Analysis
-
max time kernel
2965856s -
max time network
155s -
platform
android_x86 -
resource
android-x86-arm-20231215-en -
resource tags
androidarch:armarch:x86image:android-x86-arm-20231215-enlocale:en-usos:android-9-x86system -
submitted
24/12/2023, 02:39
Static task
static1
Behavioral task
behavioral1
Sample
bd98e2b77d1fd32616f4322fda3cacf6ade979fda083d9fbed5811016bd8dda6.apk
Resource
android-x86-arm-20231215-en
Behavioral task
behavioral2
Sample
bd98e2b77d1fd32616f4322fda3cacf6ade979fda083d9fbed5811016bd8dda6.apk
Resource
android-x64-arm64-20231215-en
Behavioral task
behavioral3
Sample
bdxadsdk.apk
Resource
android-x86-arm-20231215-en
Behavioral task
behavioral4
Sample
bdxadsdk.apk
Resource
android-x64-20231215-en
Behavioral task
behavioral5
Sample
bdxadsdk.apk
Resource
android-x64-arm64-20231215-en
Behavioral task
behavioral6
Sample
gdtadv2.apk
Resource
android-x86-arm-20231215-en
General
-
Target
bd98e2b77d1fd32616f4322fda3cacf6ade979fda083d9fbed5811016bd8dda6.apk
-
Size
26.1MB
-
MD5
caa753c640a5658ec79550ca2b45dfef
-
SHA1
3f790c6229470195e331b94e0fb5f7026ca58ce8
-
SHA256
bd98e2b77d1fd32616f4322fda3cacf6ade979fda083d9fbed5811016bd8dda6
-
SHA512
653d6df2560ac0d995fc7aa18c3592488fb6fd1ee08c4ee2fc7518dd7169d5c34d63dd56efaee3f9f0fc766f425106fc53672181eb23cc5230d1a9c959d72a3a
-
SSDEEP
786432:DL18iG0oy06hgwC9ea8QctTWh8VrLLn5VRgLCv/Qv:D6iloy06FNHQ6aeZrRgLCnQv
Malware Config
Signatures
-
Requests cell location 1 IoCs
Uses Android APIs to to get current cell location.
description ioc Process Framework service call com.android.internal.telephony.ITelephony.getCellLocation com.pcncn.jj -
Loads dropped Dex/Jar 10 IoCs
Runs executable file dropped to the device during analysis.
ioc pid Process /data/data/com.pcncn.jj/.jiagu/classes.dex 4255 com.pcncn.jj /data/data/com.pcncn.jj/.jiagu/classes.dex!classes2.dex 4255 com.pcncn.jj /data/data/com.pcncn.jj/.jiagu/classes.dex!classes3.dex 4255 com.pcncn.jj /data/data/com.pcncn.jj/.jiagu/classes.dex!classes4.dex 4255 com.pcncn.jj /data/data/com.pcncn.jj/.jiagu/tmp.dex 4255 com.pcncn.jj /data/data/com.pcncn.jj/.jiagu/tmp.dex 4292 /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/data/com.pcncn.jj/.jiagu/tmp.dex --output-vdex-fd=43 --oat-fd=44 --oat-location=/data/data/com.pcncn.jj/.jiagu/oat/x86/tmp.odex --compiler-filter=quicken --class-loader-context=& /data/data/com.pcncn.jj/.jiagu/tmp.dex 4255 com.pcncn.jj /data/data/com.pcncn.jj/.jiagu/classes.dex 4535 com.pcncn.jj:pushcore /data/data/com.pcncn.jj/.jiagu/classes.dex!classes2.dex 4535 com.pcncn.jj:pushcore /data/data/com.pcncn.jj/.jiagu/classes.dex!classes3.dex 4535 com.pcncn.jj:pushcore -
Queries the unique device ID (IMEI, MEID, IMSI)
-
Uses Crypto APIs (Might try to encrypt user data) 1 IoCs
description ioc Process Framework API call javax.crypto.Cipher.doFinal com.pcncn.jj
Processes
-
com.pcncn.jj1⤵
- Requests cell location
- Loads dropped Dex/Jar
- Uses Crypto APIs (Might try to encrypt user data)
PID:4255 -
/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/data/com.pcncn.jj/.jiagu/tmp.dex --output-vdex-fd=43 --oat-fd=44 --oat-location=/data/data/com.pcncn.jj/.jiagu/oat/x86/tmp.odex --compiler-filter=quicken --class-loader-context=&2⤵
- Loads dropped Dex/Jar
PID:4292
-
-
getprop ro.build.version.emui2⤵PID:4355
-
-
getprop ro.miui.ui.version.name2⤵PID:4426
-
-
getprop ro.build.version.emui2⤵PID:4446
-
-
getprop ro.build.version.opporom2⤵PID:4465
-
-
getprop ro.vivo.os.version2⤵PID:4483
-
-
getprop ro.smartisan.version2⤵PID:4501
-
-
com.pcncn.jj:pushcore1⤵
- Loads dropped Dex/Jar
PID:4535
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
6.4MB
MD582f58600d8517d4556e90456ed277452
SHA10395125c1fd68fc16dc7bd53a61b09239260716f
SHA256df232d6ff6b5a51e40e1d01eef1f0c9e0286df8d73dff90cad3685f9821b0987
SHA512a7eee542eb6e7e5b1500a1e9c3bfc5016e9cc7a6fc30bbf17558a19f7db57877240efb5cce718bc25e0fb499c74f5b9b9aff06f252a3699985fef3a12e56d5c3
-
Filesize
6.5MB
MD590c1f068e4c0da2b830f85d816afd981
SHA175a46eaaea0005657db60bce37a3660c30b4c495
SHA256eea44fafed2f63db33604d32b04d1c4650a5fa70dc844de61c92d707e51be159
SHA51211bcc8357a299ecfc840dcd729c61e4d574c3198390e914a6a4f60b23ef5bb2939dac0ab3a27514fc73521af43086cdb73196905dd23f333cf8c80ea57ce7a26
-
Filesize
6.0MB
MD56e6b2ba8c71dcc0456804ed5b08e3119
SHA1755cbbc6aef7b6603753ae5d65a4784c218cb7fd
SHA256d9535f4949103805402ef3528015f03a7d3eff9f7e1ea5711bf8691ca0470739
SHA51240031abe05bf5bbcab4eff1f4a35000601a5dcc05df0fbb23384bbc0b772817ae097dd1875ba75c2837bed7dc557cb09ee989fe55aa22d01e5b784e4b3e1ef8f
-
Filesize
5.1MB
MD5a6a1bb28f9722bb57a4204f7de731bec
SHA1be704b24b8639f1705806000fe81ce4a3a4c5bfd
SHA256917140d217be7bab8b2e084a5944c69470e7d5e2b85c5b2d428afae583e2a567
SHA51291b89933fe32804205ee45345e3750c7d1e980c9aa8e75a3cc405bc65de237d7058e3d6f69fdcf3610ae54c4e1f1d5bc4d4ff798857133502c96129735991a95
-
Filesize
491KB
MD5940317093cc329d45cf45ea8713b1c1f
SHA13f9ff8cef8e41d03ea714b8d5f030ad1fcaec0be
SHA25657f0ffa7062aaa03074648a0c9df78ed9d3f78c2f07fb846b11bb1b667e246bc
SHA5123f40076d241bc3a2b83e56d01e826b8cb7d310a67128ac8b1165bdb93dd917c6a7219c1e65dbd8a40432fb38331828c7171e266e8474dfc69db2675e29e2723f
-
Filesize
284B
MD5f1771b68f5f9b168b79ff59ae2daabe4
SHA10df6a835559f5c99670214a12700e7d8c28e5a42
SHA2569f8898ce35a47aeafced99ea0d17c33e73037bb2307c7688e50819966f4ae939
SHA512dae27d19727b89bec49398503baa6801640540355688dfabbe689c97545295c2c2d9b0f0dcd7cbc4cfbf701d0c0c3289e647a152f49ff242d1ecc741efe4145d
-
Filesize
36B
MD537e8e716e0e2f4a0b05cd9571d95b84d
SHA1f8d068f6931707bddb8cd69f706f2224ad1fea3c
SHA2567080cb592d5149c858b206d3fd0d5e3e7d601f120af00b2616bee928ee1291ca
SHA512e62b850901835fdb73fa6224618422f721dd765861d42f6bc2dd013413e96bd910ac5313afd9b4f63da74beb12a15fac81b5157456c9caa3031862dab84423f6
-
Filesize
33B
MD567d4dce5585f78e4a757cf85a81a3893
SHA10298e929309374d3fb1c824e631053bfc2bbff47
SHA256fa640f438f4f65d9c5692a3617c888b66d15c3506197524ef4ce27f3fb07c066
SHA5126b58611e63ad44c25eb61cb18362b9175d9033eeae11ad6d4f98183befc74089295d3f0f81b14644c97bb21600db42cd8c069592a73c5e6113296d5d1906d143
-
Filesize
512B
MD50740836219cc9b49887a008143b2a620
SHA132cda26ffb568090c3520300c874648b17075e5c
SHA2563c9cf53ee34a3ed7cf2da49c227c42c3d7975da54d9a866b837d7f99dd29dc96
SHA512d60234b459f4fa36da5ddf6f78d0815de0c6b2c8a5ee5a98a450fa85d31110efffc84332d10f5214675ca1db759eedcb924b4ddbedea5beed7faf9d73ac5e2bb
-
Filesize
16KB
MD5c5bb30ffddb8eeb07822d14b65a89a3c
SHA13ba7fcca84b91dab83ead90cc80d66579226ecb5
SHA25609666b1d8dbb00f02ee46c04645e8bd66b5623220f0d47c3c71d5044cd0fe7fe
SHA512601c1f9f68d95c8500a87dccb996c20ef97b0f01d7e32734ac3349600fb5daea8aec4b2ccd49febe0fb047ec12a1e35adc2d7453bba499dacd83035dcbab31e3
-
Filesize
512B
MD5589c264db049aef80dfab4db279e148d
SHA1b77d78c4b197eb685132fe6d949f225bc19b03ca
SHA256c85bea4e4b4d96a4e92588ec754c6d89d00d7d24093dcee12091fa7c77c7b7f0
SHA51209aef3eea4ae19054448f6f87b7d2a07985762db43655efe848b9340ef4ee6fcd116d63c407b3ba007b168eb4ce4a84a337869e4ac44b02492b8abc2bcea86fe
-
Filesize
28KB
MD5cf845a781c107ec1346e849c9dd1b7e8
SHA1b44ccc7f7d519352422e59ee8b0bdbac881768a7
SHA25618619b678a5c207a971a0aa931604f48162e307c57ecdec450d5f095fe9f32c7
SHA5124802861ea06dc7fb85229a3c8f04e707a084f1ba516510c6f269821b33c8ee4ebf495258fe5bee4850668a5aac1a45f0edf51580da13b7ee160a29d067c67612
-
Filesize
32KB
MD5f25b61c3b81be712d84e7c9bc51a48de
SHA181bb7ec2dba48c4a053a0f455a9a6a7ebe1b9a1a
SHA256c8e0d38a77c6c042b69937b6d24a97c000adf73d61f0cd1e751741d0afc942b3
SHA51220b24b7ec3d4ef844b7fcc9f698f5c5361ee68321fa97553308ab95400dae71b6f93c0bbf33a0ffe69ddacb613f06bd71183f55386eaa8bbc9f3b6fd51b5c1cd
-
Filesize
512B
MD5f18a682a632dc24cb2fc1d199c02726b
SHA159185de1a2900659796d6c9cf506805847db1125
SHA256aa9209d15fc1a0c6f9c4ecaea90d7236d87e3c1c76f03d75e6a4b36ea10cdbc6
SHA512215b89a7217247d1894736a256fc0fe25364ffd98f9b5a73165802bfeede55f9a50f2f726178a8128b7b830725d883f58ba6f5bdadb67205bc0fca5d5856a048
-
Filesize
136KB
MD50a81a809ce32f931e8dd8735c8a395b6
SHA161292d04b4051604e1a43b1f6a99aec31e0e593b
SHA2566bf238db078d46584b4b1afc1e3dfaac7d592595753de24e4210bf2e61e04eaa
SHA5125cc41aed6b40825fbf17451586902f4957b519d25c34d8c07941f72d39ca06b0956d811125478b26ddf5ba83726655d769475fc307ac22c9c35578346aa6cef1
-
Filesize
4KB
MD5f2b4b0190b9f384ca885f0c8c9b14700
SHA1934ff2646757b5b6e7f20f6a0aa76c7f995d9361
SHA2560a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514
SHA512ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1
-
Filesize
512B
MD515e2f87baa42ea86886c39b5bbfedd2b
SHA1208f9481939e67b600f88dab4ce8c791dac2bbd4
SHA256fbdd9504891e107e9fe02a271fb2bf4041b5d5b7c3accb25b76ab2e88c11c6ed
SHA5125737738d7be76fb212239f7353c3ef346578b781975f73dd64697822b2c7ab31ddb1db8d29515908bc32136d9aa73aad45a53889c655e62f3a3f78fe13c30660
-
Filesize
32KB
MD578ea806c8b8b510d9e8634d5a36ed570
SHA18e783ec4d8f007b71d9bd5eb336d6d3423cd4f27
SHA2564c9e5fb539fcc79ec9d201c7f36ce94172b55d86e9743019340fab7509aafa6f
SHA512461f6e240eee18e8e6347a7b9d93288ac4da607dda4ec7beac735fe470033d81ce8214e16b0be87653539ad52fd70b072217cc70c2d8a2fc5c845373ac1ab369
-
Filesize
512B
MD56276d090761eb7c3bc20e910d35923c9
SHA149f3d56f5395384f1083787c56cf7814614bd97c
SHA25691b3f4f43660ad75cec7a0176c86affebfea9c821874158729637bcbc4c70fe5
SHA512bb2fc085061e31ec2d5b2974b28d5892e35a9a846ee49278a29008c81070fcaaa14e7d2f0f5c43bfb71eac2095126aedf77c18f9da90440d29b27474384607dd
-
Filesize
68KB
MD52e0a3496bb4c95d8573f01c7075d252d
SHA19e2788f7d38f8fccb850a0050148a90e40d0c79f
SHA2561fc7ae8aa101da11fd5ea38a357c15788549a9833b3a85cf669fef1f24a83bfe
SHA5125cae867f5a954aa55278216f097b49b6fac6a3533c864555894fe8c9661ee5ea530605a575a00762e502d2081967bba6d7bdf8ac19404197e4f6d1dec24db700
-
Filesize
40B
MD53882fd0701b8d988207d375910a7f379
SHA1121e7743be0692a45b9f9ef9e57263087735bdc3
SHA2562a3e44b0047629448e9558c5921b3c742f9bb12f1997094739e05d425f6cb0dd
SHA5126743e43008da75373fd0ff7c79c4ade58b283ee695390d27b546b8776402e4735bab3cb718949d137a789623b7ee3116063dae6ef7c19bb3bb0e6af1c1f47bee
-
Filesize
109B
MD50d03cea7c4d4611b4c3bdd85fbedaf41
SHA1d44690eef34ce16b5744f56174f519d9993d2de9
SHA256a97041bea03bc3f079346d36c44ba906dce4a87a221c0b54f93c4731de6cc214
SHA512fbfb1b684931b24a9dd8ec8e8459ce312ee085d1f6f0e6a6fced48abd78040008f91d56c7dead1e5d6d3b6f48e95787364c9de22408a62f2e0b4435a92a0d36c
-
/storage/emulated/0/Android/data/com.pcncn.jj/cache/tt_tmpl_pkg/template/ad6bd3e6bc7eec226d76280544f2ef19.tmp
Filesize6KB
MD52470f63dc14e1de6877348facf6408e4
SHA131098762c3ed2996e6654faacd843bce7312d884
SHA256a1f828933e367d1bd68813e09eb9f45c203cdbfcd1d1a9da2d2e4d8048de9125
SHA512a50554e077644986f5541af86c5672ef552f62296939c043e7f7cc54e1f8bea233eae179ae20c86b80c82fe7aa17f18b7a8e3515d4d45a9b2edaafabc8329595
-
/storage/emulated/0/Android/data/com.pcncn.jj/cache/tt_tmpl_pkg/template/efbcd986c1fee7f430303b1db3ac9661.tmp
Filesize150KB
MD56770b726db365023857d2b9bb6e6abbe
SHA1de64fee12a1cf44820729753de16e73b8d67434a
SHA2567d6cba801b8221a435e3d5144f51df85d9c3274e66d4588f21cc3f604e66b908
SHA51246aa768f309f61692eb3a9a07e7ffdc5ff97f065375f7d9130badce51a531d125f9756afb7dd1a21807c672a9eff3cbd4bff00e9864d725b08127f95eec64eb8
-
Filesize
31B
MD58c92de9ce46d41a22f3b20f77404cc1d
SHA18671a6dca00edb72be47363a7071be65cf270373
SHA25668bb33ddeed9200be85a71f70b377985f9ee68e91578afbde8321463396f1274
SHA51230f45fe9954215d6adafcc8f0a060a7ff41963a64f9b849a37f0d18fe045038d429ec13bf15226769c4ba78dad3c52f3d9e0dbbb4fcdea4828a1efe956e48f56
-
Filesize
36B
MD5526111f7c321a5d83b4199535a01f087
SHA19dc8990254140197131a79d6a5bbee474dfc1117
SHA256861fef0d900ac4bb683b8783cfcd2582d6203b14bb8d573735a2485801b2ffbb
SHA512722d7c4f50fbd78c4c0cd6dea94513a966fa417fbdc0d288e136647298226e318fe96a53ec1ee90b1cef63d2b4ce28b8830efc6f767d051181a125c9c9595890
-
Filesize
32B
MD58b3358863805e90ae315ea27dbdd4487
SHA19d269248df6d91213e812f5e7b02ed14a48acd6d
SHA256ee3d928ca59912c3ebe7e4fb1c196c96976b5062a751343a8aa465c6906cf9c1
SHA512a33183c69d06d50ebf1cd533b698af206114e5f1eb5fdc709842d16d15086f1f2792d55d547949636d66540e6b7100e8eb2d8993f6b8274ae7e668f6d45fda52
-
Filesize
24KB
MD525b5cc5f79e5cbaeb95e26bc8c7f24ca
SHA15d5650092051d7cc5d9fd0dcb34fa1258df580bf
SHA256ede48a567b6df53b93c179712d93591a0371a7d27762675dedfafaaca0cb7b56
SHA51210815dbaf65ae37d103da9e31d35d1b8bcf8b5fe1304d45ed356e1515580f55ce0aaee2d04e29c9e0493c9abe4b7412d68e2d141aad67e87d1711fb3e6cc24e9
-
Filesize
24KB
MD5485c1e8d9156e65e7731fc4c7392b306
SHA182153107423ff3c1592b70f383ec5d492eac43bc
SHA256a43b2e467dfba7939119b88a54656c194b09f20b52e7005652d66f504d3d8bd1
SHA512a7a59d1b8aee398142cd29b9a8beaafa816b01961a81e73d86739ee3393c22610cbf5787c9615d887bd6d77595f2b752ef516731eb169377fe87fc3684eca654
-
Filesize
8KB
MD50b895548c02bdb35d27708b2d48d47ca
SHA1a410084e76022eb0766c83a8277762f48d927fb2
SHA25618fddf94b9354474e75c5fd0a5df3092754b72df915729944d71515fc87b084d
SHA51283a14f73bb873f5b77c2a3cca38cb9146e9c0d9369e1d16e2002f2cd762ec0894e5d6cb3d7b4f9a0fde59a388a17eb5878a2b3b84afe7deda5a2709fef4aa9ce
-
Filesize
8KB
MD50a3b9e4c5a1eb7241827c7fba2e504d2
SHA15ec14a4faab7eac3dc69460d79a7190b8bb5f957
SHA256889c19967339f648b832020efead3dd1953ab81919f91b85c694512d4249dbc0
SHA512b65e54e24b8a984f5e6bdf84ce09761a42370fc43d3959a9abf70c554f751e3ad155d4f7b05a3f775eba4a0501aeafaa7f6ee2bb4252cef45c55afdcb789e667
-
Filesize
12KB
MD595884c1af28d477ce407c279528461bd
SHA1e3ffad37436e569811a78197e3eaa74204dbbc45
SHA256b2693d4bb03d43023ba62a965200749755ff96dd471a0953fcb060bee5d8d0e2
SHA512f5fa073b3981b91309d3f4296dc7465c8e5a20f25e63b93c44b04bcced045c68cfd21f36fee98acc0994bca38f9e2899295e1ba01c1e9108b2c9365f2abe14a9
-
Filesize
55B
MD57b26c0495351dcdcc8485838a3f2f578
SHA18194a948991dfcedc58836e289a78c0cb637062a
SHA256c1822d8017548e18acd7d0dc2a3de0043e6192eefe171b5bb025d04e26f2b0cb
SHA512c41e5e07470fbc0d4bbe86481a2007b079fe94508c62420fc568f168dafd2f114619d99630709d4d318c9b2a71ea0d0ca58161a8c5b35bb44bbee1bcfa567c0c
-
Filesize
84B
MD56a07319cf63e3043de9e9c35b615439c
SHA11e4de0a78ca13ddbc67f0f1a671025581cd60c31
SHA256605c2aa81cce66e685ddbd3d4251f4ce310f1cc3089f417d49c0acc9dfe2c4f9
SHA5123105cce5a026f876c57b6dd0497e3c9f6c7ef2ee55ffe23959f2c1a43acc77e65ce450672e00e11121de2d638fb1be1f84055521b84915267ab1da7fcfeb6c11