cc33191a0f4b6adb50409455e0245d48436d6e11f2c3500e5b0faf20a4ff5cb5

Analysis

max time kernel
2984879s
max time network
156s
platform
android_x86
resource
android-x86-arm-20231215-en
resource tags

androidarch:armarch:x86image:android-x86-arm-20231215-enlocale:en-usos:android-9-x86system
submitted
24/12/2023, 03:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

cc33191a0f4b6adb50409455e0245d48436d6e11f2c3500e5b0faf20a4ff5cb5.apk
Size

22.9MB
MD5

c38a1b8521e43c0cf060491bcdc9e666
SHA1

ec38a133d814628241335a4c5827cc66f469f03b
SHA256

cc33191a0f4b6adb50409455e0245d48436d6e11f2c3500e5b0faf20a4ff5cb5
SHA512

2e749c08a42c84d66aabbc036e20c7e2fcbcfcef3421320663e67130072b4250ff3fea95b87eeb7d9341157fd50d3df04f41ab0bac6d4e6f58b165f06a6f0868
SSDEEP

393216:MXTIrckuhH1Y7D5KTk6/kvnT+ibrnyGjeicRq1ufdWmkhc1582llzB9ihvk:MEIDRaAMTDHnRj2Rq1+4rt2llzehvk

Score

8^/10

banker evasion

Malware Config

Signatures

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 IoCs

banker

description	ioc	Process
Framework service call	android.content.pm.IPackageManager.getInstalledApplications	com.du91.mobilegameforum:channel

Checks Android system properties for emulator presence. 6 IoCs

description	ioc	Process
Accessed system property	key: ro.hardware	com.du91.mobilegameforum
Accessed system property	key: ro.product.name	com.du91.mobilegameforum
Accessed system property	key: ro.hardware	com.du91.mobilegameforum:channel
Accessed system property	key: ro.product.name	com.du91.mobilegameforum:channel
Accessed system property	key: ro.product.model	com.du91.mobilegameforum:channel
Accessed system property	key: ro.serialno	com.du91.mobilegameforum:channel

Checks Qemu related system properties. 4 IoCs

Checks for Android system properties related to Qemu for Emulator detection.

description	ioc	Process
Accessed system property	key: qemu.sf.fake_camera	com.du91.mobilegameforum
Accessed system property	key: ro.kernel.qemu	com.du91.mobilegameforum:channel
Accessed system property	key: qemu.sf.fake_camera	com.du91.mobilegameforum:channel
Accessed system property	key: ro.kernel.qemu	com.du91.mobilegameforum

Loads dropped Dex/Jar 5 IoCs

Runs executable file dropped to the device during analysis.

ioc	pid	Process
/data/user/0/com.du91.mobilegameforum/.cache/classes.dex	4476	com.du91.mobilegameforum
/data/user/0/com.du91.mobilegameforum/.cache/classes.dex	4476	com.du91.mobilegameforum
/data/user/0/com.du91.mobilegameforum/.cache/classes.dex	4788	com.du91.mobilegameforum:channel
/data/user/0/com.du91.mobilegameforum/.cache/classes.dex	4788	com.du91.mobilegameforum:channel
/data/user/0/com.du91.mobilegameforum/app_libs/ymdex.jar	4788	com.du91.mobilegameforum:channel

Unexpected DNS network traffic destination 1 IoCs

Network traffic to other servers than the configured DNS servers was detected on the DNS port.

description	ioc
Destination IP	223.5.5.5

Reads information about phone network operator.

Listens for changes in the sensor environment (might be used to detect emulation) 1 IoCs

evasion

description	ioc	Process
Framework API call	android.hardware.SensorManager.registerListener	com.du91.mobilegameforum

Uses Crypto APIs (Might try to encrypt user data) 2 IoCs

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	com.du91.mobilegameforum:channel
Framework API call	javax.crypto.Cipher.doFinal	com.du91.mobilegameforum

com.du91.mobilegameforum
1⤵
- Checks Android system properties for emulator presence.
- Checks Qemu related system properties.
- Loads dropped Dex/Jar
- Listens for changes in the sensor environment (might be used to detect emulation)
- Uses Crypto APIs (Might try to encrypt user data)
PID:4476

com.du91.mobilegameforum:channel
1⤵
- Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)
- Checks Android system properties for emulator presence.
- Checks Qemu related system properties.
- Loads dropped Dex/Jar
- Uses Crypto APIs (Might try to encrypt user data)
PID:4788
- cat /sys/class/net/wlan0/address
  2⤵
  PID:4891
- cat /sys/class/net/wlan0/address
  2⤵
  PID:4912
- /system/bin/cat /sys/devices/system/cpu/kernel_max
  2⤵
  PID:4931

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.du91.mobilegameforum/databases/MessageStore.db

Filesize
4KB

MD5
f2b4b0190b9f384ca885f0c8c9b14700

SHA1
934ff2646757b5b6e7f20f6a0aa76c7f995d9361

SHA256
0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514

SHA512
ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1

Download Submit
/data/data/com.du91.mobilegameforum/databases/MessageStore.db-journal

Filesize
512B

MD5
aeccdf5661ac40caada8d9850527bc88

SHA1
c064a546dafb0e02d88152e7fdce532876d8da0a

SHA256
852a5f2125b06952e82725e3198d3770bd9302c9a5453b5e996c3ed4ca79598c

SHA512
fe8fcb81d534b8d6b7f4b9ce6987718e4b0ebf2f28f1e17590ae539644d2cfd13922ba284060d6029586f44098f5ac3b01f29f5942eea52a1be3667f69ef6e65

Download Submit
/data/data/com.du91.mobilegameforum/databases/MessageStore.db-shm

Filesize
28KB

MD5
cf845a781c107ec1346e849c9dd1b7e8

SHA1
b44ccc7f7d519352422e59ee8b0bdbac881768a7

SHA256
18619b678a5c207a971a0aa931604f48162e307c57ecdec450d5f095fe9f32c7

SHA512
4802861ea06dc7fb85229a3c8f04e707a084f1ba516510c6f269821b33c8ee4ebf495258fe5bee4850668a5aac1a45f0edf51580da13b7ee160a29d067c67612

Download Submit
/data/data/com.du91.mobilegameforum/databases/MessageStore.db-wal

Filesize
48KB

MD5
f87227b462704a8aaca1ff15ee2da449

SHA1
53df7ceb19f048115dfd36a47bbb0411e87848dc

SHA256
23fd0627cdf32410c63d7fd282de91dcda94adfa141a9ce5f5076aea73e80ca4

SHA512
b3db38d13e40ef22071fd50bc1410692496a63aeedd11816d3dea772264d2bcfaab77cded82d886bf6c84e241af71d41b8da0ced7c4eba9727ad82ed993c8cfc

Download Submit
/data/data/com.du91.mobilegameforum/databases/MsgLogStore.db-journal

Filesize
512B

MD5
8c2975a47c13aa4f3242d2b169a33a86

SHA1
32b9c042797dc618c41dc0cc3ac7199de96e533d

SHA256
6a0047bfe7c1a1871e1e704d9861b0097e08ddbca1170b2b7789c5130ae05521

SHA512
ac51534c4427df3e7e483401466aaeeeba6e6535444d3e863061b71462b35e58a9ebaadacb9260c7bebd55099f5afab642339483c909f74ab8eba32907de81f2

Download Submit
/data/data/com.du91.mobilegameforum/databases/MsgLogStore.db-wal

Filesize
68KB

MD5
af56a1e0043bbdf5a3a9e247bdd554fa

SHA1
6f80d5b0b454854e9095c15507dc3451add9a6a2

SHA256
124d2c93ce42cfb0419c8f48ce589af3af0dcdf32f62eb6faa359ba9650b8c13

SHA512
a0b74b047c1d35a958ee49cfae6349b8150a691dc9bf95412fb85f610bab08dac5458b7dd5a8950833a8efff548e48c08a4f21d515ce9024c5f8eea93440edef

Download Submit
/data/data/com.du91.mobilegameforum/databases/accs.db-journal

Filesize
512B

MD5
59e361716fbc9bfd498ecda990dfaa40

SHA1
0ee7a6862c59cf882c642fb1470caa4cfbee3456

SHA256
ec05c9d9c3b8cc904c91aee3fb9f0d5ab64d24143a9a3823155f1a68d22f32dc

SHA512
27e1d4afb840f3581f79e0bc812cb1ff81fc3477582a35f3cb61a001afae4f9192da5b90c473c7d7011e6169969dce0732e01d90cd7b4de5a936a576133041d9

Download Submit
/data/data/com.du91.mobilegameforum/databases/message_accs_db-journal

Filesize
512B

MD5
c7eee6ea7607586c40f5e17470416f1e

SHA1
18c888d776463241e6627a8171f339b4247afd77

SHA256
35b03bee2974e7d82252e7a25d3abe3333a976b40cabf07eaf0890fa7eb39a3c

SHA512
bd9669b2ec324f90dd3ef99cf1bb0f5dad7b765f18a6c99d896e7e9befc54f10f4ac3f1eea9d1a99b637310590ff091dda19562da4daed9a67a32d0f5af35b55

Download Submit
/data/data/com.du91.mobilegameforum/databases/message_accs_db-wal

Filesize
48KB

MD5
d2603708756dbc703313d2cc6adbf6e7

SHA1
5a4e3acdf7254d8c5b5374379b6db1408a7b6fb8

SHA256
ea7bd8dbe1222ea8abfac1a3ae63c7b47a99a145a204da0a468873e056dff068

SHA512
e00a23f98fe430ed7fe20ad696031e5a84a39194a04c12ed2235ee3d2ee80b54973e18c29d9e5ac6435ad444a0a112a830d0f59a5edc57bb16879d7d95fcee78

Download Submit
/data/data/com.du91.mobilegameforum/files/agoo.pid

Filesize
28KB

MD5
b180f74524f6fb14c8a0d0dc0c8ec1e4

SHA1
c702a04dd58a81dd0d4183dbd3d3e3b3a69d0c75

SHA256
a83be5024c9646759247f0b9ed500fd916961d423041d72d195a3d50d9045647

SHA512
29ccacb54c46f329ed692472822834ab6cfe19afa685fe78b9384836dae57c59e0e09370af60e663f2f545750ca85fc2b59162e5357a1d1e2b6ec898db4f4d3b

Download Submit
/data/user/0/com.du91.mobilegameforum/.cache/classes.dex

Filesize
8.4MB

MD5
15c45cf69b57d51a71edd0093cc87d3c

SHA1
4fc6a79a2113f8141cf975bcb3d88a1e70ce42a9

SHA256
9dfa85058ed5b4862c30502eceac2b4113b11b03324949b248401c512b8e75fa

SHA512
fea848d894bc0e75095fa283f58c63058b96580ce5aad855f7e4fe4c5aa0b7c4e69d656b7aacdc6df3882c1402e28f00d2ec45c69d87f2e180451c93da69df89

Download Submit
/data/user/0/com.du91.mobilegameforum/.cache/classes.dex

Filesize
3.1MB

MD5
d4bb3c12a036f35c4d1b47c2ef329289

SHA1
543f2603b28c700b52c9e8b26de42f44b4dcfc9a

SHA256
3ea9e32e5930b6e6eb42e830868966ecf43cad73febb4ac30135bf1acdf618e8

SHA512
3576e0a968abcaff560b00e31d5b7c014b285241d8b5f47c7538888a6ea0753bbf8c5aee0c57010f188cededeae447af7e4106bacef3e9c08165ccd0d0d6f759

Download Submit
/data/user/0/com.du91.mobilegameforum/app_libs/ymdex.jar

Filesize
841KB

MD5
9084b14b2a21514122e9818dd73e60a5

SHA1
5c83ad3343799fbb2e055c409d5f3efa905d6c7f

SHA256
2ba924119f2380d04d9d28ba07d6b2225be124a18d9b57610929cdd9ee3d1b6d

SHA512
d8ca7514f0a1e943ee05c0dabf00e28cfda128381bffe896f951e0e81c4f84e5d69afcab649bd0af55f5f4f451193abd7dd3640ca6578a82a45ac61d6fab3886

Download Submit
/storage/emulated/0/.DataStorage/ContextData.xml

Filesize
111B

MD5
9ab0cc38f3ecf66cac074dffd56cca2d

SHA1
4037343acfd385912f2ba9087c834765f2a02bbe

SHA256
2b36c2bac339cc0af1a4dc29c5a3eefc45e885f043780b593468fa3de9c4b903

SHA512
b09a53656380d3496ca0731cc21c768c1039c3d634daa4aa3e395ad47bc6d6a704e556e06241e484928e9b58177b421f8e31dbed864611c71166962047823468

Download Submit
/storage/emulated/0/.DataStorage/ContextData.xml

Filesize
512B

MD5
7204a2bb285221e6a55bdc0d6493be62

SHA1
f64ce34c2be2bce07dc9e73fd72b4c82dcd2dd47

SHA256
a95a78fee42355c5f0e2bc978238d9c62f99e9871cda0e392a3e3f12f99831ae

SHA512
3ab32fae57b8b8d03872150bd4771f2cf4ec21f5d0f32c46598dc2c444148753346af39ee1a528faec60b2e56002918ed26bafe4b012123284dd66d96659570f

Download Submit
/storage/emulated/0/.UTSystemConfig/Global/Alvin2.xml

Filesize
65B

MD5
9781ca003f10f8d0c9c1945b63fdca7f

SHA1
4156cf5dc8d71dbab734d25e5e1598b37a5456f4

SHA256
3325d2a819fdd8062c2cdc48a09b995c9b012915bcdf88b1cf9742a7f057c793

SHA512
25a9877e274e0e9df29811825bd4f680fa0bf0ae6219527e4f1dcd17d0995d28b2926192d961a06ee5bef2eed73b3f38ec4ffdd0a1cda7ff2a10dc5711ffdf03

Download Submit
/storage/emulated/0/.UTSystemConfig/Global/Alvin2.xml

Filesize
111B

MD5
7fe6a10007ceae6373df70f0a02082c4

SHA1
c8af8c214516295c452de8b1d890a7e014ba98ac

SHA256
54b84e9a2de8cf92679394adc5cf1b81686d6a596cbac7d4a0ba38ab3337f05d

SHA512
f5e18b91d9af83dba64aa8dfb7288385c04566c73cfec1aabf33505c1319a28e0b4531afaef766a86902409d81cebede6b483b5af60a537f3a92f952455d3245

Download Submit
/storage/emulated/0/.UTSystemConfig/Global/Alvin2.xml

Filesize
4KB

MD5
35c00f708d60ef2db3cb07329248dded

SHA1
beb3f0f7eab95600901b6bbf9a0d648f3fe10cc9

SHA256
fee7016e688f177869d8f55cf49384affbdc9fb0402e0f67b78ab93a778fc437

SHA512
419c9c893b51ce2ee6cc246ed66029df05d7f82e1179449cd619afc32246703c13c625f6bf06f3e504ab9cc5949423cf2b57475e0100959b8f232a41e1055ff9

Download Submit