Analysis

  • max time kernel
    2965856s
  • max time network
    155s
  • platform
    android_x86
  • resource
    android-x86-arm-20231215-en
  • resource tags

    androidarch:armarch:x86image:android-x86-arm-20231215-enlocale:en-usos:android-9-x86system
  • submitted
    24/12/2023, 02:39

General

  • Target

    bd98e2b77d1fd32616f4322fda3cacf6ade979fda083d9fbed5811016bd8dda6.apk

  • Size

    26.1MB

  • MD5

    caa753c640a5658ec79550ca2b45dfef

  • SHA1

    3f790c6229470195e331b94e0fb5f7026ca58ce8

  • SHA256

    bd98e2b77d1fd32616f4322fda3cacf6ade979fda083d9fbed5811016bd8dda6

  • SHA512

    653d6df2560ac0d995fc7aa18c3592488fb6fd1ee08c4ee2fc7518dd7169d5c34d63dd56efaee3f9f0fc766f425106fc53672181eb23cc5230d1a9c959d72a3a

  • SSDEEP

    786432:DL18iG0oy06hgwC9ea8QctTWh8VrLLn5VRgLCv/Qv:D6iloy06FNHQ6aeZrRgLCnQv

Score
8/10

Malware Config

Signatures

  • Requests cell location 1 IoCs

    Uses Android APIs to to get current cell location.

  • Loads dropped Dex/Jar 10 IoCs

    Runs executable file dropped to the device during analysis.

  • Queries the unique device ID (IMEI, MEID, IMSI)
  • Uses Crypto APIs (Might try to encrypt user data) 1 IoCs

Processes

  • com.pcncn.jj
    1⤵
    • Requests cell location
    • Loads dropped Dex/Jar
    • Uses Crypto APIs (Might try to encrypt user data)
    PID:4255
    • /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/data/com.pcncn.jj/.jiagu/tmp.dex --output-vdex-fd=43 --oat-fd=44 --oat-location=/data/data/com.pcncn.jj/.jiagu/oat/x86/tmp.odex --compiler-filter=quicken --class-loader-context=&
      2⤵
      • Loads dropped Dex/Jar
      PID:4292
    • getprop ro.build.version.emui
      2⤵
        PID:4355
      • getprop ro.miui.ui.version.name
        2⤵
          PID:4426
        • getprop ro.build.version.emui
          2⤵
            PID:4446
          • getprop ro.build.version.opporom
            2⤵
              PID:4465
            • getprop ro.vivo.os.version
              2⤵
                PID:4483
              • getprop ro.smartisan.version
                2⤵
                  PID:4501
              • com.pcncn.jj:pushcore
                1⤵
                • Loads dropped Dex/Jar
                PID:4535

              Network

                    MITRE ATT&CK Matrix

                    Replay Monitor

                    Loading Replay Monitor...

                    Downloads

                    • /data/data/com.pcncn.jj/.jiagu/classes.dex

                      Filesize

                      6.4MB

                      MD5

                      82f58600d8517d4556e90456ed277452

                      SHA1

                      0395125c1fd68fc16dc7bd53a61b09239260716f

                      SHA256

                      df232d6ff6b5a51e40e1d01eef1f0c9e0286df8d73dff90cad3685f9821b0987

                      SHA512

                      a7eee542eb6e7e5b1500a1e9c3bfc5016e9cc7a6fc30bbf17558a19f7db57877240efb5cce718bc25e0fb499c74f5b9b9aff06f252a3699985fef3a12e56d5c3

                    • /data/data/com.pcncn.jj/.jiagu/classes.dex!classes2.dex

                      Filesize

                      6.5MB

                      MD5

                      90c1f068e4c0da2b830f85d816afd981

                      SHA1

                      75a46eaaea0005657db60bce37a3660c30b4c495

                      SHA256

                      eea44fafed2f63db33604d32b04d1c4650a5fa70dc844de61c92d707e51be159

                      SHA512

                      11bcc8357a299ecfc840dcd729c61e4d574c3198390e914a6a4f60b23ef5bb2939dac0ab3a27514fc73521af43086cdb73196905dd23f333cf8c80ea57ce7a26

                    • /data/data/com.pcncn.jj/.jiagu/classes.dex!classes3.dex

                      Filesize

                      6.0MB

                      MD5

                      6e6b2ba8c71dcc0456804ed5b08e3119

                      SHA1

                      755cbbc6aef7b6603753ae5d65a4784c218cb7fd

                      SHA256

                      d9535f4949103805402ef3528015f03a7d3eff9f7e1ea5711bf8691ca0470739

                      SHA512

                      40031abe05bf5bbcab4eff1f4a35000601a5dcc05df0fbb23384bbc0b772817ae097dd1875ba75c2837bed7dc557cb09ee989fe55aa22d01e5b784e4b3e1ef8f

                    • /data/data/com.pcncn.jj/.jiagu/classes.dex!classes4.dex

                      Filesize

                      5.1MB

                      MD5

                      a6a1bb28f9722bb57a4204f7de731bec

                      SHA1

                      be704b24b8639f1705806000fe81ce4a3a4c5bfd

                      SHA256

                      917140d217be7bab8b2e084a5944c69470e7d5e2b85c5b2d428afae583e2a567

                      SHA512

                      91b89933fe32804205ee45345e3750c7d1e980c9aa8e75a3cc405bc65de237d7058e3d6f69fdcf3610ae54c4e1f1d5bc4d4ff798857133502c96129735991a95

                    • /data/data/com.pcncn.jj/.jiagu/libjiagu.so

                      Filesize

                      491KB

                      MD5

                      940317093cc329d45cf45ea8713b1c1f

                      SHA1

                      3f9ff8cef8e41d03ea714b8d5f030ad1fcaec0be

                      SHA256

                      57f0ffa7062aaa03074648a0c9df78ed9d3f78c2f07fb846b11bb1b667e246bc

                      SHA512

                      3f40076d241bc3a2b83e56d01e826b8cb7d310a67128ac8b1165bdb93dd917c6a7219c1e65dbd8a40432fb38331828c7171e266e8474dfc69db2675e29e2723f

                    • /data/data/com.pcncn.jj/.jiagu/tmp.dex

                      Filesize

                      284B

                      MD5

                      f1771b68f5f9b168b79ff59ae2daabe4

                      SHA1

                      0df6a835559f5c99670214a12700e7d8c28e5a42

                      SHA256

                      9f8898ce35a47aeafced99ea0d17c33e73037bb2307c7688e50819966f4ae939

                      SHA512

                      dae27d19727b89bec49398503baa6801640540355688dfabbe689c97545295c2c2d9b0f0dcd7cbc4cfbf701d0c0c3289e647a152f49ff242d1ecc741efe4145d

                    • /data/data/com.pcncn.jj/cache/HttpCache/journal.tmp

                      Filesize

                      36B

                      MD5

                      37e8e716e0e2f4a0b05cd9571d95b84d

                      SHA1

                      f8d068f6931707bddb8cd69f706f2224ad1fea3c

                      SHA256

                      7080cb592d5149c858b206d3fd0d5e3e7d601f120af00b2616bee928ee1291ca

                      SHA512

                      e62b850901835fdb73fa6224618422f721dd765861d42f6bc2dd013413e96bd910ac5313afd9b4f63da74beb12a15fac81b5157456c9caa3031862dab84423f6

                    • /data/data/com.pcncn.jj/cache/zyjlCacheDir/journal.tmp

                      Filesize

                      33B

                      MD5

                      67d4dce5585f78e4a757cf85a81a3893

                      SHA1

                      0298e929309374d3fb1c824e631053bfc2bbff47

                      SHA256

                      fa640f438f4f65d9c5692a3617c888b66d15c3506197524ef4ce27f3fb07c066

                      SHA512

                      6b58611e63ad44c25eb61cb18362b9175d9033eeae11ad6d4f98183befc74089295d3f0f81b14644c97bb21600db42cd8c069592a73c5e6113296d5d1906d143

                    • /data/data/com.pcncn.jj/databases/bd_embed_tea_agent.db-journal

                      Filesize

                      512B

                      MD5

                      0740836219cc9b49887a008143b2a620

                      SHA1

                      32cda26ffb568090c3520300c874648b17075e5c

                      SHA256

                      3c9cf53ee34a3ed7cf2da49c227c42c3d7975da54d9a866b837d7f99dd29dc96

                      SHA512

                      d60234b459f4fa36da5ddf6f78d0815de0c6b2c8a5ee5a98a450fa85d31110efffc84332d10f5214675ca1db759eedcb924b4ddbedea5beed7faf9d73ac5e2bb

                    • /data/data/com.pcncn.jj/databases/bd_embed_tea_agent.db-wal

                      Filesize

                      16KB

                      MD5

                      c5bb30ffddb8eeb07822d14b65a89a3c

                      SHA1

                      3ba7fcca84b91dab83ead90cc80d66579226ecb5

                      SHA256

                      09666b1d8dbb00f02ee46c04645e8bd66b5623220f0d47c3c71d5044cd0fe7fe

                      SHA512

                      601c1f9f68d95c8500a87dccb996c20ef97b0f01d7e32734ac3349600fb5daea8aec4b2ccd49febe0fb047ec12a1e35adc2d7453bba499dacd83035dcbab31e3

                    • /data/data/com.pcncn.jj/databases/bytedance_downloader.db-journal

                      Filesize

                      512B

                      MD5

                      589c264db049aef80dfab4db279e148d

                      SHA1

                      b77d78c4b197eb685132fe6d949f225bc19b03ca

                      SHA256

                      c85bea4e4b4d96a4e92588ec754c6d89d00d7d24093dcee12091fa7c77c7b7f0

                      SHA512

                      09aef3eea4ae19054448f6f87b7d2a07985762db43655efe848b9340ef4ee6fcd116d63c407b3ba007b168eb4ce4a84a337869e4ac44b02492b8abc2bcea86fe

                    • /data/data/com.pcncn.jj/databases/bytedance_downloader.db-shm

                      Filesize

                      28KB

                      MD5

                      cf845a781c107ec1346e849c9dd1b7e8

                      SHA1

                      b44ccc7f7d519352422e59ee8b0bdbac881768a7

                      SHA256

                      18619b678a5c207a971a0aa931604f48162e307c57ecdec450d5f095fe9f32c7

                      SHA512

                      4802861ea06dc7fb85229a3c8f04e707a084f1ba516510c6f269821b33c8ee4ebf495258fe5bee4850668a5aac1a45f0edf51580da13b7ee160a29d067c67612

                    • /data/data/com.pcncn.jj/databases/bytedance_downloader.db-wal

                      Filesize

                      32KB

                      MD5

                      f25b61c3b81be712d84e7c9bc51a48de

                      SHA1

                      81bb7ec2dba48c4a053a0f455a9a6a7ebe1b9a1a

                      SHA256

                      c8e0d38a77c6c042b69937b6d24a97c000adf73d61f0cd1e751741d0afc942b3

                      SHA512

                      20b24b7ec3d4ef844b7fcc9f698f5c5361ee68321fa97553308ab95400dae71b6f93c0bbf33a0ffe69ddacb613f06bd71183f55386eaa8bbc9f3b6fd51b5c1cd

                    • /data/data/com.pcncn.jj/databases/db_cache_http_2-journal

                      Filesize

                      512B

                      MD5

                      f18a682a632dc24cb2fc1d199c02726b

                      SHA1

                      59185de1a2900659796d6c9cf506805847db1125

                      SHA256

                      aa9209d15fc1a0c6f9c4ecaea90d7236d87e3c1c76f03d75e6a4b36ea10cdbc6

                      SHA512

                      215b89a7217247d1894736a256fc0fe25364ffd98f9b5a73165802bfeede55f9a50f2f726178a8128b7b830725d883f58ba6f5bdadb67205bc0fca5d5856a048

                    • /data/data/com.pcncn.jj/databases/db_cache_http_2-wal

                      Filesize

                      136KB

                      MD5

                      0a81a809ce32f931e8dd8735c8a395b6

                      SHA1

                      61292d04b4051604e1a43b1f6a99aec31e0e593b

                      SHA256

                      6bf238db078d46584b4b1afc1e3dfaac7d592595753de24e4210bf2e61e04eaa

                      SHA512

                      5cc41aed6b40825fbf17451586902f4957b519d25c34d8c07941f72d39ca06b0956d811125478b26ddf5ba83726655d769475fc307ac22c9c35578346aa6cef1

                    • /data/data/com.pcncn.jj/databases/npth_log.db

                      Filesize

                      4KB

                      MD5

                      f2b4b0190b9f384ca885f0c8c9b14700

                      SHA1

                      934ff2646757b5b6e7f20f6a0aa76c7f995d9361

                      SHA256

                      0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514

                      SHA512

                      ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1

                    • /data/data/com.pcncn.jj/databases/npth_log.db-journal

                      Filesize

                      512B

                      MD5

                      15e2f87baa42ea86886c39b5bbfedd2b

                      SHA1

                      208f9481939e67b600f88dab4ce8c791dac2bbd4

                      SHA256

                      fbdd9504891e107e9fe02a271fb2bf4041b5d5b7c3accb25b76ab2e88c11c6ed

                      SHA512

                      5737738d7be76fb212239f7353c3ef346578b781975f73dd64697822b2c7ab31ddb1db8d29515908bc32136d9aa73aad45a53889c655e62f3a3f78fe13c30660

                    • /data/data/com.pcncn.jj/databases/npth_log.db-wal

                      Filesize

                      32KB

                      MD5

                      78ea806c8b8b510d9e8634d5a36ed570

                      SHA1

                      8e783ec4d8f007b71d9bd5eb336d6d3423cd4f27

                      SHA256

                      4c9e5fb539fcc79ec9d201c7f36ce94172b55d86e9743019340fab7509aafa6f

                      SHA512

                      461f6e240eee18e8e6347a7b9d93288ac4da607dda4ec7beac735fe470033d81ce8214e16b0be87653539ad52fd70b072217cc70c2d8a2fc5c845373ac1ab369

                    • /data/data/com.pcncn.jj/databases/ttopensdk.db-journal

                      Filesize

                      512B

                      MD5

                      6276d090761eb7c3bc20e910d35923c9

                      SHA1

                      49f3d56f5395384f1083787c56cf7814614bd97c

                      SHA256

                      91b3f4f43660ad75cec7a0176c86affebfea9c821874158729637bcbc4c70fe5

                      SHA512

                      bb2fc085061e31ec2d5b2974b28d5892e35a9a846ee49278a29008c81070fcaaa14e7d2f0f5c43bfb71eac2095126aedf77c18f9da90440d29b27474384607dd

                    • /data/data/com.pcncn.jj/databases/ttopensdk.db-wal

                      Filesize

                      68KB

                      MD5

                      2e0a3496bb4c95d8573f01c7075d252d

                      SHA1

                      9e2788f7d38f8fccb850a0050148a90e40d0c79f

                      SHA256

                      1fc7ae8aa101da11fd5ea38a357c15788549a9833b3a85cf669fef1f24a83bfe

                      SHA512

                      5cae867f5a954aa55278216f097b49b6fac6a3533c864555894fe8c9661ee5ea530605a575a00762e502d2081967bba6d7bdf8ac19404197e4f6d1dec24db700

                    • /data/data/com.pcncn.jj/files/.jglogs/.jg.ac

                      Filesize

                      40B

                      MD5

                      3882fd0701b8d988207d375910a7f379

                      SHA1

                      121e7743be0692a45b9f9ef9e57263087735bdc3

                      SHA256

                      2a3e44b0047629448e9558c5921b3c742f9bb12f1997094739e05d425f6cb0dd

                      SHA512

                      6743e43008da75373fd0ff7c79c4ade58b283ee695390d27b546b8776402e4735bab3cb718949d137a789623b7ee3116063dae6ef7c19bb3bb0e6af1c1f47bee

                    • /data/data/com.pcncn.jj/files/libcuid.so

                      Filesize

                      109B

                      MD5

                      0d03cea7c4d4611b4c3bdd85fbedaf41

                      SHA1

                      d44690eef34ce16b5744f56174f519d9993d2de9

                      SHA256

                      a97041bea03bc3f079346d36c44ba906dce4a87a221c0b54f93c4731de6cc214

                      SHA512

                      fbfb1b684931b24a9dd8ec8e8459ce312ee085d1f6f0e6a6fced48abd78040008f91d56c7dead1e5d6d3b6f48e95787364c9de22408a62f2e0b4435a92a0d36c

                    • /storage/emulated/0/Android/data/com.pcncn.jj/cache/tt_tmpl_pkg/template/ad6bd3e6bc7eec226d76280544f2ef19.tmp

                      Filesize

                      6KB

                      MD5

                      2470f63dc14e1de6877348facf6408e4

                      SHA1

                      31098762c3ed2996e6654faacd843bce7312d884

                      SHA256

                      a1f828933e367d1bd68813e09eb9f45c203cdbfcd1d1a9da2d2e4d8048de9125

                      SHA512

                      a50554e077644986f5541af86c5672ef552f62296939c043e7f7cc54e1f8bea233eae179ae20c86b80c82fe7aa17f18b7a8e3515d4d45a9b2edaafabc8329595

                    • /storage/emulated/0/Android/data/com.pcncn.jj/cache/tt_tmpl_pkg/template/efbcd986c1fee7f430303b1db3ac9661.tmp

                      Filesize

                      150KB

                      MD5

                      6770b726db365023857d2b9bb6e6abbe

                      SHA1

                      de64fee12a1cf44820729753de16e73b8d67434a

                      SHA256

                      7d6cba801b8221a435e3d5144f51df85d9c3274e66d4588f21cc3f604e66b908

                      SHA512

                      46aa768f309f61692eb3a9a07e7ffdc5ff97f065375f7d9130badce51a531d125f9756afb7dd1a21807c672a9eff3cbd4bff00e9864d725b08127f95eec64eb8

                    • /storage/emulated/0/Android/data/com.pcncn.jj/cache/uil-images/journal.tmp

                      Filesize

                      31B

                      MD5

                      8c92de9ce46d41a22f3b20f77404cc1d

                      SHA1

                      8671a6dca00edb72be47363a7071be65cf270373

                      SHA256

                      68bb33ddeed9200be85a71f70b377985f9ee68e91578afbde8321463396f1274

                      SHA512

                      30f45fe9954215d6adafcc8f0a060a7ff41963a64f9b849a37f0d18fe045038d429ec13bf15226769c4ba78dad3c52f3d9e0dbbb4fcdea4828a1efe956e48f56

                    • /storage/emulated/0/Android/data/com.snssdk.api/cache/clientudid.dat

                      Filesize

                      36B

                      MD5

                      526111f7c321a5d83b4199535a01f087

                      SHA1

                      9dc8990254140197131a79d6a5bbee474dfc1117

                      SHA256

                      861fef0d900ac4bb683b8783cfcd2582d6203b14bb8d573735a2485801b2ffbb

                      SHA512

                      722d7c4f50fbd78c4c0cd6dea94513a966fa417fbdc0d288e136647298226e318fe96a53ec1ee90b1cef63d2b4ce28b8830efc6f767d051181a125c9c9595890

                    • /storage/emulated/0/Pictures/9493fc1f6f98527c0d455b074eecedbe

                      Filesize

                      32B

                      MD5

                      8b3358863805e90ae315ea27dbdd4487

                      SHA1

                      9d269248df6d91213e812f5e7b02ed14a48acd6d

                      SHA256

                      ee3d928ca59912c3ebe7e4fb1c196c96976b5062a751343a8aa465c6906cf9c1

                      SHA512

                      a33183c69d06d50ebf1cd533b698af206114e5f1eb5fdc709842d16d15086f1f2792d55d547949636d66540e6b7100e8eb2d8993f6b8274ae7e668f6d45fda52

                    • /storage/emulated/0/backups/system/.confd

                      Filesize

                      24KB

                      MD5

                      25b5cc5f79e5cbaeb95e26bc8c7f24ca

                      SHA1

                      5d5650092051d7cc5d9fd0dcb34fa1258df580bf

                      SHA256

                      ede48a567b6df53b93c179712d93591a0371a7d27762675dedfafaaca0cb7b56

                      SHA512

                      10815dbaf65ae37d103da9e31d35d1b8bcf8b5fe1304d45ed356e1515580f55ce0aaee2d04e29c9e0493c9abe4b7412d68e2d141aad67e87d1711fb3e6cc24e9

                    • /storage/emulated/0/backups/system/.confd

                      Filesize

                      24KB

                      MD5

                      485c1e8d9156e65e7731fc4c7392b306

                      SHA1

                      82153107423ff3c1592b70f383ec5d492eac43bc

                      SHA256

                      a43b2e467dfba7939119b88a54656c194b09f20b52e7005652d66f504d3d8bd1

                      SHA512

                      a7a59d1b8aee398142cd29b9a8beaafa816b01961a81e73d86739ee3393c22610cbf5787c9615d887bd6d77595f2b752ef516731eb169377fe87fc3684eca654

                    • /storage/emulated/0/backups/system/.confd-wal

                      Filesize

                      8KB

                      MD5

                      0b895548c02bdb35d27708b2d48d47ca

                      SHA1

                      a410084e76022eb0766c83a8277762f48d927fb2

                      SHA256

                      18fddf94b9354474e75c5fd0a5df3092754b72df915729944d71515fc87b084d

                      SHA512

                      83a14f73bb873f5b77c2a3cca38cb9146e9c0d9369e1d16e2002f2cd762ec0894e5d6cb3d7b4f9a0fde59a388a17eb5878a2b3b84afe7deda5a2709fef4aa9ce

                    • /storage/emulated/0/backups/system/.confd-wal

                      Filesize

                      8KB

                      MD5

                      0a3b9e4c5a1eb7241827c7fba2e504d2

                      SHA1

                      5ec14a4faab7eac3dc69460d79a7190b8bb5f957

                      SHA256

                      889c19967339f648b832020efead3dd1953ab81919f91b85c694512d4249dbc0

                      SHA512

                      b65e54e24b8a984f5e6bdf84ce09761a42370fc43d3959a9abf70c554f751e3ad155d4f7b05a3f775eba4a0501aeafaa7f6ee2bb4252cef45c55afdcb789e667

                    • /storage/emulated/0/backups/system/.confd-wal

                      Filesize

                      12KB

                      MD5

                      95884c1af28d477ce407c279528461bd

                      SHA1

                      e3ffad37436e569811a78197e3eaa74204dbbc45

                      SHA256

                      b2693d4bb03d43023ba62a965200749755ff96dd471a0953fcb060bee5d8d0e2

                      SHA512

                      f5fa073b3981b91309d3f4296dc7465c8e5a20f25e63b93c44b04bcced045c68cfd21f36fee98acc0994bca38f9e2899295e1ba01c1e9108b2c9365f2abe14a9

                    • /storage/emulated/0/backups/system/.timestamp

                      Filesize

                      55B

                      MD5

                      7b26c0495351dcdcc8485838a3f2f578

                      SHA1

                      8194a948991dfcedc58836e289a78c0cb637062a

                      SHA256

                      c1822d8017548e18acd7d0dc2a3de0043e6192eefe171b5bb025d04e26f2b0cb

                      SHA512

                      c41e5e07470fbc0d4bbe86481a2007b079fe94508c62420fc568f168dafd2f114619d99630709d4d318c9b2a71ea0d0ca58161a8c5b35bb44bbee1bcfa567c0c

                    • /storage/emulated/0/backups/system/.timestamp

                      Filesize

                      84B

                      MD5

                      6a07319cf63e3043de9e9c35b615439c

                      SHA1

                      1e4de0a78ca13ddbc67f0f1a671025581cd60c31

                      SHA256

                      605c2aa81cce66e685ddbd3d4251f4ce310f1cc3089f417d49c0acc9dfe2c4f9

                      SHA512

                      3105cce5a026f876c57b6dd0497e3c9f6c7ef2ee55ffe23959f2c1a43acc77e65ce450672e00e11121de2d638fb1be1f84055521b84915267ab1da7fcfeb6c11