Analysis

  • max time kernel
    2957966s
  • max time network
    162s
  • platform
    android_x86
  • resource
    android-x86-arm-20231215-en
  • resource tags

    androidarch:armarch:x86image:android-x86-arm-20231215-enlocale:en-usos:android-9-x86system
  • submitted
    24/12/2023, 02:45

General

  • Target

    be6b79bb97331013a15eab5628b59bf09ac27dd7e6b51ba9fd961537dcf994be.apk

  • Size

    14.9MB

  • MD5

    bd714520084011e8ad1ea94932ad29e3

  • SHA1

    cf2c1ba3207b75a389836d0607cbe91e71c0508d

  • SHA256

    be6b79bb97331013a15eab5628b59bf09ac27dd7e6b51ba9fd961537dcf994be

  • SHA512

    5e89e5bf7c9e2647de9fc39002ad3ab2d70be0e81a83261eb976e7740f48cae8e952cff231a8d37a7155da6f9a900d0551dca6175f00859bbf10fb4b651a6e2c

  • SSDEEP

    393216:Py/yJjKwmMnphLsqLYbxhdwhYehgzyUNw8wzaZb8hQzh:6/yJ+wmMphLsqsZwieqOFzal8hCh

Score
6/10

Malware Config

Signatures

  • Reads information about phone network operator.
  • Uses Crypto APIs (Might try to encrypt user data) 1 IoCs

Processes

  • com.wufan.test20180312957733629
    1⤵
    • Uses Crypto APIs (Might try to encrypt user data)
    PID:4262
    • cat /sys/class/net/wlan0/address
      2⤵
        PID:4398
      • cat /sys/class/net/wlan0/address
        2⤵
          PID:4447
        • cat /sys/class/net/wlan0/address
          2⤵
            PID:4466
          • cat /sys/class/net/wlan0/address
            2⤵
              PID:4504
            • cat /sys/class/net/wlan0/address
              2⤵
                PID:4533
              • cat /sys/class/net/wlan0/address
                2⤵
                  PID:4563
                • cat /sys/class/net/wlan0/address
                  2⤵
                    PID:4582
                  • cat /sys/class/net/wlan0/address
                    2⤵
                      PID:4601
                    • cat /sys/class/net/wlan0/address
                      2⤵
                        PID:4660
                      • cat /sys/class/net/wlan0/address
                        2⤵
                          PID:4679
                        • cat /sys/class/net/wlan0/address
                          2⤵
                            PID:4698
                          • cat /sys/class/net/wlan0/address
                            2⤵
                              PID:4727
                            • cat /sys/class/net/wlan0/address
                              2⤵
                                PID:4747
                              • cat /sys/class/net/wlan0/address
                                2⤵
                                  PID:4766
                                • cat /sys/class/net/wlan0/address
                                  2⤵
                                    PID:4796
                                  • cat /sys/class/net/wlan0/address
                                    2⤵
                                      PID:4814
                                    • cat /sys/class/net/wlan0/address
                                      2⤵
                                        PID:4832
                                    • com.wufan.test20180312957733629:lebian.base
                                      1⤵
                                        PID:4292

                                      Network

                                      MITRE ATT&CK Matrix

                                      Replay Monitor

                                      Loading Replay Monitor...

                                      Downloads

                                      • /data/data/com.wufan.test20180312957733629/databases/ThrowalbeLog.db-journal

                                        Filesize

                                        512B

                                        MD5

                                        9d580e3a973aeddf33836b324440b20c

                                        SHA1

                                        66d8527d72ccc1c1908b06982f96c56353e29850

                                        SHA256

                                        dbb44c1934eb4282039c4077811c00e18531512dd2e8169f454fa5bd2bf8431b

                                        SHA512

                                        169d4d6d8b25a55278561faf40b1b0dec87c788edb776613e436a7698f93d4687cd27e92f0470ec179ec1e75b42fa8077691a1fb188f4280f94e7807c9ea4065

                                      • /data/data/com.wufan.test20180312957733629/databases/ThrowalbeLog.db-wal

                                        Filesize

                                        32KB

                                        MD5

                                        18a53d084d84d09d2b6d9879f5687397

                                        SHA1

                                        9674b522dfed84d9eceab3cfadd8fbcfe7355064

                                        SHA256

                                        7346e4ebb112b33b073f2799bc05e0b557c32b026c8dee2554d51ba51f692ce5

                                        SHA512

                                        30e3b4f49c4943e3b688a72447f4c1e77652529825fd7798a40de9549a8469955f40aa7ed6b01cc30df320bda59e9bac6b7d169586e81a971f6185f9c20c380f

                                      • /data/data/com.wufan.test20180312957733629/databases/mgdb-journal

                                        Filesize

                                        512B

                                        MD5

                                        1dcde3c4dd262e36a2e1187999dc3b29

                                        SHA1

                                        6b0f8efb55925c41946890094c7fb428cf892d6f

                                        SHA256

                                        9773b47adee5082cb960f7de2feb674c831393c145851ca5e24eb8730220a811

                                        SHA512

                                        d4b2e8cedc11521c6c69ad5cb61f4c15be2b3f853ffb4f5528bef10c0ffc46f55dba9c71c719e737289882e50096e2f79ca0b13d93c5a4118fb4dd388012c4de

                                      • /data/data/com.wufan.test20180312957733629/databases/mgdb-wal

                                        Filesize

                                        16KB

                                        MD5

                                        1a99d26df8f4ae6e990fc339ee1bf01c

                                        SHA1

                                        1ab89d0b3cdea4af9733ff79d816a73452c40472

                                        SHA256

                                        802db90b653f9dab0a1a592708ba11f55d77228d8b36d59fb34940f8133f143a

                                        SHA512

                                        9d2783385267ff4d6725fc598a3b0dbf08da51b5358572621925083bb08307293a136a52d78c2d78f46bc4c09ef491d6fa8db90861332c5044dad775ba185699

                                      • /data/data/com.wufan.test20180312957733629/databases/papa_stat.db

                                        Filesize

                                        4KB

                                        MD5

                                        f2b4b0190b9f384ca885f0c8c9b14700

                                        SHA1

                                        934ff2646757b5b6e7f20f6a0aa76c7f995d9361

                                        SHA256

                                        0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514

                                        SHA512

                                        ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1

                                      • /data/data/com.wufan.test20180312957733629/databases/papa_stat.db-journal

                                        Filesize

                                        512B

                                        MD5

                                        abb3150f395a8c7e4b86a6bba2ff8d16

                                        SHA1

                                        3f7f9fc6cbd3baab3099745f08b7db64a72e2b0b

                                        SHA256

                                        94f186a66905f5757c65aaf58ad50f81fcb0e2224dc932b8a23a11b9199aab2f

                                        SHA512

                                        2abe5911ff5f2d385856356f5f89cf36e4bb8f9889536781ce83b77e42b2df1d49ea006e68d8f2683b75787cad824e79c9ddafff4b773d3d8605de2dc1b43bc8

                                      • /data/data/com.wufan.test20180312957733629/databases/papa_stat.db-shm

                                        Filesize

                                        28KB

                                        MD5

                                        cf845a781c107ec1346e849c9dd1b7e8

                                        SHA1

                                        b44ccc7f7d519352422e59ee8b0bdbac881768a7

                                        SHA256

                                        18619b678a5c207a971a0aa931604f48162e307c57ecdec450d5f095fe9f32c7

                                        SHA512

                                        4802861ea06dc7fb85229a3c8f04e707a084f1ba516510c6f269821b33c8ee4ebf495258fe5bee4850668a5aac1a45f0edf51580da13b7ee160a29d067c67612

                                      • /data/data/com.wufan.test20180312957733629/databases/papa_stat.db-wal

                                        Filesize

                                        48KB

                                        MD5

                                        48bbfe8a75d6a5c1dad2fc94890c2cf2

                                        SHA1

                                        27a3909d1793c4ea0476b50efc434b05e86de960

                                        SHA256

                                        077718f846ba4ce93eeabfe1326d050e1c681be620b171d6a2048a1ddd6dcc63

                                        SHA512

                                        20ea5c15d5da1437debce70b036cb36feb3b6cb34854538dc1b982136c09724a8e9b5635f617c613b0303d2f16aa0a28f7d2337244b45262e465a9c11daeeb3a

                                      • /data/data/com.wufan.test20180312957733629/files/.um/um_cache_1703764942922.env

                                        Filesize

                                        677B

                                        MD5

                                        722ab1583049344966f1116306338837

                                        SHA1

                                        128b23527897d5debdff2c4b781afe3847b736de

                                        SHA256

                                        05568638028a52b865fcf49ae23528730d18f0991c058d47c4a1a11b848fa170

                                        SHA512

                                        9f622c99af03a65343dbfb0b49d6827a08e69aa95e91f3ce6e2cfedfcb0caceb3b2ca13f88344e614dc1671debebef76988eb885125b6b99cac33824a5595fd0

                                      • /data/data/com.wufan.test20180312957733629/files/Mob/mob_commons_1

                                        Filesize

                                        2B

                                        MD5

                                        99914b932bd37a50b983c5e7c90ae93b

                                        SHA1

                                        bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

                                        SHA256

                                        44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

                                        SHA512

                                        27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

                                      • /data/data/com.wufan.test20180312957733629/files/Mob/share_sdk_1

                                        Filesize

                                        40B

                                        MD5

                                        9bf3326c9305bc8f3a630d43d9d5a1e6

                                        SHA1

                                        fcdaf60e5fef348b1f352faa9799ff306d23dbb9

                                        SHA256

                                        850ac28280f179cea5b494695f387f6736c4dd80d9c4c64b386038be09bdcac7

                                        SHA512

                                        9a9e03dbb4ff16b3247cc282c2f29b6cecde9dc2aa54688c883e5b863fcdb0255c1f70528f268c497b5d2621386d65da8184ff43e1c1fee281ffc214bff3a4e9

                                      • /data/data/com.wufan.test20180312957733629/files/Mob/share_sdk_1

                                        Filesize

                                        64B

                                        MD5

                                        498dd5970515206be44053300ef09e98

                                        SHA1

                                        e8b859ebfa0f5b4b391e5414c63d04add51c00ef

                                        SHA256

                                        c0fdcf111e35d3c425af88dffcb3d77764f726e8cf212090fbe396e90819e371

                                        SHA512

                                        27b06f9d98dc904d2d71a99c86c0f3ab0f561b41cb16b2db6f83f1a7681f0f3296d2f4df63eb67391db08650bac4b27770f67f4aa3286105555d3cae95a55d9b

                                      • /storage/emulated/0/.papakey

                                        Filesize

                                        36B

                                        MD5

                                        913686d66f303715e8a3516b11155a14

                                        SHA1

                                        3efdd4edc7d784072781714e59346a6ea8b644d7

                                        SHA256

                                        9ce1bf48e7f8f3bc3b8154985ef6ea9313d802bf5f6a968154d520e8c9682a63

                                        SHA512

                                        a2017c034274fde17d3fea0fccb7e1532c620ce54806bdecdc84cb3102bf7a07e8c561e79211e35dec9aed0b991c624d85e094aea9b228c6dca2b3e15b56df75

                                      • /storage/emulated/0/Android/obb/com.wufan.test20180312957733629/sdkinfo.txt

                                        Filesize

                                        6B

                                        MD5

                                        c7c8d45e0fc1a2ac188f9b0a62f1a797

                                        SHA1

                                        ffe2c07fa6f7f6b99e9be07d89c766dc029b846b

                                        SHA256

                                        91bf44d0a10bdb192c372abd8362e5089b7da61c9dbb2dffc0d936b0f33b5caf

                                        SHA512

                                        6abc5570f847c76a8f091301c26679321be9e27ea4fd07d067227937b3ee7d1a4c6e0020e4bffa769ea0d9355604e390ca29d2c998c2ca49a9341cec57a54755

                                      • /storage/emulated/0/Mob/.iew

                                        Filesize

                                        64B

                                        MD5

                                        d62b25791b9f8972176645601373ffbf

                                        SHA1

                                        03bb840c1867ffda55c486a53fc36a9ad95ef4fc

                                        SHA256

                                        2050f5a0e4bce2cc95fedb74e8438f87814131057ba93f8b5e175be144bd5ae9

                                        SHA512

                                        21de1d2fced190df5709a7444cc2300c850537aa91a26a2ddb6d87fe59321f54e1b96e616ad1462f41a1d73db837beaa36333bcd6b7e2be29dd25c261e29c112

                                      • /storage/emulated/0/Mob/com.wufan.test20180312957733629/cache/comm/.mps

                                        Filesize

                                        26B

                                        MD5

                                        840eaa01e5d03fffee257ed5ce4fba9e

                                        SHA1

                                        886bd732b29f6dbdd94b890a2b203c5a276ae773

                                        SHA256

                                        7648e772307acf936c331c4ea9d92872b1af6367cbf83f33f569ac204df65595

                                        SHA512

                                        b0a4f9238c4b60bec0cca9c72e551a702a95210a735bd8176c1d5ba741e264d2f1e885d65ed07a88086afd74f69c5e02a92db8068b222a62c6f56762a26b7d4d

                                      • /storage/emulated/0/Mob/comm/.di

                                        Filesize

                                        57B

                                        MD5

                                        70a42cba408700f9a6c01c7941a8829e

                                        SHA1

                                        eab01cc2c0671538795fb0b1146017dc099d0984

                                        SHA256

                                        499576707ce2623293166979e59c832be5b8636c64ad39aa63ebcf961910c35f

                                        SHA512

                                        8900d4dc8eed0430babbacb72942401bd22ef7fe5430cad90d3ce0c2c53010220d666aa0e2eb1026f3ec81d574c7fa12585b49222a5f15b01637f6ba134fe70c

                                      • /storage/emulated/0/aray/cache/devices/.DEVICES

                                        Filesize

                                        32B

                                        MD5

                                        1679374f0770d16182e93f6a66c35f88

                                        SHA1

                                        93027f8bf54c9c8b25cc2d8e6bfb0d5636a26247

                                        SHA256

                                        80db1f6552e3102196cbfb774557655a16b68abac4a467e33c8e6536b786c9b0

                                        SHA512

                                        2ac7cbe4b75c2a1b9e0250d5ea76107b34480f9a696aabbbe225b8eaecb53021609a82313d4794e70c2cd986f48d1b55d38abd70df8fb18b49e3f44f78c0a05a