Analysis

  • max time kernel
    2760224s
  • max time network
    137s
  • platform
    android_x86
  • resource
    android-x86-arm-20231215-en
  • resource tags

    androidarch:armarch:x86image:android-x86-arm-20231215-enlocale:en-usos:android-9-x86system
  • submitted
    23/12/2023, 20:33

General

  • Target

    8b1304596a6eaee62e814663c91fec658e969c3f2ac80e827f9a6cf1bdcc5443.apk

  • Size

    7.2MB

  • MD5

    a9efb1c2d77cc39612a6930e932f4aee

  • SHA1

    36aeba5d91381eb725c42cb79ba62924b913abb4

  • SHA256

    8b1304596a6eaee62e814663c91fec658e969c3f2ac80e827f9a6cf1bdcc5443

  • SHA512

    271a91e9422a8f0d0bfb152f13faf3bc2d1b07accc3cac48cea2ea0f41036562aafc20e358f8be56cf611012a25d8b4477c7a4436b84963e619e70af50629bfe

  • SSDEEP

    196608:WKlhSUPVGT86VLP9d+cvhmDQGVawoM32/mlXZzG8h:1hSUPVK/VLVd+cv8DdVawo1elXxGa

Score
6/10

Malware Config

Signatures

  • Reads information about phone network operator.
  • Listens for changes in the sensor environment (might be used to detect emulation) 1 IoCs

Processes

  • com.npnlmemmmlmpnnnljgjgjgjh.tsy.snxy
    1⤵
    • Listens for changes in the sensor environment (might be used to detect emulation)
    PID:4254
    • su
      2⤵
        PID:4303

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • /data/data/com.npnlmemmmlmpnnnljgjgjgjh.tsy.snxy/files/.um/um_cache_1703567274085.env

      Filesize

      588B

      MD5

      cc2979fe0e975e9650cb4e36ac627347

      SHA1

      f931bca27f26e80e053a6157b147a93e2cba5c8a

      SHA256

      5cceb8d565175c99cd33e5704dad340591ffd382cd1205b4bdd4e04a74080297

      SHA512

      ca87732233ab0446ac1b30bf65e9b59073c1d08c6a9ce2cd12d8b304f973b3dbdd3c784c58f1e1302c0ed97a634d7a5bedbc06b04b1f51d39360127dee146065

    • /data/data/com.npnlmemmmlmpnnnljgjgjgjh.tsy.snxy/files/elfinject

      Filesize

      31KB

      MD5

      56e40679971e54d53bc51c4463fa5328

      SHA1

      273eda8feea372a70f1772f3bad1e6dd12e4ce67

      SHA256

      61db91c05bba4653ce4d522b43f7bb8177328a867d78eac5a0a545e0a83b7bc3

      SHA512

      2a2f5eb7e2f66cd4a3648b109a8b8a5b5767037fb58a3b3cf15e7df26ab76cc67169957d988b4734064378b2c3fddf8bc36c6a506e444a284771431b6ed72a6e

    • /data/data/com.npnlmemmmlmpnnnljgjgjgjh.tsy.snxy/files/eventservice.jar

      Filesize

      219KB

      MD5

      44f3009fcac59538ff855f9c12bb4672

      SHA1

      ee5855ecbe3166b5d6fd8c489a1d8dcb3b5d86a9

      SHA256

      f3bd4f9410b3276a562ae62e7841e4809cc19e4799e02d5aa90f34e4c486b8b9

      SHA512

      2e7d1a2d9fbd8356b7daee5850b5db5d7678babddaf9bd5800b9b5215d038c5e878ae8ac7970bdee4fc7dec719a61015fe2346b9a143c850579295a2fe420938

    • /data/data/com.npnlmemmmlmpnnnljgjgjgjh.tsy.snxy/files/script.cfg

      Filesize

      145B

      MD5

      828ae5a261c0937ef7b2f2137982bcd7

      SHA1

      0dfa9e2a3d104f63463956afa56f25eed0b2a5fe

      SHA256

      be6727f334eca444a717cb9b72af152674cc652641c95105bf5b4cbc49a7b9eb

      SHA512

      065ea591b8ebb6300a5d738362c8d4d69f07f171104e78b7ea5f0f876a7ee8e8d086d821c051f4a0c88a468bd8cd9439b2d5c3683459a23810c09c10a82e89f8

    • /data/data/com.npnlmemmmlmpnnnljgjgjgjh.tsy.snxy/files/script.lc

      Filesize

      47KB

      MD5

      3b085754dd6652b14b083343b1fe3d66

      SHA1

      995d56a9df2fe33038828f03872f5778d5a0cebe

      SHA256

      be6fcc1b48b91f0b99698f8fc925bb010b0f0b08345b8fe88e07c5798f3c04a9

      SHA512

      1ebd2f3545ceebac8c523878e0c3d6edb8a8434e226a48e8f8dcb25eaefb7eeded371af29a68a9c90edcb6c35552d595d451666d585324ef25d7810bd3618ded

    • /data/data/com.npnlmemmmlmpnnnljgjgjgjh.tsy.snxy/files/script.prop

      Filesize

      299B

      MD5

      eaaa5df7588b531d764c91210e4a1a4a

      SHA1

      315b24ac4b834cf569ab6cb8862bd7437dfb1b14

      SHA256

      66027ece5ef1385b61d6a6e7cb25452b815455aa50db9137f8ba9d1d32336f66

      SHA512

      39758da4bd54eb32313a08907559ff1b4be34a70fd466f3c4b2d9b977b630353309ec658b6669c328a3469b0723f6eb9e2b97af8de253289788fc69bff445ebf

    • /data/data/com.npnlmemmmlmpnnnljgjgjgjh.tsy.snxy/files/script.rtd

      Filesize

      29KB

      MD5

      b1b2a49a0ec34070e4e058ec87448fd0

      SHA1

      e6675111afbb5dcf4ca0e96142211f9ad346daad

      SHA256

      45e25b25c6d3b871890326a93dc26a4c11b89634d5666ac08b8347488c2de52d

      SHA512

      7f43e18bc87acd69c3d616b612e051e3d1e4e1987b8c8823626673f42e38b56de2ed367e826cfd450145d19e44c44b4ef27a9b986b6b5726be916dc5630f083f

    • /data/data/com.npnlmemmmlmpnnnljgjgjgjh.tsy.snxy/files/script.ui

      Filesize

      3KB

      MD5

      709f598db3ee82a4ef1358341b81deea

      SHA1

      c099ee738cd02024e3b427fdd87c463e6ce6409a

      SHA256

      b125319616b5197292e13f0e538ba3a1731beee817a4754e87a80436a57cd447

      SHA512

      7e533008eb6be534dfe493383574a998174f17ac2b09bd303868192c0983080cda4817c0deda64eaf3b87ee72dc08c5b6f6cfa9887e8c740d4fd0ee0a195e2fa

    • /data/data/com.npnlmemmmlmpnnnljgjgjgjh.tsy.snxy/files/start_eventsrv

      Filesize

      346B

      MD5

      caa104eb8dc416cc3b10b8ac27cdc591

      SHA1

      b4be5632980cecc99c6f0e04869af542ba537de4

      SHA256

      f3f203c14a44b63270a29c13dd5b246f5ffcee4ab572e18b38368fbb057b6202

      SHA512

      722bcdd9b1dd286f21b83130c5821da6c83096606232ea30974e8fbbb3d49264560042de402ff42b38b83352ccd110215d8fa7c43c9c73ac42d390dab2222205

    • /data/data/com.npnlmemmmlmpnnnljgjgjgjh.tsy.snxy/files/umeng_it.cache

      Filesize

      310B

      MD5

      b19516678b1014d41d76e43d8b8efd9c

      SHA1

      07cc1a2c7c3810c517ae0d33d771b0ab3a5d4680

      SHA256

      411baad69fc91cce399bbe37a2df69af900284181e96cf74f1b23c5af0dc29b3

      SHA512

      5f267a910286b56fd6b6c59c36dd753d9ab00f4801af6389c42c12ed5552986fb29e5868447baa7cb450abbcab9150013d738053ef8f5dc61768632510a0a409