Analysis
-
max time kernel
3045185s -
max time network
150s -
platform
android_x86 -
resource
android-x86-arm-20231215-en -
resource tags
-
submitted
25-12-2023 13:05
General
-
Target
206db7f5b552136d53d6412e6cbc5d39.apk
-
Size
16.2MB
-
MD5
206db7f5b552136d53d6412e6cbc5d39
-
SHA1
b681dcf52a9741856e4a289e6e3731fcdb9f9c30
-
SHA256
a20cbbeb133ede53993cec3757826fa642dbb83a5a8cccd19963def38a77fb00
-
SHA512
a54efa8c7474ef6c8b84b0ff770fd5ca3e2161505011b93621a2b46b2fb349a757a64833e820d011f28e735dda388c248ba12daa0c15f6e1f786d94d679fbc4c
-
SSDEEP
196608:YYD6V+U+BBgnla52FOUZJ3ZNMvre2wlN921xPY+HgRUR2Hci9S1dwVZIJIS0jZWr:Y/+dBwa4FnZGOSmd8QgNkEDMOXz0RsJl
Malware Config
Signatures
-
Requests cell location 1 IoCs
Uses Android APIs to to get current cell location.
-
Loads dropped Dex/Jar 9 IoCs
Runs executable file dropped to the device during analysis.
-
Reads information about phone network operator.
-
Uses Crypto APIs (Might try to encrypt user data) 2 IoCs
Processes
-
com.isenu.liyi1⤵
- Requests cell location
- Loads dropped Dex/Jar
- Uses Crypto APIs (Might try to encrypt user data)
-
chmod 755 /data/user/0/com.isenu.liyi/.jiagu/libjiagu.so2⤵
-
-
/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/data/com.isenu.liyi/.jiagu/tmp.dex --output-vdex-fd=42 --oat-fd=44 --oat-location=/data/data/com.isenu.liyi/.jiagu/oat/x86/tmp.odex --compiler-filter=quicken --class-loader-context=&2⤵
- Loads dropped Dex/Jar
-
-
sh -c ps2⤵
-
-
ps2⤵
-
-
ps2⤵
-
-
com.isenu.liyi:pushcore1⤵
- Loads dropped Dex/Jar
- Uses Crypto APIs (Might try to encrypt user data)
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4.0MB
MD5b5865bb1e9377bb45091a855318b57c0
SHA1f59bd5339369dbf07198cce2bb06b8e1274499d9
SHA256a8fca268bd1ce5eb2ee1fee5df4792fdcbd669a7a24f60465ea434bea6511cc4
SHA512db0fc08674f6813586bc0bfac0d5d35cf926648ee1d027ddff5680d6d0d539814ec4c6050c6fde8880b5d003d53c84d2f9c7082bdc5d5b20a5cd4cc26d122680
-
Filesize
382KB
MD5aa01dd97609092ce310e17bf791069ce
SHA1f000840a8f68ea7beb2e29ea466088daf55609db
SHA256e432c191f918053ce368e1b1f155b2e1f9e84379611b93aabec0106172b73aa2
SHA512766c120a06215d0950aae32026fcde3eafed8d18ae0de7bc8135a7378a9055c8f0040d61574d9af67fe2b5b90eeae64c62d787343858ae375bb6658df8afe7b4
-
Filesize
284B
MD5f1771b68f5f9b168b79ff59ae2daabe4
SHA10df6a835559f5c99670214a12700e7d8c28e5a42
SHA2569f8898ce35a47aeafced99ea0d17c33e73037bb2307c7688e50819966f4ae939
SHA512dae27d19727b89bec49398503baa6801640540355688dfabbe689c97545295c2c2d9b0f0dcd7cbc4cfbf701d0c0c3289e647a152f49ff242d1ecc741efe4145d
-
Filesize
32B
MD5008dbc571e780c938769984c3b5bf56f
SHA1008da5654a987a1964a9cd4ee528408329a60b34
SHA25609bf0136ecbf8dfe3ff73bfb0aa566ec5ce524f7c4ad9ec0bcc9b3da5875978a
SHA512883ce1d03dff11b8c418662bb3ccb21dcdce8f316f3fe472aa02bb011628aea8eae37165a83a4ac37717e042c1db4d966688207eb1c12e38b41fba3f9cac48e9
-
Filesize
40B
MD50b6b8a89f7c5d544cbd47520ca72106a
SHA1f2e770df2d9d56f48fe024baec66b2b9694fec58
SHA2562baff64ba348ebe7fc2e48c810e824bfd9244c4822e315047938eb44923d84b5
SHA512b18e1ae17069a665a416015537462efec06dc3a67a234135f87164670a4f84445daba76084a110a2c57f461c473edb0b7ea9574add190e5ea022cca14ba4d711
-
Filesize
340B
MD57dda0a14ca9c6cb445c08e456296ff83
SHA1f52e55d2a8f60091bb7b598628ed6b51226f048b
SHA256ce55fda6462ca8d3e1b254291802ae00de806373f2f67b15311c3a88ead9493c
SHA5122273ebc116767e601c2ea352a0bb6227c739e8524ee36d3761b2b3054b9de971c281f226018f3f9c78636e882d02936de8b0b00dc413a8da75d1b79dccc4b3a6
-
Filesize
340B
MD54d035b3fece7047cd0e0ef7eae908e71
SHA1d9e826572c9ed17bed3b1c669976cbaab88eeacc
SHA256c87eda21b4e063b667116c1226f1e390df19795110fd4e4e252982e9c0f0df94
SHA512e9654635874452da726cba7f6a2afe7bc2ec84138af2a720f5fc9ec1ca042e51834529ea5fbee3788f8d3c611d244058c15cf850992e7314e30cf212cf5b048e
-
Filesize
32B
MD59f0424f478153241c690f6af4555873d
SHA12eab5039c12b00b22f8148041a561add87144418
SHA2562803c2700eb29f60e6d83bbc5b1f5eda9e74f2a085836a689d36dc2ef69dc517
SHA5127ec3c8d6334a630619879464aa0b9fd1902a6f55204674d44daa9f59cf09641fa1924338fad423ef5c099d637dd22ee1705616b4c38d9f1d0bbb89dcd451000b
-
Filesize
314B
MD5ff178b88f89b9f900a1c915442b95a5f
SHA11ffdd06c85792bd8728e3cacbd9bef6ea09d833a
SHA256e08cb418ba9e992463103551a4725b8cbb0e0b1ec58a55ed88940a04f9111d0a
SHA5128952456230cc1c6d4346d90b7a05285fbfc9a1df9e5c372e7d62b25994ba2974b49b9f6a4b4304d3d5fe70fd7496f5cdeff7f8a00481df279067325c24685e4c
-
Filesize
27B
MD588b0f96be2ed8b24a902378091faf319
SHA135ed32b58011e2c8155ea99448640b52d8278468
SHA2562b1f3c82c7777e23839a5c4d047232af39bc77b86bfa86004df5bb02f129793c
SHA512b333ac9d8591f312d0569bacf6c2e8eb025e816c7de79fec0bfa41c8cf5734a0feed1bfccd2e128bdf53b025da3a770de10efa4adf370a1de19af531dd4e5b57
-
Filesize
6.7MB
MD5ec85fc9e53d37530781e208ae6657e8a
SHA1647f8fc02e9bc1c8f9d95f59511d47c31d562a61
SHA2563d8722dc8cbae19d51c9e9fc05a0344f6e912a468ca59719071bfc0ecdb8ae63
SHA51257a5bdfe4965242ae082f9a28fb5142536eda64ff03f0e87989f09927e435b883ee11bc76b48cc6efbc93ccf1218c7ec8b45dec8cd2d175519ceb9a4abf6fe26
-
Filesize
342KB
MD5d666acb5fd61a7a23ee970464cb9f4b3
SHA195a631e43fb06cfba6d423d6e0ecb28120b0ac71
SHA2561e1e2cbdab71971e989a0778c9fb84566bd665183b65dab2bdaaaa5a9cebb5b9
SHA5123d033c000d56090ebbb964d72c187cbc2ee9b05e18fc32439474707bf29f1ae199fbb30afcafb8214f53c3aeac85505cee69d759aba9bebc6987fb0fca4930ec
-
Filesize
48B
MD51d8d16c4e3b19ebf18988530d9b9a757
SHA1bc94c1cce05cd848a53271ecb9c5311e27ffebf5
SHA256abd87140da8de3d0aa39a24a8d52bfe7b2eb28f7a3d505f205471c7e8f4964d7
SHA5124562d1eedbc5c2dd7f25cd1c70343053fd451026403585182b142a64f17016c1bd0bf6ad51667b439b220e425640e55fbbda08517e7106376cdc220a4555da82
-
Filesize
32B
MD5263558a089a3185b58da5b590a5cd692
SHA13286d4e42342f7c0dec67792b4061d1f74a5185f
SHA25653947f41bac4a7a695a2ed6ce317997bd8b59a48e001e04e9d2ae625a735e699
SHA512e21cec334fb28ee733729ef647453573264c088745e8015f4a202dc1875a51b16da08dd3c0bc10e412b17fe8513ca3b10da86ccc08db3f93f145da2b9c5d9394