Overview
overview
8Static
static
689f1435a5b...77.apk
android-9-x86
789f1435a5b...77.apk
android-11-x64
8dmss_v2.apk
android-9-x86
dmss_v2.apk
android-10-x64
dmss_v2.apk
android-11-x64
dump.apk
android-9-x86
1dump.apk
android-10-x64
1dump.apk
android-11-x64
1dynamic.apk
android-9-x86
dynamic.apk
android-10-x64
dynamic.apk
android-11-x64
Analysis
-
max time kernel
2645891s -
max time network
172s -
platform
android_x64 -
resource
android-x64-arm64-20231215-en -
resource tags
androidarch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20231215-enlocale:en-usos:android-11-x64system -
submitted
23-12-2023 20:28
Static task
static1
Behavioral task
behavioral1
Sample
89f1435a5bb09c694ff4279cfe326b78559b7624c0814f02f75c049e73f99c77.apk
Resource
android-x86-arm-20231215-en
Behavioral task
behavioral2
Sample
89f1435a5bb09c694ff4279cfe326b78559b7624c0814f02f75c049e73f99c77.apk
Resource
android-x64-arm64-20231215-en
Behavioral task
behavioral3
Sample
dmss_v2.apk
Resource
android-x86-arm-20231215-en
Behavioral task
behavioral4
Sample
dmss_v2.apk
Resource
android-x64-20231215-en
Behavioral task
behavioral5
Sample
dmss_v2.apk
Resource
android-x64-arm64-20231215-en
Behavioral task
behavioral6
Sample
dump.apk
Resource
android-x86-arm-20231215-en
Behavioral task
behavioral7
Sample
dump.apk
Resource
android-x64-20231215-en
Behavioral task
behavioral8
Sample
dump.apk
Resource
android-x64-arm64-20231215-en
Behavioral task
behavioral9
Sample
dynamic.apk
Resource
android-x86-arm-20231215-en
Behavioral task
behavioral10
Sample
dynamic.apk
Resource
android-x64-20231215-en
Behavioral task
behavioral11
Sample
dynamic.apk
Resource
android-x64-arm64-20231215-en
General
-
Target
89f1435a5bb09c694ff4279cfe326b78559b7624c0814f02f75c049e73f99c77.apk
-
Size
6.8MB
-
MD5
7dec116656c6088013dd8c1751887585
-
SHA1
87626c9a2fa1ccc4e7aa810514572ba05d3f0d13
-
SHA256
89f1435a5bb09c694ff4279cfe326b78559b7624c0814f02f75c049e73f99c77
-
SHA512
9b4fe4f739a18272e55a9fbf4a2bd0642f738621fa27ced0797f0722bfdd84550ebddb2575a9e91b29c6689ca4fe036ea60dc8a34c8678c19a95a6df8e060a78
-
SSDEEP
98304:Gr761NF7mPgOA0bzmrxQuB7MmNnt1d/AYs/I09XfbCFXruTcECHD+/OxN566D6b8:GrsOtM2uxMGwJCFFZ+/jqguPF
Malware Config
Signatures
-
Requests cell location 2 IoCs
Uses Android APIs to to get current cell location.
description ioc Process Framework service call com.android.internal.telephony.ITelephony.getCellLocation com.qihoo.appstore Framework service call com.android.internal.telephony.ITelephony.getAllCellInfo com.qihoo.appstore -
Checks known Qemu files. 6 IoCs
Checks for known Qemu files that exist on Android virtual device images.
ioc Process /system/lib/libc_malloc_debug_qemu.so com.qihoo.appstore /sys/qemu_trace com.qihoo.appstore /system/bin/qemu-props com.qihoo.appstore /system/lib/libc_malloc_debug_qemu.so com.qihoo.daemon /sys/qemu_trace com.qihoo.daemon /system/bin/qemu-props com.qihoo.daemon -
Loads dropped Dex/Jar 1 IoCs
Runs executable file dropped to the device during analysis.
ioc pid Process /data/user/0/com.qihoo.appstore/files/sllak/opt/4620/finalcore.jar 4620 com.qihoo.appstore -
Acquires the wake lock 1 IoCs
description ioc Process Framework service call android.os.IPowerManager.acquireWakeLock com.qihoo.daemon -
Reads information about phone network operator.
-
Uses Crypto APIs (Might try to encrypt user data) 2 IoCs
description ioc Process Framework API call javax.crypto.Cipher.doFinal com.qihoo.appstore Framework API call javax.crypto.Cipher.doFinal com.qihoo.daemon
Processes
-
com.qihoo.appstore1⤵
- Requests cell location
- Checks known Qemu files.
- Loads dropped Dex/Jar
- Uses Crypto APIs (Might try to encrypt user data)
PID:4620
-
com.qihoo.daemon1⤵
- Checks known Qemu files.
- Acquires the wake lock
- Uses Crypto APIs (Might try to encrypt user data)
PID:4660
-
com.qihoo.appstore:critical1⤵PID:4834
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
28KB
MD5c61303b02e060857308cde5514e08a1c
SHA19ad74aa36272e332cc27a7432b7b7e739136afc6
SHA2568b7c89cb3a969d6dd2bd30e05ef5dd2fab3ee87facd48a90057aff12b9c57f3c
SHA5126d4c2e3e3cebe852a8f2955c50bf2c407d6a21831516df787763ae75c7cd50899075b06ab6ac2f4108f2a369073fdb99ec1461bb2c784186e43b7a8f123244ec
-
Filesize
28KB
MD5bdc38f2e827574ac4fc7123dcd14dff6
SHA13f4f5052b344776de8585abd2142ce94f14cc4fc
SHA2567da57948c092aebf9ec6d31137293dfb969a2e378b059e2ee21f5955d2cb366f
SHA512c82df30416d1d479aa2aa5eb07fa959716be8cd66d6083c1124220ca78be42ddf653d63f485fe1ee6babf76cde4cbe71d78a7123e816d0ef6411c83fecba25ec
-
Filesize
512B
MD5b7627128e8f79b4a37ba9d6427c809af
SHA1bd0242f2f0676b72a954b6cd1eea1beb9740efe1
SHA25611d8915197822f1e09972e366c8db4f76b928413838371bfc82a42a5b88ff0b0
SHA5122a39f584a1937ed02616e91cb7d0baf9919f0268a5a00ca03f7a607cfc665d89d79a91652729dc8993634a5511f81082784326df54faec4c18572638eaf8b0d7
-
Filesize
8KB
MD5381732c78c0a875cef5535d909677e2a
SHA1231939408d1a41666f54b39b06b66e1816c6cc77
SHA2568a71863f085217f62ec26c21b1fd935e51354264cbf6f53712d5d0a562a8321f
SHA512028fd7134f0316dfc5231682acd00c5a197db1250d89d3a75ca98727f2722fd14a04ad66320ba616844cdc8d14dec9f6c0e959c3dca17328a40565b94b3765c4
-
Filesize
8KB
MD50d20fea1496bda00570ac65983d279ce
SHA17aaf3982dc03f45e24094a4c6d3199d7b668b4e9
SHA256b71035a3d6669d11660209218ce3a32fe433e0272a4ba0b3b3a37e4893d4b254
SHA512ab77df7a9948ac28fda156c63cab397f576ac06250b3f2f7222c8607c8b4ba2c5c376c0201c871f682a076205268f30d2f2cdfa88580afd96af8858eed757a7c
-
Filesize
12KB
MD5c40782f0cbde9860f43f9a35cdd4cb5f
SHA180e5f4bd0fa2e00885d90a3ecbe338b1363d7931
SHA256260d29baa43a95b450f3a9698a6954604dcf26080a7f68d3cc00e73b5c78da0e
SHA5127be74178912f09ac391c60752a82a2a0c56340949f3b2f7166dad565aa946ca2b623bffa161c1f0bec36e2a58b73e58c7d29ad7439e8fd6a0e6a480146c2f46c
-
Filesize
12KB
MD52e8d2b7e3b1a8758ee427d301314b7ef
SHA132bcf7c03fd4934e1224feaf2114df2ae56d0551
SHA25667b1e827a498e60301f0b57d15e0e342027c49266e8be14c7441dc7f774c299d
SHA5122a7acd5dff858b159ad5ddd05f8392dda9a0d2185dd5b2b4b20ab660d8946bd3686cdaaaeff7317d717a23a2da1d86e5e42e0221e20e55cc020a2d9a16b0869f
-
Filesize
512B
MD551ff58049d0123ce5c3784ea4bbc0852
SHA1e0804de202454b6f79ef84d3f738d94813b3ed64
SHA256b45546535eae6f5b46b4e2661721286abf027ea67065d9489b4f2377cb52bddb
SHA512766915d22902f3b8f360c9f20a3fb224d5d71d7f748bf4bf411a9a23c1ce75c636acf342d6c535d0512f558139ea444f6ccdfc46a1bc3c787bce5254e82d7c13
-
Filesize
8KB
MD5eb555da88048095b643b3fbda643d87b
SHA185342253b4c61ba3627ccb80aac01adde301fd8f
SHA25667a79e6a9a693dd86c3cc3a69e44b16e3b629657ce1903be6b73b18b4eabb51d
SHA512f5f65f788a36a67a6d878a8eba52a15d44bcc202a87b5c1cc41be43ddca456d436289ee91cd4c4ed2b970c28023b6fc061044c7c12119675f9b14c68a1d419e3
-
Filesize
4KB
MD52d2692021e584085f7c3407d77961237
SHA1dc628db84f86509f3bf6a3036f2687e6c0cb60de
SHA2569c66dc9ae5c84237fefa503814917ffe14ba330498d620aeafb37c27252addf6
SHA512a444bb9fbf7d233161f2a1f1a7361bd10b025b974ecc98c9bbe6affb88d1ee1bca27ece0a0cbb18f6dace00505b5a33e36d39cf5376598fefb33508921a19b54
-
Filesize
28KB
MD5223b095c5100b3f36d13f2922801d6b5
SHA1247df4a9847dcfa7a42b649bda66126412c279ff
SHA256dc0c24c777a762b585f1f5213b8c021d30be608bb38d823271d9eea42d60f5b5
SHA5123edff39a607c3309e4f2a921d6ae1b3fc1b8e7328d57c2e6b9a4e9825cb1d9487a16cbb4b0147cc1707fac8249253b687524e18f2184ed86a457729e9f5d9494
-
Filesize
512B
MD5a3d674b0bc74406897cef8b38edebf13
SHA1c744577887879280d997b0a1d8d11f3d1f8063d8
SHA2560261c3438842fe752492cc4501c163fc08c1a6e1a99c455f4e83b88d5c2cd2f9
SHA512d57a0056aaa85f15adb413e7c5387354ec655ee6a0a776e7e31e2e3a634102e9d285f9f9a84ff964a601d9ea9e5b03277b36618190f72bfaf09c809cd79d9616
-
Filesize
8KB
MD5b163fbcb226ddababad08ac6ebe502da
SHA1a8a46b653f915fc040057112fa96a2c0a066728b
SHA256ec72ab8d98a975f12bc4f8bca955c8b2382e1f4265428bbb3658b147fd96cce1
SHA5128b9e18ba4c52b11ec22740ebea668cf1ba5a3aa39aa9526c048b97035cb177de6c541e7a1a70a7ea7a6d57f7d62d57eea7f2a4f9718bee29e2ffe871e1964b05
-
Filesize
8KB
MD5348574d35bf4b60decbf2d07773af34a
SHA1eb962da5835d3b1170216d4b9d4ff6a78080d360
SHA25689c616f5d8b09edc0ceca78239d925e63141859bbf4a355ed2a7c555e5308cd9
SHA5121be04c52654b004cddfb70eaeabafb8949f662c44ba0bd21e4ecf760c0fe74c4923309232579fbb147beafef6670be0583c7758764b91a200d7c066bf8bd664e
-
Filesize
12KB
MD5171aedf968e17a2744d2585715606cb9
SHA1bbeddeb3b89fcf809619c35b4a318a80e7d5b029
SHA256d2ab452d9360848f46af866b870b5c6fc98230b09c72b89cb1a4b2778586678e
SHA51278a0f517ee3d21c153dda6dbfec4187ebaee9d520d7b1b63f358bcb125d08aea53f26943907a56fdeba40161d9fc7e4fd63f9ae3154dd2ad887ba0162738285b
-
Filesize
512B
MD5fb31699202c72e8a27736861b69150bf
SHA1b5474c5f8fabab1591ec1ac3765f07b94eeafd23
SHA25686dc84073f5b577e5e988d0dc328826f2676ec8b745fb0ef54a70d689371955a
SHA512c648cc4b088765155c5a16ec1c47bca09cddf326a1b0ac6ba1d0bae533bd069b34f494ef31a2b85e80f16a5c6235fb7d966f93341225fb7f31b775970c2c57ee
-
Filesize
8KB
MD5b34d19e3d8ba549ffaa8430ff5c9781c
SHA1beead44ff5185bc6aacf8c42ad6308bfda2b9834
SHA25634dc7410f1b8f3839d88bd95bbaefe55ef7792352405fc6ff01f70e524fe820d
SHA5124933f154f0d6a4d11038cfce88ba30325d87e5291e26d8fd5e8ac65c05587efc9d1d48b283ae2ace8881511ab2733dea502385e4d323d2c19dfd272db4a7096b
-
Filesize
8KB
MD51e225093ed7bf43af8e67da3e3f60c88
SHA1e2619a577e10bb99ac8da774b134df44fa550a29
SHA25682d0bfade237dafed732c68f49cfe4812c7b86ae39fb5ceb1634b284b4c0aac6
SHA5125f1f1249824dcdca29e173dd9acd47cc1700dd79e3523eb303439939d87cba4ba5c1f8d7f1ac45ec59ec0faae7b6578f89c3ebd5e20e38354c0ac5db85b52fb5
-
Filesize
12KB
MD5f41f531c07d4141546a531ff9caffdcd
SHA19dcac5aed06972d0ff6bd4cc1f1cdff85b36d3f5
SHA256bb8dee5b5c3779f175abbd142722eb0022b98d374783aa80145b34614a4de646
SHA512e0c8d1a820cb4c098e45776e8b50ea8c83944ef2e3f005cb0acbfc07688974d370f78100ae022f62564fc4c12acfdc43b710c18ca1c30f4f575bc08b9b12d2d4
-
Filesize
512B
MD55c051a152fbc5e0f0721bae38ed76a2c
SHA117b8bf0a88ff2856a93a3c581dc4df1f9dd6aaca
SHA2560156adf2a14d34255f66b8a9655a236c7c3c22be87786c92d68cc36d022800cd
SHA5122ac9feb5cef1ef3e0690aaf52302f40e0e259e27a7f1c44d52a88ad1967fd01f528416cbec6c414cdc8f6583e61b051b47105b1fe8128c622dcc830452e6e979
-
Filesize
8KB
MD5e57264c7c0ed9c6118a07163b5fa6ab5
SHA16e34518ce3888dcae926a47d0f7b99b11675e977
SHA25696e1607e93c594ab2993859b2e776a0c9e0d30a4ad6132ac3fc316cd9aeaa8e2
SHA51294bbbe5aa9869889af006576a80727235148fda3eb9b5a1f3e410acc1ba7aaa57ec104417062cfdc145c5c69a2a5d21207244ec2e78f29b9021fac5d8286bb26
-
Filesize
77KB
MD5389d5caa6e76e1655516ec7f573e5b88
SHA1f39fd7fea92987881d96366057b25475d1f544da
SHA256d208ec08a604ede96d5ae30fc1f226f3efad59037d42af162bafa55a55eaf754
SHA5125516a39f7a2bab699d979c479f45fe8a4b750ffd9a7561274b7031e7533c9b41ab060e7ad7f85aa095a315d066eb5e2112133f8add994bc26e2e15535c937848
-
Filesize
20KB
MD5131cb35da3e55d70b3f6badf68521da0
SHA1e94f6aa701f0c6263dbb50ad4fa58eb60f4cb210
SHA256714e19e3836c8fb00fff8aeadc826c7c7b635972aa33bc530f2394f9de02147a
SHA512df9331846cefc5c04172f83aaab2bd150cb3377eba7b0bb9f7b47b0964e589032c5f58772798cfa43d2591d81b6224afefe18353bc96315daac539809bc268dd
-
Filesize
580B
MD5479c65bfbef1b1b85e5a5acfe89a3d16
SHA1ad92dd2a067a7cc702aca1333796be2da49fee8e
SHA2568db69885d660ab0b22083f39e35851419d92c4566e7ecf5e734737f5c26adeff
SHA512364e981fa88e7d3bb7d7cb58fd35646312c487585d064ab736bbc577c07d373014d5a7e99887722e1341c902b1683855783fa30a0027c34edb53d8dc97b9bd6e
-
Filesize
520B
MD5eb9c21388869f4e1838783f7639be09a
SHA1101bb989f7182e7086da06bf38fed5d9a5ac9020
SHA256ac0f16b20b0d4774fe78aca8e508aa79197ff038754fb38356e961dc607ba572
SHA5129964302a18e68f03adecb494eefd0264e1856c505d11128659591a7e480694ec35704a4b3972fc406045c54ee66205caebd5eb9b7b3c33f0985a9b6f1d2b0e0f
-
Filesize
712B
MD53efb41616233028e09eaa49caa0c732a
SHA1372e041c8518e74f1e660043f3b9ed73d17f1997
SHA2564439afe80baeaf48f35e18786b8fff831535951ee03adf65f2d3eece2fbbdbd2
SHA512221bcc116f095aa01e5580010aff5f9a25efbda1aa30b8fe5cc7a128921c64b12f821cf652daba480a3cf1b02142d7f099efcbd148092a016eb5a50868836dab
-
Filesize
1KB
MD5d210b199a239e7f939710a86118d4857
SHA1a70a21bffc2aee123309623c2fed0439593864f7
SHA256c6194a899950cd768c665470065e938f39e05da3a22e1b0854a7b76801d65cc9
SHA5121f10b77328e5f6cba934be578df8dbd7d4d52554aa9e39b1edc53e43f853eb84c50d4bd2bcbca99b43712c43e1546efba04fef9e1c8b3fa233a93787509d7003
-
Filesize
77KB
MD58c0ed55b0e575e5b96ca66628c2e6228
SHA1596148485b05a581003e8b7c428d5372aaac8545
SHA2564000172a977b9b748bc362f8fe80e1bc751f06cc83e5823c097e3d54206f0ef6
SHA512db42d29d656494bbbbd3c42d88c52226c10755063227938ea8440ce813fd693335c7556881ecbef688829a388e4f2172e284a196b3526e1195d1ef9c7dfd8489
-
Filesize
580B
MD56f694c08b86c8863e2bd41d6613746fb
SHA10a8427854c93bfca73cd8efdcd01b181d29f7bc1
SHA25630d9857076aea22da725faf438106003a01958e320773696b46903b99b74b8ad
SHA5129871915f5816f0867705374fd065f9b0997436afa765cd96467395e347fe921ffe5dd5cfc620adf2363f10e1eb3f72954607f1653462d7c8b2340056503e73ea
-
Filesize
664B
MD5e32b7e5e8967aca634939ab9aadd7cfd
SHA1d647194a8853a334e3120a6aad4ec72ff79cedc5
SHA256015aff63f5c33a7d48438a1cffa26d58f9697b8de9fa7994ece89f2307d9e0aa
SHA512045a6a55f8a242fa0b83fa5146782586a4f722b42425a0fb5801748585f93ad665da5aa8576bb5bd219844aac0d11bc3f236889493712cdbc415c9ce20ab27d6
-
Filesize
628B
MD500fd3c78236c17aa1a031e7c9ca75346
SHA1d342ef4befaa0d9715363fda26d906c65f715d49
SHA25647b9d921b03638e4b9a73bf8e4494a7ffd519b109ae5ad052ae099d6b66b9b4b
SHA512260e2e36fd9cf4edd42dfd5e3af028071a5f58fccb3e8f7627e80d0fbbd93a38da9303588c4665d3b608b546aa6146a67bbd56117cf406d5bbf426bd343102a5
-
Filesize
656B
MD5f977f54248e18f99d6469b355660a765
SHA1acb99986bfd423722738aec3f4466d274412201a
SHA256b66867c17e1b2f99b87bc0ca4c622d3ab956faa107ed59df86e771a934a3f994
SHA512a4d742938cc86ea2ea205d0ca07d63cea6c522d932c195fb49aecff63c3620bbfa71d6eaf1298304b1a1dbe3654e5bcc99ffeeee3a743fe916b478b8d6abdfe5
-
Filesize
2KB
MD58496b830e3432025a35ea67eb1bca240
SHA1665420735bc570988c8db828153fbeed4052fe29
SHA256a3c08a0f66ae1393c2bfe160b9c68296f8549371546dd49840f8ecb6ead124dc
SHA5120b400788da0441da5ba32f8c013737b548bee9a1a2a093f62612f1a1a79d19d5a2324f05c2194a2685b8010ecb01b3dc40599c988f64af33bfa4ca16e5dc524c
-
Filesize
596B
MD5936a99ed83e13c373d55ebd7a2760f85
SHA18396cec252c88a27e83b61a63374d86e19b9387f
SHA2569d183f18b65177462a20887f2fba49c88d9b4ee1a418eacff1b1d06d58e533e2
SHA5122751e0a3f1f0186dfdfd27fe2f3a6ead35560589c9fae35e5e054c7f340fb933e600a64834d8b95d4b43af1f371b6bb3b8fd0eeb3e1dfed0265acd5702d38a98
-
Filesize
176KB
MD5b667ca71e42bbeb899566c8834ed085e
SHA1053a3f889e326efdfa0d3ae7e5b2655f0b7376d2
SHA256536678202267f95d80480f15065e784d7ec609922a0963d935e9c5a4b0f62bef
SHA51252255d3d7066d01bd47a9da788f86c707af14e7666a918737fa5ffb4bb003e97b28dd84a7cead3439ee39e10b568c97e80174a80bf776c7dd58335b06656f8f2
-
Filesize
527B
MD5c8f75f86475547e407ea4c8796ec23b1
SHA18fdbdbdfffd6f6fcb4c6021c333e5716fc0544e7
SHA256f2442a8f5764c08a491f3dfe7618937464ccd61e56664ef1736d1adfda09ea75
SHA5123e964b58f8b6e23038a33feda63cb2dae9b37654268903c558b27a7026230ca05e51f1b490176899d3e9c57088a993a019251b174efff200425790835cf0f160
-
Filesize
83B
MD58f54a6692e3f36d7e96bdf54a1f3428e
SHA1a4051218f3fc49c5b74250e31cb6d1f05c60f924
SHA256068b2ae47ff2ece8e4bcd101ad69ead0e6533afa22f606d57c83dc09cf8eef29
SHA512fb53ee1510083e23da688eef4d851def31eb0522770108eca7e765ec0f02deeedade735fe8de977643069ebfcb8aba5ec47469da4225dab88b753f4e0a2c1593