Overview
overview
8Static
static
63f94b225c1...04.apk
android-9-x86
83f94b225c1...04.apk
android-10-x64
8dmss_v2.apk
android-9-x86
dmss_v2.apk
android-10-x64
dmss_v2.apk
android-11-x64
dump.apk
android-9-x86
1dump.apk
android-10-x64
1dump.apk
android-11-x64
1dynamic.apk
android-9-x86
dynamic.apk
android-10-x64
dynamic.apk
android-11-x64
Analysis
-
max time kernel
3525741s -
max time network
159s -
platform
android_x86 -
resource
android-x86-arm-20231215-en -
resource tags
androidarch:armarch:x86image:android-x86-arm-20231215-enlocale:en-usos:android-9-x86system -
submitted
04-01-2024 01:43
Static task
static1
Behavioral task
behavioral1
Sample
3f94b225c1bf3ae757c3e8caae9e4604.apk
Resource
android-x86-arm-20231215-en
Behavioral task
behavioral2
Sample
3f94b225c1bf3ae757c3e8caae9e4604.apk
Resource
android-x64-20231215-en
Behavioral task
behavioral3
Sample
dmss_v2.apk
Resource
android-x86-arm-20231215-en
Behavioral task
behavioral4
Sample
dmss_v2.apk
Resource
android-x64-20231215-en
Behavioral task
behavioral5
Sample
dmss_v2.apk
Resource
android-x64-arm64-20231215-en
Behavioral task
behavioral6
Sample
dump.apk
Resource
android-x86-arm-20231215-en
Behavioral task
behavioral7
Sample
dump.apk
Resource
android-x64-20231215-en
Behavioral task
behavioral8
Sample
dump.apk
Resource
android-x64-arm64-20231215-en
Behavioral task
behavioral9
Sample
dynamic.apk
Resource
android-x86-arm-20231215-en
Behavioral task
behavioral10
Sample
dynamic.apk
Resource
android-x64-20231215-en
Behavioral task
behavioral11
Sample
dynamic.apk
Resource
android-x64-arm64-20231215-en
General
-
Target
3f94b225c1bf3ae757c3e8caae9e4604.apk
-
Size
6.0MB
-
MD5
3f94b225c1bf3ae757c3e8caae9e4604
-
SHA1
f99a043a923438deab9af2687ffd2e5ec653e79d
-
SHA256
0272e7947c9e677da2d67dc7f1fda6fd8a1ba56f3c535f24dd0614f43711f506
-
SHA512
32da2b093d062f3edbe3cfc3a77ac0472668b3af4caded4e4e52153bbfc2c9da1d0c6713b77fbfdc8c3df1b177663d1de8fad037e1dd50067b944c89f08ac7d8
-
SSDEEP
98304:BiXFXGiyTwaXPlI+9giSWdbsJynNCUIeR29Gd/cMqP1R60lN3pOMGJTXNKkG1:Bi4mW2+9JSWB7CUIeR302yZtiT9TG1
Malware Config
Signatures
-
Requests cell location 2 IoCs
Uses Android APIs to to get current cell information.
description ioc Process Framework service call com.android.internal.telephony.ITelephony.getAllCellInfo com.qihoo.appstore Framework service call com.android.internal.telephony.ITelephony.getCellLocation com.qihoo.appstore -
Checks known Qemu files. 6 IoCs
Checks for known Qemu files that exist on Android virtual device images.
ioc Process /system/lib/libc_malloc_debug_qemu.so com.qihoo.appstore /sys/qemu_trace com.qihoo.appstore /system/bin/qemu-props com.qihoo.appstore /system/lib/libc_malloc_debug_qemu.so com.qihoo.daemon /sys/qemu_trace com.qihoo.daemon /system/bin/qemu-props com.qihoo.daemon -
Loads dropped Dex/Jar 1 IoCs
Runs executable file dropped to the device during analysis.
ioc pid Process /data/user/0/com.qihoo.appstore/files/sllak/opt/4248/finalcore.jar 4248 com.qihoo.appstore -
Acquires the wake lock 1 IoCs
description ioc Process Framework service call android.os.IPowerManager.acquireWakeLock com.qihoo.daemon -
Reads information about phone network operator.
-
Uses Crypto APIs (Might try to encrypt user data) 2 IoCs
description ioc Process Framework API call javax.crypto.Cipher.doFinal com.qihoo.appstore Framework API call javax.crypto.Cipher.doFinal com.qihoo.daemon
Processes
-
com.qihoo.appstore1⤵
- Requests cell location
- Checks known Qemu files.
- Loads dropped Dex/Jar
- Uses Crypto APIs (Might try to encrypt user data)
PID:4248 -
/system/bin/ping -i 0.5 -s 56 -w 10 -c 10 221.130.199.882⤵PID:4397
-
-
/system/bin/sh /system/bin/pm list packages2⤵PID:4701
-
cmd package list packages3⤵PID:4721
-
-
-
/system/bin/cat /sys/devices/system/cpu/cpu0/cpufreq/cpuinfo_max_freq2⤵PID:5006
-
-
/system/bin/ping -i 0.5 -s 56 -w 10 -c 10 221.130.199.882⤵PID:5066
-
-
/system/bin/ping -i 0.5 -s 56 -w 10 -c 10 221.130.199.882⤵PID:5104
-
-
/system/bin/ping -i 0.5 -s 56 -w 10 -c 10 221.130.199.882⤵PID:5153
-
-
/system/bin/ping -i 0.5 -s 56 -w 10 -c 10 221.130.199.882⤵PID:5202
-
-
com.qihoo.daemon1⤵
- Checks known Qemu files.
- Acquires the wake lock
- Uses Crypto APIs (Might try to encrypt user data)
PID:4278 -
/system/bin/sh2⤵PID:4439
-
-
com.qihoo.appstore:critical1⤵PID:4459
-
app_process32 / com.qihoo.appstore.rootcommand.persistent.CoreDaemon --nice-name=com.qihoo.appstore_CoreDaemon --daemon1⤵PID:4495
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
28KB
MD504183d28d08d24a5b03704e8a44f1e0e
SHA13710a7d4f4a50e9a8a14d1cd312291d99fadf7ff
SHA256cbcd94a175e1689d50dc1d42f20d9238dc71ff218539f8eab55da964e5190695
SHA512817f91475b63f1e8feb1a11cf55f0409b6728bfe8db1b6fc6db63a7dbb091a144c607b2f339993d79b0a7ab338d02c9612af63296624a1ba1f6de03b96fc245d
-
Filesize
512B
MD5023a42e305e368353a4c3f432871c0e9
SHA14941e143b7c59f5969ee880612960e1d7b18856c
SHA2562e0d762e08ab909694a48bc52fc32a885ea90169ffb6566d2d08e570f6d67bfc
SHA512508f8897013670c8beaa332e3fa9e365e48d2ba6e869bda00091d5c537f745f7d12e27691c8bdea2c3b1a0cbc679435939e4678f0032a5231fb96f55e443c097
-
Filesize
40KB
MD533bacb52af2cddc87be341fdc9adea73
SHA1ec7324ca432629bf6ee03359dd14cfbffc520c8a
SHA256cb2e85fdbf1b9bb3d81f2056abcf034b3ffa22e2dec34fd269085fe64220f086
SHA5124ba7c2b379e324181162c36d527350f87d8524e13c8428892edfeb28e683279337af8330b55b65c677cbc96bb3d79c62169e7966c65620b34f2c398f00c9886d
-
Filesize
8KB
MD577918884613a4dfd9b14a444eedcae6b
SHA165c7273528588ff0ee88ed6d177f1a921fc47fc1
SHA256b971d845e4109c14b89266b5e5c1f7ceb2f2ad4480c1814d90b1749c73a445cd
SHA51227e45ba475d16fa8821d9530dbba9e10a0d7c2c6310c250f6cbb99a7189319140bd15c3348d524683943dc575adfb7ca8103d4b0e3f0429689f493a44b03bd4e
-
Filesize
512B
MD53e75b032a11e3a52b81fe6dcd37b4cdf
SHA186effe26d4d976a4cc642f992f27f86fa32c8b09
SHA2567c66292e80e776fac8b1c0c201b30852548238538462695e5e39fce921a60df5
SHA5126cae8458057164c0e7a13e937fae61c216a60d72b69f1e80908a222d448bd40aa72a6708abc6da090848c1e1d01a2fe7b48489ae50caaab0b2b6b33c1aec3a3e
-
Filesize
20KB
MD538239631095929d7040dab66f3c43ba2
SHA18facfb2a434db93c4d230a844965fcaf4add9a71
SHA2563833903d759f0141460db0878a6789b882d723eb0bfd0a5daf5e83d0ee28ab89
SHA512f11b1adfd793882b5ee545e64ada878541347f2a1b2ca3d2bc5982c2aa321cb333c6bda666f3fe76d728654836366e7ec9592fe8cd539aca9384cdc259969015
-
Filesize
28KB
MD5924e8d876830616bfc401ee5a5e64225
SHA11caaa4b15e0e9bdb7bb540c37f5518ceadf80214
SHA2566a912b040955c84b13cd3b7224673d8cf96746689840d2b3bbe6d5dbdb8c63b9
SHA512974f9e4d4bd724308a2a066bb8ccdd8355c69c327dc034f8a742d0cdb012e5f4d8544aae43ad8a2ede8e3d41c942262de3dd1c13399677447882fb394b168c1a
-
Filesize
512B
MD57df5e75840c15039e1fef93bcecc7698
SHA1767258e6bf656604fdf96647e806029cf7692543
SHA256e1cb6a0a5544eb2c38d90ff46a9aebf171b2aba854d8b6e077eda92fd4bf5f0b
SHA512041a6887c38256608fe120479bd4cc1bd5e9ab5f28b440017997a6b03995742bee1a6bbb95739096c6082ab27cd84eb9366d088c6ee883ac6d369ee13196524d
-
Filesize
40KB
MD5e64eb0da27f0eeabffa47b561e273c81
SHA13ebd9e0ccb0609f91adf2366419139008c692589
SHA2561ad8fb304cd73c092c83538d3768d6286dd8ad1b59f84258d67ebba481fc769e
SHA5121dd57f1d62b1455778bf77eac4b15f984814cf6aef2f979f26254bce3407ee9dfd3fcf5bedc701cf9a628190845857074313ac723c2748b5f76cdddee84a7a95
-
Filesize
4KB
MD5f2b4b0190b9f384ca885f0c8c9b14700
SHA1934ff2646757b5b6e7f20f6a0aa76c7f995d9361
SHA2560a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514
SHA512ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1
-
Filesize
512B
MD5508a5226de3398e1e810029f70270e9a
SHA165d207f874e3b5e0da0ff65204bf5a38c06669dc
SHA25654a423208ad3b1cc74ee882edd4c3cb399b83572fa0ee0e09a1b2ed4b1d8688b
SHA512d7b6c6a8603936f15686adcd9f36941426ec3f35c631b046bef38c394006cac97564ad3822b6c2b8955ab3b97285ff54be616d756bb3afe7773f1a5361a3f2c1
-
Filesize
12KB
MD54072783b8efb99a9e5817067d68f61c6
SHA17cb41fea50720b48be0c145e1473982b23e9ab77
SHA256f3cc103136423a57975750907ebc1d367e2985ac6338976d4d5a439f50323f4a
SHA512b9b362ac8b88c1eaae1fa87f8498050450d7aa6c7d07698c3aaf8a355b603b6d535e74b47f6da4b4798b04df58b3b6eb1dbc4782fa07756bce10933ed86017d3
-
Filesize
16KB
MD5ed2feb6e84d8eb21d42b7a2b32f0628c
SHA1dad1bf77d842f98ae47db3e8e2b992d37ef16c04
SHA25629a2f3e3fc651c35bf0794c739a83e97deefed2764e5235af539b4415dc4341d
SHA512581845e6a8072420f78b0dcb4123935f66e1304084f75a836025d43638aa6b189973a06e111ed3c9be92620c68cbaed4a9584869bd31727e03c0e95224fe16e9
-
Filesize
512B
MD5681a28e265149d3687ca705cad61bcd9
SHA1114c1179f35afb44ddf4b62ba186b21de1aab3e0
SHA25637c98c85fbd7ff2d9c047272448889ee19f337602f3a867d901d33a8d1364eca
SHA512fd0da0d8e685c3f89543f1fe71fba165c2117f8862da400a9de7e73146cd5711f48e7aea2cdec65b4559505454fe10d0ef711d6bdc7763873504221472affd06
-
Filesize
28KB
MD5cf845a781c107ec1346e849c9dd1b7e8
SHA1b44ccc7f7d519352422e59ee8b0bdbac881768a7
SHA25618619b678a5c207a971a0aa931604f48162e307c57ecdec450d5f095fe9f32c7
SHA5124802861ea06dc7fb85229a3c8f04e707a084f1ba516510c6f269821b33c8ee4ebf495258fe5bee4850668a5aac1a45f0edf51580da13b7ee160a29d067c67612
-
Filesize
32KB
MD589123551e9d3e483c87d030ec6dc7e1f
SHA1f83f187bab8f9aac0942dd95449e583955b9f489
SHA256964e184abc93d13f53a28aca7a89dcda92f5a82a90c151d7bf54ecd91b214314
SHA512b60a13274d4ae3908d6fcd1c324e2347b8c6ea82464c01942ce3f686035f9019df213de58044e917cc21d0f3a79f9963f4cbdbae0d2a28e8a0e6389fd0a40362
-
Filesize
12KB
MD53fe30614d7e0d11db870b4624f6c50e0
SHA1053ff0fc621ab40f2afeddb3e7b4a73ee41ec533
SHA25667c532f0324228dd33b445cd399c1426e3a0e0cdc7b9358c66b402c5d40a838d
SHA512c7c09e97a408e88aacaf8099ad4d1fa604d58113393500a384eb3c2eb7c3c105af41314934b86eca2f088045cbab5a20d768bbb295448dc1ae6cb6c3f59821ae
-
Filesize
20KB
MD560e4cf217e77c56efd3707b603797c5b
SHA1816247b4883d3adb30c4db39fda16d2288e27de0
SHA2568e2b8343f703045fb8596dee1888f65fc66b64d10304a4a49fd4ad1f63bd67ea
SHA51222a8cd2974663e8caa220177e7bc64aaf35735dc8abc3870a7e47ea86b02d8b06b041000e5505039b3116290aee67e9645ad2d9c26218749f5b5b2e332712af2
-
Filesize
512B
MD5bd3f52bd9c48c4b1ca19b64cffd5f5fd
SHA17d8808b047297e9b80c377ea4a3690f719545ebf
SHA256ac55560eb040c167a24b51e904c7b3d5f725fa75bf8e526e6cfe0b79b120a875
SHA5128c7c8626fc0dba804ec43ef9491645473720c0a971c2f888a1cb33b702d3bfa1f36730159431a9bac5e63e392941bb1963ae739a16188c108b5593b3a52660d3
-
Filesize
16KB
MD5f01d4141148b268fb45a24aa37047713
SHA19a20ab880009701819d74c2159b647e75865bb6e
SHA25665d3fccc6c58263b3bdf65e007972fec0d1a298ae50a3b74c133eca5c3f763a4
SHA512de92ffe72dff2f236d49a085cb7b1724d5bf2164dc10d69f348f723c56645c880557b7c26de7a52a5820ede151bc965e0587d4fb2ce89d79fba26280fcf6c650
-
Filesize
20KB
MD567ec0153e344be1011dbca235f083059
SHA178d46dc624bb2689ff66ae145b7d131f41d5beef
SHA2564ae3404c2842dde81c92e0519afd287513667ac1572d45fdcec4c990aa92774a
SHA51281f5da4074ba8747e46229d4353ef92c4b97f408feb939af0d5187848f3e3ee62c6730179efd2407b9acbc5364655166894d721e0fe70d4e4f9333aedf3e4093
-
Filesize
512B
MD5be5a7a05c005de7086e364672275e79e
SHA11d44dd84922b6af8f880968c6034be42fab0ebe9
SHA2567daa0f32bb1fc3621c8480527295c21731ec9e6be720f234dfbf730ad0e1bf99
SHA51246340c6c70b65a17ccf144a61c4a026c44d84f674a14c0dac0f61dac8264a811099bafe7d54e697ac79634edc779f8aee3aea61069b49d849d65e9053a7dbe96
-
Filesize
16KB
MD5c2ff834714aafceeb2d4b8fab306589d
SHA15e01e69f55f6432f41a9e6f03aed58b100aa6857
SHA2569336cdcf34258c4efe8cc9d68b5a5cd782ed30c34fa5870922eb6e4d61c9ce1a
SHA512a75e5ba3ab3f0697296ba93087979e06f85a294a10f3c15adfc6a7d1a196dd300901308da1da695c9ab18d5d59cd2af901b152c6ef54f7e0a89428f673fef86e
-
Filesize
512B
MD546ffab1730d657b0c136eb95eea8ced1
SHA1331df26842ec126d65df124c550da2e0f97b3ea3
SHA2569fb18245597fe63fa3618ca55e7e106cfae5633df5f3bdd5b6546aca0c086ea1
SHA512bdea7b52c734d9e668b5724116bf6e2c4c306d6008e9604e526d865131ea808b70663f75225d30e7aa95ec2c236897bdb25c1cd7abd7b5652e49eb64d78f5770
-
Filesize
32KB
MD53c9e27ffe0407892f709d0ab37799b6a
SHA17d8c82021a644924a6cc1bbf448c16a09a3d01ca
SHA2566393666a3d039270d92445bdb2acc3bf8c6842efd8748158b19065211d6338f3
SHA512af4d55de36e5e6ff19b87af895562da8e3d2598cecd0c66afd0422f788750cd6be87640b3b584fd10ee0c0ccf51a04c54e16c24d1fc791c1cd749efd894513a6
-
Filesize
612B
MD56283ceb30ea4a9af8ff362141534c76b
SHA175c701268d666a6c2f892ecff9bdd1e34a595b2e
SHA256694c5f07f2f39827626dcfb4eeaac3ce1d6d8bbc921c22f3370972cb7d9a1610
SHA5126dc604fbee47d3a8eb17d28ce33f373625c624df3a3a6969a35e24427aac99b66894b415e3a7a8749fd3f9af7b0f0912722b69e805d86a2520543f7f74e8ef8d
-
Filesize
520B
MD525e61344694b4f6c9e54a5c7b9e85be5
SHA1602682b67de9c4c4a0757df8511b191644ef9467
SHA256cd6cdc36af59669cfb9d44bae0ce7561c21811e54f2f66f62b7f0f8a21921aa6
SHA5124da0b95fe20bda82dfe92a262ef87a8ea35ae5a011e46992b67ade95cc40ba797f6675155aab271c4850baa5fb1a931fa77b8bb8f66fdd5a8fdb5bc684009f06
-
Filesize
544B
MD5ba00ed1217127aeb54e128b0564e3077
SHA1198d088e629ce9eee66c8a18fdff888d3862db86
SHA256fb4adbdaefb28d7dfdfe9f334cdbaf9eec8776d9bc8c7bf7018ce47c15641c23
SHA512d37334dc89d3cd2d031158c6a41483fbd19c25766a7a979cc6040946a30a2c93f47f60aefa315ee8f46e19de6c190b324222f3a6569c20238a98e049dc1552e3
-
Filesize
1013B
MD5f54c55cb7345597cb7b7ef027e98fb21
SHA111f1798e350e816800e5ca1a1348477c949446c5
SHA256036aa7164c17601c9dd31193cf73fa4e938f24191f417c8d3c02dd8b021a2e51
SHA51240b32e7f2f3e25034ed1c68915be247fef089246e5addc25d456f4f2d525f52a03ccbc61bc137673e88ca44bf99d8fb9f6db1bdf0d401edc7adbd2d856b4b542
-
Filesize
1KB
MD5b19b35be0f93a8f2e470567f9dd41179
SHA19a1713c10336cb5fcafe1de09c2f6bea4ecc3c15
SHA2565ea045c95ee346e35c3ec7bd4ac21b706a41f17b1905956cc06e0ab00f10ab68
SHA512fdd1209b5c3d3378b8f0cfb5e5638130630a79a61cbe17e6d36f4236b977874f4ad2d5eff16cd9c5ec2d76ae6a3ffdf2b138f1801d20abae4b63d467c909f546
-
Filesize
1KB
MD5d54284edf32262aa8837afc0eee6b92f
SHA1f8a79a704bdf886ffb852747f2f4e8dc130615f9
SHA256f62ef9ae7180b1ea7ab3fea6be95f012dd853cfe3d84a6f5b6739ba68d55f9a5
SHA5124179333d5c02cc7fda97efc43432811ef7122daf9c485a3cc9dc73970a90bbbd22a470ece2e8be958b46e06c75b51bfcb3b320d30f6487af6c64c84e1e4edff2
-
Filesize
32KB
MD513bcb329277b3de20c6278ce3b2d7fa9
SHA164dce3679160e057b60189ffed388f0025aad593
SHA256d96895ffb64ce4fb6f46c325498ffee8d67926edc2cece7afd6c5e431d464f0d
SHA51273141c5b397c39f0f3dcfffcca77f7998498dc4a9667acd6c1f969f49984b04bd7a9b2229199c8047048b05c007df6000c09c9d6279862623605fb32aef07689
-
Filesize
2KB
MD514ee1c67abdf43d8a3d235425836115f
SHA1bc2c9cd2e5cb7ff3efc8696e5a730db10a0adb89
SHA256fe405fc03ebb4d73a615aa97ef6714f2275bc2292d0bb43f747e910364515f67
SHA512fa2596b31bbf93765b9b0a8822d5a3b396ad7f0cef0d97deb8c6c889e15731d5dfdf7dc751ecacc34caae39c0773cf9af64cf46720842ab2242a4784d7196499
-
Filesize
76KB
MD5121050b0238f804e63f2d501df3a8fcd
SHA1ecd7e2a0defa2b01665bd164267ef1f269298222
SHA256fc4390b1dbcc3d14aafef204d76cc311cead4baf55f32b8296b5e27f0dfe5483
SHA512112d0cb1834f2c602956eabf0d5732b4df070142a636151c99ffc5f72160366ad99761c37aa1f71b8047dbc51ef614fa2531b902fce6c589c8a4c1b383714bd5
-
Filesize
57KB
MD5405d7fe851061a260f080bc6a292bb6b
SHA1ddeabfd2d8ca90583cfdc67308c5648ef44f60b4
SHA256eeb7d3e3276a9f23cb6f51ee91a3580b955b5b7f16edff586c764e4567ad1309
SHA512c9a2791f05d5cdbf623ea089ee799f2b8336ddcb5a90f7970cd7f6a4ea0ccd6f02469781de82a01b5bdb492783fc8587911776fab0be8c6b0537001c3150e840
-
Filesize
174KB
MD53aea2d8c792865fe9e4b244825aa9039
SHA1cdf6c37e14d41618abc7dad2724e8a1df1ac0123
SHA25642c2a3b99c7595735885d40bee6cb902795e140917fde9503a6e0bc7ac570ea1
SHA5120f65a13e4d1baa24f956b85f530585ae251a55f8e1eb9435207305747b4c2fcb411ba70354f5911a7741fad4749e278fe2b4dd50dc42193eb7048c65ca2f8eea
-
Filesize
83B
MD5a6f47d5f32b2d70786e1c3bb660ed259
SHA15ca31b6c70d072adf23a99ed2668a70701308024
SHA256f90fc88b944bd1af477d2ed4b90579c537e8ead227ca033b730cd716b9f14086
SHA512140fb617d97ceaf6c32f0709ea39399d4ccde740adff13b217a229568df65b7ed5a5db6040f9ed24265f9f184c4f8439172c3f584f7042d081188ac01680812d