71fac7eac7464d742bb4b4a22b8b6643f67a93b35eb8c0d2982bca81a6cd615ed97221f8ff1fc40dd173d3d2d5c20b64f17f0ecd4df878
-
Filesize
512B
MD581dcfd7fb1f4da1f1557c4d1b847567b
SHA1479117480d3a333584580d2b0377f07353d2ca26
SHA256fe3f85ed39fff93e80a3860803ded2e9bc37a43125137a285a323a83b0f88d15
SHA5121d2bf712b9d6c9027a9b7e0c279551c2dd1f69e73f90cb7b07156d7633cceee0d2cd8a098ca8a9bd34059ee32d5f5f6401a611c7a791e816559b962b3d9ef30f
-
Filesize
8KB
MD51e9d16f7d25c8f4cd0af826a49a23bcc
SHA130af657ddf98006230a1c98a67a93c00345a2295
SHA256999e2a13be8cade0f8bcb09c006b7de3fcfd690c7480b26dd429aab25ed5b02f
SHA51207a12dcfcaa86c2a876f34a97870ff71a924b6bf00afa5d6b95eb661534ef1d385f6c9d1aefa453cac67a2826e8d009d66fce60651cf8c986ddc7461e0d0a06b
-
Filesize
8KB
MD53fda09068ed6a32257f248c0eaa6cc54
SHA15759995ca938c8ba4250c21f74f65a2cedd1b95d
SHA2568381bb9c183b0ab749b342b1374e5214f38da59d35174704bf1a4ee721876a74
SHA512a9aa1a4eb8bd19ae98dfbb0fffb00a7913de5d9895aae96b1e482d872c5a3542e9001c6163579a76272a297cf4b53e4b409850dd6370025675c7826c456ac4e7
-
Filesize
32B
MD5c3d0ffc5ebc468f603ec6d6665480687
SHA17baeabf6b5bdefe8fd62bd49d936bf36c8adca52
SHA2563ad97c6deb5b74270f3e4af448b0aa91b322a1eb015fa4169c999dc4de515b03
SHA512e6feb49bb7628da0021be7db5f854904cf6ed5630c54fdcd0c6bdbf63dc5ac63cc66a508b300370b099ab2b6990dc234df9e06083eac9a60803becd3c659856c
-
Filesize
512B
MD532436c843d7bcc8ad6686c38795ae9a2
SHA1a6ce8dca47a6cba6df7d2e7d6cd8b17c32356898
SHA256badf081c814de6758fc01a8fe32a6e00006c66f88fb2e4ed72fea8f24e72df7a
SHA512767193d1935e571a0b67d43bca7738e51636225046dd55228bb288cd389c0d09672b677a70c5b69e1e972a4956707a891614cefb7aa69fdb6f59152c872ed5d4
-
Filesize
340B
MD581e9cbcd941fc05580f963b197db26a1
SHA1d1b524212a6c5f874feb49b028ef139818f67e60
SHA25640929e8d0dd0959b041b622836d36d1641cc99399cab50a665e16a58d2549ba0
SHA512be18cbcbb282edd6a995b93b498a5bbdd22a588cff19440a911f9ae0030bb94c2025cc85ecf7329c248164441e99b994d9d0d0ddb49fc87d693dabd471b9d23e
-
Filesize
32B
MD5d48bdaa5c7a42d37252391bc7345cf12
SHA193228220ee43b4129e89425053e2c8880bec6345
SHA256ebaba9fbfc66bf18ef17ed156cf656b7b4c96b14cf5035accf8da9001c17ce8c
SHA512e9936930a8658cac109830e2a756650444c2e58f0da25a2b27a2a782414305612571b5674df9903cf3a0b1d5bfbfe6a36f72b99f11d878097c8326acaf99debb
-
Filesize
314B
MD5481bd78778d9915cb2dc2b0081b64792
SHA14fe50ea8e0e3a4429cb36bb7a2e640fdc7f01271
SHA256932dd9d62151055dad1620a12a7d0249aa264562960310d018bd8b1d5ddcb246
SHA5125f9d5bf879ad5ae8a3c658d02519511268f7850f40b00f8584aceb5fd6d35690f1974223776636edd0304b2b0c4b59c175d8c1ac20152fccf36fc5f906bc7d36
-
Filesize
32B
MD5448e391c59eef34ee1defbe4dee4c41f
SHA1df1f890987371d7d8e6963c68b787856e42bc146
SHA25655612e17689f4bb05f27e18b4f6d06ffef92a6a8893a5cfdd3d5b99a6028b549
SHA512ce336ce895ba861dda7da27e8869dea065eb3c3403cac55cdf1935409e5ebc95b495370f87ed7416af20af533b15615472e333ae9f2fd2713040f526835399b7
-
Filesize
27B
MD5738b60003a0547492836909b36205750
SHA1d98f78ae5c69f4d26b19a246d8958705f50ca6f4
SHA2568b3ca536deb6e12c4d6ee47193e7dec1996cbf40cafa8deac513bf48cf4e0850
SHA512051552955ff5e193b5238230edd0f16521477d98da7c79515ba3d60cc239673b713847ad9630c2dd43c38856fd3a3b3aba0fa454e9f58663758b15e2f515024c
-
Filesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
-
Filesize
314B
MD52c26844b80fa19cac9ad9e67160ab449
SHA1d57c3aa20018f6e9a6a26a7ae9ad27dea01f0af9
SHA256f01bfc9782b94393eb5fc82978238d73009c8d631827cf0651b50592adf8b113
SHA51260c8f8a65a56b08f3a9e34f1cf8ebc2305ea95369e67ec7deff1aa552565a341acbaba8f3c2c96191eb4e68c0640b8eedcb64a3949638061fb6d720bd1e44d6e
-
/data/user/0/cc.ibooker.ibookereditor/[email protected]
Filesize6.1MB
MD57c86b0b1e78ae96eaf90959f01a276a2
SHA1b9bd1590caf68db42c14fba4ddcffa97eeec5221
SHA256dc2cfbf72db8f1a2d415184b2d3d22d5b62448c93bec8ac38472580c9151d199
SHA5120124b9f0c7b18dd3a10fdd2a1c2ff02281c8050d266b0bef00965be5845c290d478ff367dbfcd559635439624a5d1158c7ee8d3007a37ec086474a648848441b
-
/data/user/0/cc.ibooker.ibookereditor/[email protected]!classes2.dex
Filesize3.7MB
MD5e76c4a5b931ff5634a6a6691d89d3dcc
SHA1385e4afcfe19c4aa48ceb51de7f7e66461c880e9
SHA256d2cc66436823ecabc810948411ccbc58ad8f73fea89870a024404f4e4c38bd2c
SHA5124fc37611c9aa89dd782da672373cb24fd55ac0621413fd649ac752f67fd46c9eef258669ddad7619d99bd851f51563d76219518a969e8887829777321c1b1041
-
Filesize
796KB
MD59f03083b3faaf85ae204f9ba7d72ea20
SHA1436601a861d1c0c6e61e0fa8fb83671fb88f4d90
SHA256e3d665d63e435195a25726c68da20d322169c157304f7d6963bf02a7dc28ae58
SHA512e42ab94d65b52fe006197fd81ef55251a2ea6b922bc92e47afbf2a7e14fc84685b112831bdc964cad5bf97f18b4492f9d51d5f85d2e67480a6401e5a9ae1343d
-
Filesize
111B
MD508ba94583b4f56d5519c801fcb5814ab
SHA122d2d862a917d053852cf6e5de6103412e9dd14b
SHA256b8db1e401e87cf126be78cb11a2cb33de7a75f893ac9221b362861c3478aa4c8
SHA51201e86e034d60316fbd3d4ac1de789ef520781aac95a7f2ce3ee7dfa3e887c490d8097a9cbb48f9eb2c59f6447a0a8a7568e888fd892a7961a55169b780104b5b
-
Filesize
213B
MD51edb2b3327a55f6ec33abf2eeb6dfb05
SHA1edf72d93ce896fac71fc474395a374586b06cfc1
SHA2563750604eb11a72e131f3eeb60743c5e01b1a9397f6141197905e062862674fc9
SHA512ca50c131a57727737cf92d8439f508205554858b568bce68b349a0cb9504f707b80e734d9bc488c76f8e201fbe119c3167b031ea6023f9d32538b3866b528833
-
Filesize
65B
MD59781ca003f10f8d0c9c1945b63fdca7f
SHA14156cf5dc8d71dbab734d25e5e1598b37a5456f4
SHA2563325d2a819fdd8062c2cdc48a09b995c9b012915bcdf88b1cf9742a7f057c793
SHA51225a9877e274e0e9df29811825bd4f680fa0bf0ae6219527e4f1dcd17d0995d28b2926192d961a06ee5bef2eed73b3f38ec4ffdd0a1cda7ff2a10dc5711ffdf03
-
Filesize
111B
MD52f9e61863cbb45a03b5c26bab857607f
SHA1249c9b944962cb16fa612cdaf4e44ee4957b37d1
SHA25613a5f3893ac6abc3aaf558d6c06380a517cda9d99762ac09ecd1f2f500286123
SHA512e1c84f0b681f2e004a4828e1d99fe8627a0f71df1341abd07cf9c833b7969383a00a0a3e5b77ace35b6e971b2ebb97d826ab333c0f777a0d9e0aa4fed5e1574e
-
Filesize
167B
MD5d7e8037e2a2fbf47760962575df2a224
SHA1fcab36d5da9f4fdf96ef2ac94bfdcbc727d7f758
SHA2568de59f2347153b2921c1f11930df80792cb31dc2aed2cbe19f06e4ae4a0cfcc0
SHA512533a9b325cb4e794ad86c368a6f0087c1e3a0ae3f8dca12fb26dcc4cfb3bcb2d48807efc00d4a239db0437d492b4a46410bcbaf0ce480616862690c94dca2437
-
Filesize
48B
MD54c4c5285293d5141f582aefa4e038669
SHA1e01852a72e5a8e6f7d63a21426b515118196047b
SHA25636c5c63f39ddf7a6a9c01946e4f78b95790aa734176802e793e95724a1b5b731
SHA512097aa673273e307f7bfb7c08861ad389d4b5f7fae55d972a5c1636aa66d0b8d23b5eb9b696cefe0e5b942f23969dabf0147397aeca85fb9a4d75e0473104e399
-
Filesize
32B
MD575a040226748a2ad6b89dd75b20bb0bf
SHA1ecfe440214b1c9b63f1ca6c3a7f8246234c1ce73
SHA2560a4a5e2d23c3a892341c1486f55b6276eac71ee8b684164a72be0f603e21eb9d
SHA51298f2f6a174eeae18b59343bcacd3b7b78e66fd6183f93e15852f9b556603f1740aa7c84d2ab8ef102022b2532ac5ed306c62dd75631e035f7e135c1fc9c09cfb