aafb6f48ccf8c30adfefc26b2f0f5d9fa81124f021a0fb267f0578a81cc827ae

Analysis

max time kernel
2916365s
max time network
130s
platform
android_x86
resource
android-x86-arm-20231215-en
resource tags

androidarch:armarch:x86image:android-x86-arm-20231215-enlocale:en-usos:android-9-x86system
submitted
24/12/2023, 00:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

aafb6f48ccf8c30adfefc26b2f0f5d9fa81124f021a0fb267f0578a81cc827ae.apk
Size

6.3MB
MD5

5b9048f0f5998203374a977a248f7033
SHA1

bbf888f201afe3bbaabcff242d26f3a1caf1b458
SHA256

aafb6f48ccf8c30adfefc26b2f0f5d9fa81124f021a0fb267f0578a81cc827ae
SHA512

eb01a4183fc6c98a03bc65d2441d4bfb745afff84a79775bf93e5c1bfa5fb0e32b2d37d1dc6295d78b468211423b36a643bb74831087d247666fb7e83ebd4ff8
SSDEEP

98304:lyG8lv9PeaY/KzDkVEK4BSlP+JV72EJ5u0knO24LzI3WKFU4GWr3fC4:lyjv3nzQB4ElmTjJJaEIGKvG+N

Score

8^/10

banker evasion

Malware Config

Signatures

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 IoCs

banker

description	ioc	Process
Framework service call	android.content.pm.IPackageManager.getInstalledApplications	com.android.yugamezwdzjsmxwa

Requests cell location 1 IoCs

Uses Android APIs to to get current cell location.

description	ioc	Process
Framework service call	com.android.internal.telephony.ITelephony.getCellLocation	com.android.yugamezwdzjsmxwa

Loads dropped Dex/Jar 4 IoCs

Runs executable file dropped to the device during analysis.

ioc	pid	Process
/storage/emulated/0/Android/data/com.lyhtgh.pay/plugins/com.lyhtgh.pay.ltplugin.apk	4280	/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/storage/emulated/0/Android/data/com.lyhtgh.pay/plugins/com.lyhtgh.pay.ltplugin.apk --output-vdex-fd=48 --oat-fd=49 --oat-location=/storage/emulated/0/Android/data/com.lyhtgh.pay/plugins/oat/x86/com.lyhtgh.pay.ltplugin.odex --compiler-filter=quicken --class-loader-context=&
/storage/emulated/0/Android/data/com.lyhtgh.pay/plugins/com.lyhtgh.pay.ltplugin.apk	4251	com.android.yugamezwdzjsmxwa
/data/user/0/com.android.yugamezwdzjsmxwa/app_pe_odex/pe.apk	4378	/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.android.yugamezwdzjsmxwa/app_pe_odex/pe.apk --output-vdex-fd=89 --oat-fd=90 --oat-location=/data/user/0/com.android.yugamezwdzjsmxwa/app_pe_odex/oat/x86/pe.odex --compiler-filter=quicken --class-loader-context=&
/data/user/0/com.android.yugamezwdzjsmxwa/app_pe_odex/pe.apk	4251	com.android.yugamezwdzjsmxwa

Reads information about phone network operator.

Listens for changes in the sensor environment (might be used to detect emulation) 1 IoCs

evasion

description	ioc	Process
Framework API call	android.hardware.SensorManager.registerListener	com.android.yugamezwdzjsmxwa

Uses Crypto APIs (Might try to encrypt user data) 1 IoCs

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	com.android.yugamezwdzjsmxwa

com.android.yugamezwdzjsmxwa
1⤵
- Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)
- Requests cell location
- Loads dropped Dex/Jar
- Listens for changes in the sensor environment (might be used to detect emulation)
- Uses Crypto APIs (Might try to encrypt user data)
PID:4251
- /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/storage/emulated/0/Android/data/com.lyhtgh.pay/plugins/com.lyhtgh.pay.ltplugin.apk --output-vdex-fd=48 --oat-fd=49 --oat-location=/storage/emulated/0/Android/data/com.lyhtgh.pay/plugins/oat/x86/com.lyhtgh.pay.ltplugin.odex --compiler-filter=quicken --class-loader-context=&
  2⤵
  - Loads dropped Dex/Jar
  PID:4280
- /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.android.yugamezwdzjsmxwa/app_pe_odex/pe.apk --output-vdex-fd=89 --oat-fd=90 --oat-location=/data/user/0/com.android.yugamezwdzjsmxwa/app_pe_odex/oat/x86/pe.odex --compiler-filter=quicken --class-loader-context=&
  2⤵
  - Loads dropped Dex/Jar
  PID:4378
- ls -l /system/xbin/su
  2⤵
  PID:4455

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.android.yugamezwdzjsmxwa/app_pe_odex/oat/pe.apk.cur.prof

Filesize
324B

MD5
efe2f7486851435a3873107f453f7ec5

SHA1
69f64c9349306be511df1b7cd8ebce8698b9b7c7

SHA256
d5e7ebef1ba751714fdcd46a99031f02fb155fc6406819bd30da2118ccfbcee9

SHA512
52adffe24b2a16f0d2dd6036cdcaf833a3352a3c68b696259eb59409b3e3286c5ef00a93988884f1b6912fd6ced731fea5ca60c86b61ebdc48454336d769cef8

Download Submit
/data/data/com.android.yugamezwdzjsmxwa/databases/ygrhf_2.db

Filesize
4KB

MD5
f2b4b0190b9f384ca885f0c8c9b14700

SHA1
934ff2646757b5b6e7f20f6a0aa76c7f995d9361

SHA256
0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514

SHA512
ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1

Download Submit
/data/data/com.android.yugamezwdzjsmxwa/databases/ygrhf_2.db-journal

Filesize
512B

MD5
a6cf84e999410ebe19b09491519ce9df

SHA1
e5dc3c22b2c052ceaaada2ab83b0b27ed3e49cd7

SHA256
b401f8104253d3aebce1dd98a9d99f28628360db54e7c6ff0f3a1aaa343730cf

SHA512
7c554f2b3dde41b2122498784789fbcec4449fb2e2c5e95202c8d7b63408930fc72ab8f17a5c165e85947833832801b3575a982ae0720641712229457c7026e6

Download Submit
/data/data/com.android.yugamezwdzjsmxwa/databases/ygrhf_2.db-shm

Filesize
28KB

MD5
cf845a781c107ec1346e849c9dd1b7e8

SHA1
b44ccc7f7d519352422e59ee8b0bdbac881768a7

SHA256
18619b678a5c207a971a0aa931604f48162e307c57ecdec450d5f095fe9f32c7

SHA512
4802861ea06dc7fb85229a3c8f04e707a084f1ba516510c6f269821b33c8ee4ebf495258fe5bee4850668a5aac1a45f0edf51580da13b7ee160a29d067c67612

Download Submit
/data/data/com.android.yugamezwdzjsmxwa/databases/ygrhf_2.db-wal

Filesize
28KB

MD5
00d15279882c6a525a815bdffdc453b3

SHA1
33a2719e1105ee28eff8111f725270e14c6de31b

SHA256
f4317c166f1e15cf282594e984710fd560e9c3927d25fad2ff73e185922dfcea

SHA512
60d806725a7bdcfbcecf190c620bed95d3cab111b1c5ebb005982db7f52b7ee8fc54e5f470b84e385e3dde3f7d50b3c2deccb5e0c5e419dc077444b277a887cb

Download Submit
/data/data/com.android.yugamezwdzjsmxwa/files/lotuseed_jy.apps

Filesize
3KB

MD5
6f568bfbdd835d209413a0e419880bd5

SHA1
b6c479c174ec5f3ece9d618dded16649ce318bd1

SHA256
f94013995f67079302fde38f4204b431ac473bf93662f1c85ca4ce82af777e21

SHA512
61e02e58b4eeac8afa5d1c66c727418b828565c4f01d3de8127f7a0d4e23e62eaa7e551b9022ed8ddad957aa72e3fe4f39cbb9edd1fb84212dacf8bad5c42fd8

Download Submit
/data/data/com.android.yugamezwdzjsmxwa/files/lotuseed_jy.s

Filesize
647B

MD5
103ba693f74ad21b02e16f65552b7972

SHA1
eebc8fae4e67df292727334c4dd8b4777647028f

SHA256
b448cd0fe046be2e94183e4b17d8b9386d9fee22ca578d0ebd520405ca9b9ffb

SHA512
b812f7d4966ff3d24fb84dacfcb2c4acd86e2c10e758d25d8a163868ec0884247ce664e19f9cd65547ccfcf3294af4814e6d604014d315e068858d930aefd611

Download Submit
/data/data/com.android.yugamezwdzjsmxwa/files/lotuseed_jy.s

Filesize
77B

MD5
8d025fe146842bdba1d8d68c8fb2ea23

SHA1
78c07a2e0626d756d611f984a823054d680de95e

SHA256
2851543dc86c4933142a3d85cd8912a452d825628ac5ab8dfe9ab2ff89810a76

SHA512
4485d8a5f028ccd270e3b7b5ccaea370f4fdef3702aa74f44870c120e8205a8f97b59837d9e7c4236d4282478c04836475509e970835dc7d6bc911813ead5834

Download Submit
/data/data/com.android.yugamezwdzjsmxwa/files/lotuseed_jy.s

Filesize
9KB

MD5
3fb6b8241bd9c89fb34c5b815622c980

SHA1
4c2ed661c18de8fc0b5974f0fe3fb125aa54f96b

SHA256
36172fa3919825a87ee958685b7d7e058d5a85430eb37f97689fd870aa098486

SHA512
a17589fa8deb8343ad3b5eb9e1b1a3c99c7b5e318bd62b59025149c6ba51da3b0df83562ecb2b8765d7f0068967a3b1f05dbbbfad0bde192c5b63ce527b426cd

Download Submit
/data/data/com.android.yugamezwdzjsmxwa/files/lotuseed_jy.task

Filesize
89B

MD5
51dbaa695725b4b1ccfc0ab2d1f7101b

SHA1
9eeabd2a4a596596ca3772547170842e4d462e35

SHA256
32b10b5c3655f5b7cf4270e4fae6a6ba8869822cf7bfcc5182c09f1eef7841f8

SHA512
c28f88a6ed9739b775322b4117d5fe74d6391ba3465a1a2a5d6d9d5158596171232d1cbdcbc8ee746e70682b691701c68ce14aff72262ec68f02febc7ad9c9c8

Download Submit
/data/data/com.android.yugamezwdzjsmxwa/files/rtlast.sys910d635b-62ff-4991-a4c7-106b3ac1840e.tmp

Filesize
19B

MD5
3feb265c5461debf00003683f725c1cf

SHA1
f23b84bd9b9ad73745b7c53d58e134bd5ac64610

SHA256
aaa5a97c668a6d031cada1845aab3988d175862dbc1cb627e6dfacc0fe0a6e94

SHA512
72bedbeaffc1cf5e5277ecf225a1d152c3ea72e59f4a0586a815029f78dadd9f4cf4e71a6d0720d8b5607b72cb6d6fe688d129b3b42a547ee9bec177c21e9583

Download Submit
/data/user/0/com.android.yugamezwdzjsmxwa/app_pe_odex/pe.apk

Filesize
95KB

MD5
1c524225c4ca3c5a264b418c1e777f64

SHA1
06917629eb8a0caeeb62605c60e012e84355e9fd

SHA256
42ff04d77aa1fb09bdfa0f8ed6d767d76d37a90b68b73f04811c53b611e7b6aa

SHA512
ff0f8362e78fa9e0298a92ccc22e04dfdbc0899422d565dbef9e7e85badf41cbd711b9575b512db2458b65914933b67b4deef8136d34b826554708b289a6de5d

Download Submit
/data/user/0/com.android.yugamezwdzjsmxwa/app_pe_odex/pe.apk

Filesize
95KB

MD5
1f5d8f2342054812f7795c8d220fa9a1

SHA1
bc88a41dee81d4da6a4d1445c927651d8d0bcb8a

SHA256
6ea4a0ec92202646368939f136efb1f6d548c8fed265e5c0c6c33aa7fb6270f3

SHA512
e73ddae531230bcb4358a3b21d04c11a265f2a7ed2396656a8fbeea42434b893ecf52eea8f9a9dc03b131cb513ebcf084b4e215d9e923208cb51904b8cdd97e9

Download Submit
/storage/emulated/0/.android/XseREdseiEd

Filesize
163B

MD5
a7e1ab3458e42083d60a3e12e652a7a0

SHA1
e4333e06d25dd0754d3fc03349dfc67d7997b5c6

SHA256
498f67be35e2dc6f5d5325c5b4b1aef7437b2a7684e9a2b80bddb0b32287237f

SHA512
0a702500db0a6129bcf5739745d73390a7369ac35c37b8b3c015ac2888f3ed0d5842b1370d74f737fa41f5f7e4bf07354cbc3fbaea811a57b1238db0786f1de7

Download Submit
/storage/emulated/0/.system/lotuseed.devid

Filesize
85B

MD5
b05a29e0f25e9cca01cac1e515b05aa0

SHA1
d2c7f5849bc2aea0b2fd3e2122bb325a812721be

SHA256
4837f4149280be591dff83660ce6918f3360379b08d88d1052e7e310abb806b0

SHA512
7fb53ee8b96eb10a84e8b0d9a5bcd69adeda3087c55a4515f6986bb6c73bd703dc3f535e505c66470d7548dcb34d56d83194614a26a5f77fcbf4eff26f4a10c9

Download Submit
/storage/emulated/0/.uct/uuid3c7007ef2-6b1a-444c-8280-814f6e65f5ee.tmp

Filesize
36B

MD5
a519ddf851a13f5a619ddc25d0751440

SHA1
3ec2d47845fcec32461fe1b3274815e61c4f91e6

SHA256
6618938036edf797cb107b191d48bbed1361ff3b6ad8415cffccefe595759912

SHA512
f46308d0b8122686c7766f486ba70f6420eef606b99986e364b1526f06adc569c642cd702df16d6bf09f321368434d809bb02c708a3653bd832317c66593252f

Download Submit
/storage/emulated/0/Android/data/com.lyhtgh.pay/plugins/com.lyhtgh.pay.ltplugin.apk

Filesize
169KB

MD5
236cc03e03ea321c65f95b7a7aeb6778

SHA1
136992438ecfd311d529e1e9c5aeef2edac155ef

SHA256
80c1b2d9ff49681b77de4b582e881ee0ccc4700c6fb7eec86786d852b0368e80

SHA512
dd299cb3bf7910356f7ccf01a4cb5b07f8dffb72d540ddab6b249496d86492306a609edec27a54e23558da731bf481b83077b684da478ac04a97ba27b5df68e5

Download Submit
/storage/emulated/0/Android/data/com.lyhtgh.pay/plugins/com.lyhtgh.pay.ltplugin.apk

Filesize
380KB

MD5
21d9eb6596947eb260bdcc7bcabdb23a

SHA1
f5ffda71211e4a75a47aa1025c9bae022d9148a6

SHA256
6ed87ddc3daa7a38d927d51d596c8e9fd6e4ead03e004cdac038c82d0bf3c4a2

SHA512
e86f9ab904191facda3f2ae3496d4b497705c50e513970305459c46ca60faa5a0f3e308bd2afe84573d77244e69b4a3eefb53b18b13e6035ce57dab046c5ea8b

Download Submit
/storage/emulated/0/Android/data/com.lyhtgh.pay/plugins/com.lyhtgh.pay.ltplugin.apk

Filesize
380KB

MD5
217cef827df4d5cb5eea55f1ad4d7f8a

SHA1
16f299b3f3c3ae8bdad43784de1d847a4765da0c

SHA256
483d3614859d901b375e781fe474f5843215e81c8698e0e96b29b3d47f17006a

SHA512
1fb4c01bf802a9f49b6321dba2b9d871d879e36e6d5c6eb04337593a8a7320ae1846536b93ecd5e236b79863c049e24e3f0a512894b41d42fbae40e54b3dc296

Download Submit
/storage/emulated/0/sdtmp/id1603f7e65-75a2-4e88-ba94-d1e2a7b79f03.tmp

Filesize
15B

MD5
9faac5092b78514b5cc3ca7422a41ce3

SHA1
fba83f8b165e2e21023d5f82e3e2b8cac31e731e

SHA256
0d6bd637ccbe1f9f24dee69cfe8998636a6737bfd46b1af4b25815f13d2e29ec

SHA512
ce8202b0ce583fc0915c1b2e43880ecfcb6f8b652940b5d2ebdad9924e4b35c38b88632912a32bd0fcfe656ae75f6e49e9b284b65e3d91eb451e34252ac83a2b

Download Submit
/storage/emulated/0/sdtmp/id20fe32a19-8aab-4ec3-8b03-c664ccc54130.tmp

Filesize
15B

MD5
748d9beeaa1899252a7365b780b95fb0

SHA1
2158cbe9044f2b138df0094615afe6616e526c9d

SHA256
59290d2d5a77605f8140feb82e44e8438115fb2f93dc56ed4c225b88c21baaa8

SHA512
cdeb0c4cebf1cc96ebda6940763a940df76120ee991bc7f003480caf055a970f16e4a19ef2ba2c56fa056d539b981e16542ec7239a7b91dd3828585bc2d1e440

Download Submit
/storage/emulated/0/tmpsd11012/test.dat7ffe11c1-7b5f-4218-84f4-a6d48bc24290.tmp

Filesize
36B

MD5
9a7921835ee789d6d47c4fcd31c3f022

SHA1
b62b53a7d5fce5827d61df49a9be44b63846650e

SHA256
8ef8d7301dc82913c01e5b883b5bc9bf6a6ef72c6031b3721f17514531887922

SHA512
bbad10425d88dee51a76220eeefde81a04d9712275e8403d2770a8c7b0cb1c83be62d3a88b9f815ae2ddd6b810b6ec97b646fbfb0b71c0e06b8b24bc8b6cfe97

Download Submit