Overview

overview

8

Static

static

6

c76d697ad4...2b.apk

android-9-x86

7

c76d697ad4...2b.apk

android-10-x64

7

c76d697ad4...2b.apk

android-11-x64

7

alipay_msp.apk

android-9-x86

8

plugin-deploy.apk

android-9-x86

plugin-deploy.apk

android-10-x64

plugin-deploy.apk

android-11-x64

Analysis

  • max time kernel
    2986825s
  • max time network
    130s
  • platform
    android_x86
  • resource
    android-x86-arm-20231215-en
  • resource tags

    androidarch:armarch:x86image:android-x86-arm-20231215-enlocale:en-usos:android-9-x86system
  • submitted
    24/12/2023, 03:31

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    c76d697ad42791e4f2da83e6a5902e376de092e9ce91fd06e8838dd5cbe13e2b.apk

  • Size

    4.8MB

  • MD5

    a41711e1eac0020a160680794f2dc475

  • SHA1

    8381d14c80f5a37293969e5fec7ce88f06af51ff

  • SHA256

    c76d697ad42791e4f2da83e6a5902e376de092e9ce91fd06e8838dd5cbe13e2b

  • SHA512

    edaa3050a8de2e8d5967985237771fc6084731f30eaa341f9dccc2740f0e1743189e276cc2ff871867d408d0698ae040a002ea306516d1c51f7a3ce334285d4b

  • SSDEEP

    98304:gWaJK2y93FPzYBtIf+d/eJfWnPZfM+2w2ZUctbusnirMyoHLs4:baJK2y93FPzYUf+5eJunKUsI8I4

Score
7/10
evasion

Malware Config

Signatures

  • Loads dropped Dex/Jar 2 IoCs

    Runs executable file dropped to the device during analysis.

  • Checks the presence of a debugger
    evasion
  • Uses Crypto APIs (Might try to encrypt user data) 1 IoCs

Processes

  • com.kingyee.kymh
    1⤵
    • Loads dropped Dex/Jar
    • Uses Crypto APIs (Might try to encrypt user data)
    PID:4237
    • /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.kingyee.kymh/app_push_lib/plugin-deploy.jar --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/com.kingyee.kymh/app_push_lib/oat/x86/plugin-deploy.odex --compiler-filter=quicken --class-loader-context=&
      2⤵
      • Loads dropped Dex/Jar
      PID:4264

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/data/com.kingyee.kymh/app_push_lib/plugin-deploy.jar
    Filesize

    202KB

    MD5

    610ae20fa40cb991ef4670582bc3996a

    SHA1

    bad8dbc9b7226fbd4f1b97dabe777c36605ccc9b

    SHA256

    010690c6a9fe3d6e21c33940453cb2a5c41e26ac24ea42e3732111613701eede

    SHA512

    8584fa3850e97276d6afef61dff9401531cd7830a3a7660fcc3b75c21c55196a59efad46ad763f1695f59c99874e29aa285ba9d9f43a5989d004a0e115d76b1b

    Download Submit

  • /data/data/com.kingyee.kymh/app_push_lib/plugin-deploy.key
    Filesize

    174B

    MD5

    86896cfc29159ebebbdc72a7fea66d3c

    SHA1

    76f71e17f279e9010cd1f16d9c979f75bb9cbdb6

    SHA256

    4040246e2cd23768965dd2720eed8ab30b0891eb7324201ac1592e8e39eb7697

    SHA512

    89d4d3e88c41bf4c9cd527ed6c7af45e14545019b1d86414fd7965fb6dac79a6a8f1e8c4b4de4503e6bef2b98ad32f37d319c7e29e807b2b83d56cd867ab9ca6

    Download Submit

  • /data/data/com.kingyee.kymh/files/.um/um_cache_1703793874300.env
    Filesize

    581B

    MD5

    6bd83075f9ad4a36b5c5ebd3d633efdb

    SHA1

    81148cae62bedd6e2ef55e1e4d25456623d54391

    SHA256

    82c9524cfbc22de8c83b1d54a120463684c4a5678c9c1f6e0484b9fe0bf8d975

    SHA512

    d7fcb3782e49688ad35a7373581465d996b23e0a72f04e0a8414fa15743a005dcf0ca22d535a188cafe6f0dfcfe9d2e89870e3ac16aaae43579a36aea4f11575

    Download Submit

  • /data/data/com.kingyee.kymh/files/umeng_it.cache
    Filesize

    310B

    MD5

    efc01366fc75818f1617b1d5acfd47c6

    SHA1

    68f1f39c755395e657886304b16fedb3da0fc900

    SHA256

    091bcd081902b8297a990d62ce22ab3a6776cbba216d6ae5820bc817a8fb94fa

    SHA512

    03f359fcd7b125f9ed357354670d8a6af728e8e79ca18c8c03fc2d32e2e51a52c1ab954fa1fa8b003ac5798a85e059344a7a6eb9f8ad13fa34976b3066f7eb70

    Download Submit

  • /data/user/0/com.kingyee.kymh/app_push_lib/plugin-deploy.jar
    Filesize

    507KB

    MD5

    0f01de9b83dd8195bc640c07b7e45dd3

    SHA1

    a427c07efaed492839e89ab490db691534da8c21

    SHA256

    738447a77b1796c32da78df26302a5bef6369f761af0c4622466338806f8c061

    SHA512

    510c3b4ff8ec84345b45d8cb7ded5fc93dab20f154c8f90f23afb3d9713f27d44b96858e52684dd5cb333134e231a6096f7cef18ea2cccd5c81ee7e98ba61459

    Download Submit

  • /data/user/0/com.kingyee.kymh/app_push_lib/plugin-deploy.jar
    Filesize

    507KB

    MD5

    058c9e49195a1ab48863deb84a028f63

    SHA1

    a35b0dc7822174cff3683e1aa2b5cf85833733df

    SHA256

    ce04c452c6c3dc56dee78205f036a779c7144eb607dede07aa054f93f77ad049

    SHA512

    081643598f3bbda4d2f560975f6e6fec8da94c8a578d80c05cf6f035ed3766db65de21cbe3ec92a16060e5ea1c1aebe37bd339de76365daf67648fd5967e5c47

    Download Submit