Malware Analysis Report

2024-09-09 13:43

Sample ID 240503-gel8zage5v
Target 1dda2398fb3c4c2aee9b2a18f0975b921cbd2809625618d7a91d174806c677b7.bin
SHA256 1dda2398fb3c4c2aee9b2a18f0975b921cbd2809625618d7a91d174806c677b7
Tags
octo banker collection credential_access discovery evasion impact infostealer persistence rat stealth trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK Matrix

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

1dda2398fb3c4c2aee9b2a18f0975b921cbd2809625618d7a91d174806c677b7

Threat Level: Known bad

The file 1dda2398fb3c4c2aee9b2a18f0975b921cbd2809625618d7a91d174806c677b7.bin was found to be: Known bad.

Malicious Activity Summary

octo banker collection credential_access discovery evasion impact infostealer persistence rat stealth trojan

Octo

Octo payload

Requests accessing notifications (often used to intercept notifications before users become aware).

Prevents application removal

Makes use of the framework's Accessibility service

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)

Removes its main activity from the application launcher

Checks CPU information

Loads dropped Dex/Jar

Queries the phone number (MSISDN for GSM devices)

Queries the mobile country code (MCC)

Registers a broadcast receiver at runtime (usually for listening for system events)

Obtains sensitive information copied to the device clipboard

Checks memory information

Makes use of the framework's foreground persistence service

Requests dangerous framework permissions

Declares broadcast receivers with permission to handle system events

Reads information about phone network operator.

Requests disabling of battery optimizations (often used to enable hiding in the background).

Declares services with permission to bind to the system

Queries the unique device ID (IMEI, MEID, IMSI)

Acquires the wake lock

Uses Crypto APIs (Might try to encrypt user data)

MITRE ATT&CK Matrix

N/A

Analysis: static1

Detonation Overview

Reported

2024-05-03 05:43

Signatures

Declares broadcast receivers with permission to handle system events

Description Indicator Process Target
Required by device admin receivers to bind with the system. Allows apps to manage device administration features. android.permission.BIND_DEVICE_ADMIN N/A N/A

Declares services with permission to bind to the system

Description Indicator Process Target
Required by accessibility services to bind with the system. Allows apps to access accessibility features. android.permission.BIND_ACCESSIBILITY_SERVICE N/A N/A
Required by notification listener services to bind with the system. Allows apps to listen to and interact with notifications on the device. android.permission.BIND_NOTIFICATION_LISTENER_SERVICE N/A N/A

Requests dangerous framework permissions

Description Indicator Process Target
Allows an application to write to external storage. android.permission.WRITE_EXTERNAL_STORAGE N/A N/A
Allows an application to receive SMS messages. android.permission.RECEIVE_SMS N/A N/A
Allows an application to read SMS messages. android.permission.READ_SMS N/A N/A
Allows an application to send SMS messages. android.permission.SEND_SMS N/A N/A
Allows an application to initiate a phone call without going through the Dialer user interface for the user to confirm the call. android.permission.CALL_PHONE N/A N/A
Allows an application to read or write the system settings. android.permission.WRITE_SETTINGS N/A N/A
Allows read only access to phone state, including the current cellular network information, the status of any ongoing calls, and a list of any PhoneAccounts registered on the device. android.permission.READ_PHONE_STATE N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-05-03 05:43

Reported

2024-05-03 05:47

Platform

android-x86-arm-20240221-en

Max time kernel

39s

Max time network

137s

Command Line

com.beautyship5

Signatures

Octo

banker trojan infostealer rat octo

Octo payload

Description Indicator Process Target
N/A N/A N/A N/A

Makes use of the framework's Accessibility service

collection evasion credential_access
Description Indicator Process Target
Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByText N/A N/A
Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId N/A N/A
Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId N/A N/A

Prevents application removal

evasion
Description Indicator Process Target
Framework service call android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction N/A N/A

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)

banker discovery

Removes its main activity from the application launcher

stealth trojan evasion
Description Indicator Process Target
N/A N/A N/A N/A

Requests accessing notifications (often used to intercept notifications before users become aware).

collection credential_access
Description Indicator Process Target
Intent action android.settings.ACTION_NOTIFICATION_LISTENER_SETTINGS N/A N/A

Checks CPU information

evasion discovery
Description Indicator Process Target
File opened for read /proc/cpuinfo N/A N/A

Checks memory information

evasion discovery
Description Indicator Process Target
File opened for read /proc/meminfo N/A N/A

Loads dropped Dex/Jar

evasion
Description Indicator Process Target
N/A /data/user/0/com.beautyship5/cache/qhqrdtmuyib N/A N/A
N/A /data/user/0/com.beautyship5/cache/qhqrdtmuyib N/A N/A

Makes use of the framework's foreground persistence service

evasion persistence
Description Indicator Process Target
Framework service call android.app.IActivityManager.setServiceForeground N/A N/A

Queries the mobile country code (MCC)

discovery
Description Indicator Process Target
Framework service call com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone N/A N/A

Queries the phone number (MSISDN for GSM devices)

discovery

Registers a broadcast receiver at runtime (usually for listening for system events)

persistence
Description Indicator Process Target
Framework service call android.app.IActivityManager.registerReceiver N/A N/A

Acquires the wake lock

Description Indicator Process Target
Framework service call android.os.IPowerManager.acquireWakeLock N/A N/A

Queries the unique device ID (IMEI, MEID, IMSI)

discovery

Reads information about phone network operator.

discovery

Requests disabling of battery optimizations (often used to enable hiding in the background).

evasion
Description Indicator Process Target
Intent action android.settings.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS N/A N/A

Uses Crypto APIs (Might try to encrypt user data)

impact
Description Indicator Process Target
Framework API call javax.crypto.Cipher.doFinal N/A N/A

Processes

com.beautyship5

Network

Country Destination Domain Proto
N/A 224.0.0.251:5353 udp
US 1.1.1.1:53 semanticlocation-pa.googleapis.com udp
GB 142.250.179.234:443 semanticlocation-pa.googleapis.com tcp
US 1.1.1.1:53 tecbabbshop24578.shop udp
US 1.1.1.1:53 karakalandankasd5.com udp
US 1.1.1.1:53 karamdsadvs2.shop udp
US 1.1.1.1:53 tecklardankalan.shop udp
GB 142.250.200.14:443 tcp
US 1.1.1.1:53 android.apis.google.com udp
GB 142.250.180.14:443 android.apis.google.com tcp
GB 142.250.200.10:443 semanticlocation-pa.googleapis.com tcp

Files

/data/data/com.beautyship5/cache/qhqrdtmuyib

MD5 7cfcfcdf2f1a2e962d3975435a55b97d
SHA1 0e3b3c6e167542c580dec3a674f2fc3b4e91628d
SHA256 abe48a2b945177b37b9f59db9f4d8f92ea9dc991f0835b7df3191e937b6d8929
SHA512 eafb08deef09f5b4644c42e9bccac724dd5ba0345f43ea5cbc4ca8286b6ee34e579fa6195fbff24ceeb5e25db521e44edd99cc4d9a5691405e0e1f71b805548a

/data/data/com.beautyship5/kl.txt

MD5 6311c3fd15588bb5c126e6c28ff5fffe
SHA1 ce81d136fce31779f4dd62e20bdaf99c91e2fc57
SHA256 8b82f6032e29a2b5c96031a3630fb6173d12ff0295bc20bb21b877d08f0812d8
SHA512 2975fe2e94b6a8adc9cfc1a865ad113772b54572883a537b02a16dd2d029c0f7d9cca3b154fd849bdfe978e18b396bcf9fa6e67e7c61f92bdc089a29a9c355c6

/data/data/com.beautyship5/kl.txt

MD5 9fc8fa2644f287ad7bc19c398f986eba
SHA1 82af8448f5929af4a299eab7e25acc24066b4a23
SHA256 1a477e93758d2413cf7ef8b625815962a62738d18f2c10f931499f8a814e799e
SHA512 0190275e5303cf67399224602ea768a85c8aab3ee75aa606ed0d00db008fc6846f4528a13b6b9b079cc899b6171865dd56ac57825fef30ccf55db27b6e2363c6

/data/data/com.beautyship5/kl.txt

MD5 3cd3a378a4516f848ad4a2bfac0bbebd
SHA1 26a6cb8ca6f08327bf44b75f8bd2fc1cc51418e7
SHA256 588bca6ced9ffa56fce9709854070c56078ad06c1855d8b79f7165c4fc08197c
SHA512 7b8123e2a4696a8082afce16cdae29812c1fdd47bdf16c608a40afeb1605ee10c60ddfc8f8430c4dfab66d342a4f4dd94a4c208a796e7aaa298ef4cc58905965

/data/data/com.beautyship5/kl.txt

MD5 2cf9abb5b191c3cee2f1110bf3c76b9c
SHA1 20e4dabb69e8a1bbfa7621dca5633d7b2e2b6d2c
SHA256 3efcabbb92d859d6f7ebc6b63caa4daaf06766bfa826b31b5717ff56631ebbcc
SHA512 207614e9e8424eaa75e075f7ae441d41d790e8ac83ea5bbc2dbd311d9ff6ef27828c58d2849b1912454dfe63dc9fda013aaf6552ea6339ed9565b1e57ed9d08b

/data/data/com.beautyship5/kl.txt

MD5 bb2e5fc9708f4619619e51cfbf7da5a1
SHA1 9d443f12a528ab211e7b0fb2c26191c1b816553d
SHA256 b99126b5fcaf9ce492f662c8fe6918e1527234c81c6a4b2ed9487ea7b34d724e
SHA512 1419716e75cebee3904a4e501e672954a555369cf600bb724d7b0cd8b0590b629c4dcfbabe055b1159b10d85c7a13abfbae79ba99dfc0be47b6834c5e8a0f069

Analysis: behavioral2

Detonation Overview

Submitted

2024-05-03 05:43

Reported

2024-05-03 05:47

Platform

android-33-x64-arm64-20240229-en

Max time kernel

61s

Max time network

160s

Command Line

com.beautyship5

Signatures

Octo

banker trojan infostealer rat octo

Octo payload

Description Indicator Process Target
N/A N/A N/A N/A

Makes use of the framework's Accessibility service

collection evasion credential_access
Description Indicator Process Target
Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId N/A N/A
Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId N/A N/A

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)

banker discovery

Requests accessing notifications (often used to intercept notifications before users become aware).

collection credential_access
Description Indicator Process Target
Intent action android.settings.ACTION_NOTIFICATION_LISTENER_SETTINGS N/A N/A

Checks CPU information

evasion discovery
Description Indicator Process Target
File opened for read /proc/cpuinfo N/A N/A

Checks memory information

evasion discovery
Description Indicator Process Target
File opened for read /proc/meminfo N/A N/A

Loads dropped Dex/Jar

evasion
Description Indicator Process Target
N/A /data/user/0/com.beautyship5/cache/qhqrdtmuyib N/A N/A
N/A /data/user/0/com.beautyship5/cache/qhqrdtmuyib N/A N/A
N/A /apex/com.android.wifi/javalib/framework-wifi.jar N/A N/A
N/A /apex/com.android.uwb/javalib/framework-uwb.jar N/A N/A
N/A /apex/com.android.tethering/javalib/framework-tethering.jar N/A N/A
N/A /apex/com.android.tethering/javalib/framework-connectivity-t.jar N/A N/A
N/A /apex/com.android.tethering/javalib/framework-connectivity.jar N/A N/A
N/A /apex/com.android.sdkext/javalib/framework-sdkextensions.jar N/A N/A
N/A /apex/com.android.scheduling/javalib/framework-scheduling.jar N/A N/A
N/A /apex/com.android.permission/javalib/framework-permission-s.jar N/A N/A
N/A /apex/com.android.permission/javalib/framework-permission.jar N/A N/A
N/A /apex/com.android.os.statsd/javalib/framework-statsd.jar N/A N/A
N/A /apex/com.android.ondevicepersonalization/javalib/framework-ondevicepersonalization.jar N/A N/A
N/A /apex/com.android.mediaprovider/javalib/framework-mediaprovider.jar N/A N/A
N/A /apex/com.android.media/javalib/updatable-media.jar N/A N/A
N/A /apex/com.android.ipsec/javalib/android.net.ipsec.ike.jar N/A N/A
N/A /apex/com.android.conscrypt/javalib/conscrypt.jar N/A N/A
N/A /apex/com.android.btservices/javalib/framework-bluetooth.jar N/A N/A
N/A /apex/com.android.appsearch/javalib/framework-appsearch.jar N/A N/A
N/A /apex/com.android.adservices/javalib/framework-sdksandbox.jar N/A N/A
N/A /apex/com.android.adservices/javalib/framework-adservices.jar N/A N/A
N/A /apex/com.android.i18n/javalib/core-icu4j.jar N/A N/A
N/A /apex/com.android.art/javalib/apache-xml.jar N/A N/A
N/A /apex/com.android.art/javalib/bouncycastle.jar N/A N/A
N/A /apex/com.android.art/javalib/okhttp.jar N/A N/A
N/A /apex/com.android.art/javalib/core-libart.jar N/A N/A
N/A /apex/com.android.art/javalib/core-oj.jar N/A N/A

Makes use of the framework's foreground persistence service

evasion persistence
Description Indicator Process Target
Framework service call android.app.IActivityManager.setServiceForeground N/A N/A

Obtains sensitive information copied to the device clipboard

collection credential_access impact
Description Indicator Process Target
Framework service call android.content.IClipboard.addPrimaryClipChangedListener N/A N/A

Queries the mobile country code (MCC)

discovery
Description Indicator Process Target
Framework service call com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone N/A N/A

Queries the phone number (MSISDN for GSM devices)

discovery

Acquires the wake lock

Description Indicator Process Target
Framework service call android.os.IPowerManager.acquireWakeLock N/A N/A

Reads information about phone network operator.

discovery

Requests disabling of battery optimizations (often used to enable hiding in the background).

evasion
Description Indicator Process Target
Intent action android.settings.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS N/A N/A

Uses Crypto APIs (Might try to encrypt user data)

impact
Description Indicator Process Target
Framework API call javax.crypto.Cipher.doFinal N/A N/A

Processes

com.beautyship5

Network

Country Destination Domain Proto
GB 142.250.178.4:443 udp
GB 142.250.178.4:443 udp
GB 142.250.178.4:443 udp
GB 142.250.178.4:443 tcp
GB 142.250.178.4:443 tcp
BE 64.233.166.188:5228 tcp
GB 142.250.178.4:443 tcp
N/A 224.0.0.251:5353 udp
GB 142.250.178.4:443 tcp
GB 142.250.187.234:80 play.googleapis.com tcp
GB 142.250.178.4:443 tcp
GB 142.250.180.10:80 play.googleapis.com tcp
US 1.1.1.1:53 www.google.com udp
GB 216.58.212.228:443 www.google.com tcp
GB 142.250.200.46:443 tcp
US 1.1.1.1:53 android.apis.google.com udp
GB 142.250.187.238:443 android.apis.google.com tcp
US 1.1.1.1:53 karakalandankasd5.com udp
GB 216.58.212.227:443 tcp
US 1.1.1.1:53 karamdsadvs2.shop udp
US 1.1.1.1:53 tecbabbshop24578.shop udp
US 1.1.1.1:53 tecklardankalan.shop udp
GB 142.250.178.4:443 tcp
GB 142.250.178.4:443 tcp
GB 216.58.213.4:443 tcp
GB 216.58.213.4:443 tcp
US 172.64.41.3:443 tcp
US 172.64.41.3:443 tcp
GB 172.217.16.227:443 tcp
US 172.64.41.3:443 udp
GB 172.217.16.227:443 udp
US 1.1.1.1:53 android.apis.google.com udp
GB 172.217.16.238:443 android.apis.google.com tcp
US 1.1.1.1:53 remoteprovisioning.googleapis.com udp
GB 216.58.213.4:443 udp
US 1.1.1.1:53 newsstand.googleusercontent.com udp
GB 142.250.200.1:443 newsstand.googleusercontent.com tcp
GB 142.250.200.1:443 newsstand.googleusercontent.com tcp
GB 142.250.200.1:443 newsstand.googleusercontent.com tcp
GB 142.250.200.1:443 newsstand.googleusercontent.com tcp
GB 142.250.200.1:443 newsstand.googleusercontent.com tcp
GB 216.58.204.78:443 tcp
GB 142.250.200.1:443 newsstand.googleusercontent.com tcp
GB 216.58.204.78:443 tcp
GB 142.250.179.238:443 tcp
GB 216.58.204.78:443 tcp
GB 142.250.200.27:443 tcp
GB 142.250.200.27:443 tcp
US 1.1.1.1:53 i4.ytimg.com udp
GB 216.58.204.78:443 udp
GB 142.250.200.46:443 i4.ytimg.com tcp

Files

/data/user/0/com.beautyship5/cache/qhqrdtmuyib

MD5 7cfcfcdf2f1a2e962d3975435a55b97d
SHA1 0e3b3c6e167542c580dec3a674f2fc3b4e91628d
SHA256 abe48a2b945177b37b9f59db9f4d8f92ea9dc991f0835b7df3191e937b6d8929
SHA512 eafb08deef09f5b4644c42e9bccac724dd5ba0345f43ea5cbc4ca8286b6ee34e579fa6195fbff24ceeb5e25db521e44edd99cc4d9a5691405e0e1f71b805548a

/data/user/0/com.beautyship5/kl.txt

MD5 6311c3fd15588bb5c126e6c28ff5fffe
SHA1 ce81d136fce31779f4dd62e20bdaf99c91e2fc57
SHA256 8b82f6032e29a2b5c96031a3630fb6173d12ff0295bc20bb21b877d08f0812d8
SHA512 2975fe2e94b6a8adc9cfc1a865ad113772b54572883a537b02a16dd2d029c0f7d9cca3b154fd849bdfe978e18b396bcf9fa6e67e7c61f92bdc089a29a9c355c6

/data/user/0/com.beautyship5/kl.txt

MD5 7f27aad5fbd8691c0f69ed2dd5fcce36
SHA1 f622b95fe0dbb25a7922fa0c28e0c3f497e3b99d
SHA256 acb960c6e8a29502ad7bc2efea3fcd1ce91eac5a34f70dabb3df3dcedf72a992
SHA512 2cd09ef67e2b288927a1d5ef18dae41e7685dd2dd348acf33aec9b93ec764544b07c4bb09b23131cb9c3ddec23a803726351a44c604a345347113ad2fcb16809

/data/user/0/com.beautyship5/kl.txt

MD5 6ce1be9f2b2bcc4149f600c000178920
SHA1 f91b19249a871dd2e87d045b43d6424a7f03d306
SHA256 d84ca96b920f774ab6d73f89a2427f5d791417df47b76760abb13e700ad881b1
SHA512 ad77d8e2b3bc10767dbfff60ae892b53066e7b50a912ae4a38f3615822f5524ee9f3ae9ce62be31bd2a5d00508b3a704278c49bf213d5d258d7d6a7bf8c1b90f

/data/user/0/com.beautyship5/kl.txt

MD5 9a1ef346708d24fa891ad080d7b667f3
SHA1 b738de93bc81ed9839a4223d9ec890f6097d3d1e
SHA256 d35a037c9a63e0c7d5463ae9becfe4396b9f14c56a78ff88e0d89b78e603e0e6
SHA512 cfe2b872b573af64371a4d9faa6b5dc9dd290dad1634cd4cfcbac500000becebee8a93b369a3873e277aed9887ea6353428c87b4e7b28e6bb55d5424581fc1b8

/data/user/0/com.beautyship5/cache/oat/qhqrdtmuyib.cur.prof

MD5 6af14bb3a5d26476f2a43888673a816a
SHA1 4b4553d799974a0ccf1307e46266434543664ad2
SHA256 14d73d9d3658e9ff2452f107e60fcb3c12592645173343185cbd10835232ddc1
SHA512 62c6089e2b0ecdd3480a251b8495ea9c0c2fa20d4515f5eb17a8e682b90f358018de272286c47da148ecf5de8bcc138b9e94eabc05c4e182d8383543fd7dd276

/apex/com.android.wifi/javalib/framework-wifi.jar

MD5 38bb2ecc2647701304bb9980e35480fd
SHA1 1bfc5c534617cbd176268d6a267abd59959f3184
SHA256 79bb444346e1086292f96dfd8f859fe6e72fb439c1426db6915aaddb5bd30a65
SHA512 02fc2026b43e02c25cb370606ff2adfc3c9b66b393250ca92b2d5eabbfbd2568c391d8932ba774bd5c5661c850bd71157a0ce454b195658066b65b7363a1f551

/apex/com.android.uwb/javalib/framework-uwb.jar

MD5 7f8f7e544abbf10bf9d0623e09aabe34
SHA1 ee06d0f1adc3ce304d2b4dde0bc043b37a0e32fb
SHA256 31ec5ef294c561e6ead889767bd0656714f42998717a947427150d51dbc3b367
SHA512 8c49570f530b73c9edeb948ff89f1d4491273e4c5ae7a79156d38f12d5cc93076f325913107848cf91f566ee7b59c30b86db213c078fd0a635e9aa6eb9a99ddb

/apex/com.android.tethering/javalib/framework-tethering.jar

MD5 d81b5e468aa772e188d4d826bea7022b
SHA1 a95510ede5c549b29c6778b235863a6c817d982e
SHA256 fdabd2584172b86fb29014cb70f61e5995c229db5fe098a80244809bb7bca7cc
SHA512 bcec5c487477d83cc8aa43c75bc1eec9d3e50cf34960c302ace30d8a91a1ed298b5314dcf83845dd142be202cf960a4514eeb8dd376fb7947c7728349d940ae3

/apex/com.android.tethering/javalib/framework-connectivity-t.jar

MD5 6af554dbf0735cde24b20ffcbc996fc7
SHA1 2f8e3e13b167f5a619b4a4aba6e735516a04f68c
SHA256 595956d19b204fce5ae88e02999467cd6bee084158ef209fce06958d76806608
SHA512 b450779b88d6e07537e6cb39e413ae69c8b60e4e18786d9654f5d610abbe404f83c9ed9036977051766a1b414d7434383c6dfab7edda3d854b0a16562d41f6ab

/apex/com.android.tethering/javalib/framework-connectivity.jar

MD5 4f7a254ff28a65ea2a4cffe24b1339ce
SHA1 5c2861faf85e3086eb0144bb6006099503b5e283
SHA256 13f8f21e0f6c093ce54e81bbd0e169f605060d68a60070bffb0e1ba2e54a40c0
SHA512 53357cfbdaf076104dc6d6feeeabe1235d8e4214bc4b5b3a70eab2107799be19efc0b970add2eb65e8c099b4f0dfce72a309842a5d0bf6c266e3707b73311a2d

/apex/com.android.sdkext/javalib/framework-sdkextensions.jar

MD5 dde2bd24649e82bea6ea5d8bcf7c0589
SHA1 ad1b2b9ffeb9e87ce85db2d47a896c551990a985
SHA256 835e58ff912600ddef1b3fa9adaff5d7e2c4b379fbe8adaac065122777b204a5
SHA512 2b9b75466911a0e7f75b02d7132a497017873752a4310a2c79251b546e0c5e426f90ac460fed1e932e6119738cada32cc6df041d4b9c49200675dac9d470abe1

/apex/com.android.scheduling/javalib/framework-scheduling.jar

MD5 9667a58cf7cbf24089068395a663542d
SHA1 233b15ea03809e8d55249ecc2a386ed8d6f1b05c
SHA256 a80d2a1dd96cbfd38ed68d8934611f2294ff8f85fce7378500570814d571ce7e
SHA512 21b7e60d5e299fae15d61212f657504aa429120ed90f0facae98b5e04b16f35fd79b63a6668c9a1bfa799e47f42f42ce9495e475b86e01837cfcab88111f92be

/apex/com.android.permission/javalib/framework-permission-s.jar

MD5 dddbffa4fb9866e65e46ddedbfc917eb
SHA1 d1b1e3f5e3596544a4259a019607d93b31d2a271
SHA256 25c24c41332b5886427c5864067ac491e163a6c729bc219b31183b229e5d3219
SHA512 6a55f0c915ebfcff4fcd928dc67a0126ae7a0467c8ba39028996c219d089312872f8a2f672ba9b3886d003726961da10d66a8459bee91934fcde28ec8ea110d1

/apex/com.android.permission/javalib/framework-permission.jar

MD5 11055bb5f97d6dac0aa37bfeca7051e8
SHA1 b71d72d66800f512b9ccdbe3e3b1028f8e1090a2
SHA256 e62333a706d04ca49f917826f49770ad089d134580f050567de912ecac31302c
SHA512 787b6f40c233eae5c0e5d84c178f02f755cb0c8ba9ad3991e145841fcc05da69573d489f3331f46a778c365e25d3cfd20a1388d2cd6ee4dd99a0381feb90b2d9

/apex/com.android.os.statsd/javalib/framework-statsd.jar

MD5 c62549e4c3dc3dc6828b5930a696d82e
SHA1 a19f79ea7a2fb4a730e20817b52a51625ab23dcf
SHA256 22481f2149c6f9b6e8873c4419c8fd33fd72c7dd1ef8e968c63ba3a1c8eab914
SHA512 cef48a5871c75d214a74fdc2907bcb6052b7a6fee03c7463ee0922fb1158d08e770a0a6fa5412fc69bd5704b65800c9cf875a563a560a864778e873772747d9a

/apex/com.android.ondevicepersonalization/javalib/framework-ondevicepersonalization.jar

MD5 a226d2dab862fc8e24ab338ca5eefd26
SHA1 d424730e7a0ab29a2ef906b7e71e50f857d24856
SHA256 f2d356c75b62b631972f29ed268497b3088e80676f34c4f8ea779d30be959b4f
SHA512 df211db5e4b6dfaeb74f5cdbe9d776486753dec9d527364ffe3d38a1ccdc5718f8edf1d59a4a9bc1d0fe6cc568de9a43a46510a7cf2ea5c93cd3fd0cdf9adc17

/apex/com.android.mediaprovider/javalib/framework-mediaprovider.jar

MD5 5f147ff03fa6df46871cc7988719efff
SHA1 1bcc3c94c4edaec0c4b71d619ad6e93834c98420
SHA256 6ae5b642fe117238ea95d6f39931c86cc3e784115a0874e8b742dab88ef9629b
SHA512 d6d6e022fe31d6aed2663ffcd7c909aa22d93e4389f8c4930c32bf4b49062e57c4481f9c551cb2963457a0418cdef8acb24c123204127b0873e8b18e89a591d2

/apex/com.android.media/javalib/updatable-media.jar

MD5 5b75de85d1963c518cc39440e203e80a
SHA1 cd199428ef27a5e6c42462a600fe572a0c8cdfd3
SHA256 19eb02aed8c826a9a4b74d11a345e8ecbe1fe5562c5b9d13ac1286efaa4771e9
SHA512 de7ac7c3d55f36d9efe66d7fce049543fcf2e37c24e50f8e593c50b71e3d77271f50723a223e5b6877248ae0c53f9dcfd450dfe428e2b4e6ea5e5c8195ef0ea1

/apex/com.android.ipsec/javalib/android.net.ipsec.ike.jar

MD5 5041171aeeffa6ae45eef650b594445b
SHA1 cc2a8d2577fedf8cf3f5c146a7874a3420a9015e
SHA256 dbf99fd2ecc3f0a085855d9a53881b91132da8f0e85dd11d92ee46db01d6ab83
SHA512 79201fe62462460065e376879ff014232394dc608e838fee0e2391b4f01fa1e8c76866398894b8195e23d45e2ae56ce348930d9abbb14e622a0874df0f4f66d7

/apex/com.android.conscrypt/javalib/conscrypt.jar

MD5 7ce91e3f14e20db318e38b3fb497984f
SHA1 068ebff84b6fcb998fa518e39b78b4d52707edae
SHA256 787aa8fdbb20b5a4df8a61213c8df30de929dc610967f32712611b323d89d32d
SHA512 54ffec1ac57503575b6a2f471f8eb895b1042b2592b5febe63377e11522103dee0f70f01ae52cb2081b06dfd16ef79723cdc1b40680a6d2622fa0a5067b5267d

/apex/com.android.btservices/javalib/framework-bluetooth.jar

MD5 dfeab0380131c54e132e010995886029
SHA1 8d99f8257731637cace5f413916741a94fe5e460
SHA256 9f51175dca7d241cff99acba4f8e29a1b781f3d16a72baebc8ab7434ded1869c
SHA512 2f101e3e655e0d6ce4952ba462692d706752491d5ff3b8528d0331f1523ac227c0830a26c74bc850117f7bf028d1547cf190bdac02f647ca245e83d60f9715d9

/apex/com.android.appsearch/javalib/framework-appsearch.jar

MD5 45f2b5cef7279c9e721764da4618a83d
SHA1 c3b16d4e71bb29955481eba3d2e7bac78292d1ac
SHA256 a77cfbc9d66d3fde22540b2e6a5bee8ce21dbeb3f66c0d9121764513188252f7
SHA512 fbbdefd3117f8af38dc60676b85a86e7d38009bf839aca2d1d7f38960e05942befa7d5645f218cdbdba56aef6d7d1f5794ed3fb53c0f2134ec782323b03d7c9e

/apex/com.android.adservices/javalib/framework-sdksandbox.jar

MD5 898c6c1597e17488fff3ad1f075b126d
SHA1 ded41197706768e8fb5a27211091710de74f87cf
SHA256 e71199d47af29d61859792529bfee051ebb23b92747d57e402d6af30c8d2a9c2
SHA512 34126bb4f7e75a9386c5960685c2d6107b547ca545643a4158f09876d62e4a04e48961e01664ef9bebf2faa165952adb29d447281178fbdc4f157a079a2159dd

/apex/com.android.adservices/javalib/framework-adservices.jar

MD5 b7378810aaedc21703a206caa03483f6
SHA1 c7f25825108746487b3845bf92a050cd58d8696f
SHA256 ebf554eca9585be7cc99314e35c844d481ab811456055a1127b3df4641cf2ffb
SHA512 29dc68938e9ed5cf0ce51ed35ba10496ce703a9099a4a2dc4849470aa8f567b3052e08515dfee102f22c5b5bb6f2a4d21daf03b97a61e3d1d2964bc450956d37

/apex/com.android.i18n/javalib/core-icu4j.jar

MD5 baf8aae4583bf6989f30a3512d36cdf4
SHA1 b8623c5c6be23f8201cc1b826f83eaa6ac8f7b46
SHA256 baa7c3b0f8df0cb4e6b925b44ccf99dbe35dbf4be00a0ae33c5e4eeb173ce7f5
SHA512 420c583336e62cd5137809fc6d2267344d1d52fe5edd3e0ed8385207f6731d17a6370b61b6418260039266c2ae2c5e814c5eb9b16b4e672a6b0e3b1e5714f11f

/apex/com.android.art/javalib/apache-xml.jar

MD5 5c1dc5d635f8e0de770c930b244d72ab
SHA1 1cfab9c114f0e14bef8f58bbb5c46ea5c7f45581
SHA256 a592316ce171525b731179a84d91a1f7824d5e7c2c6f713d038163a95f7f3626
SHA512 fbe9dead311f0279587006fd60f13759635ae39f81f3eaaac71db264e2ef773788162fccaf6537f87e7b7b9d5a7e8cf0ff31561774686e1bc3fed0ec9bdbd363

/apex/com.android.art/javalib/bouncycastle.jar

MD5 610cf8fc8e3b9316656d5d8562edf98f
SHA1 6c628e96dcc908ef390c46a67de435b06607a2fb
SHA256 b12a49fda7dec105cac09b6d77b083d37b1be5d52f4f265790f2e348e5783f06
SHA512 3adc4a3bea3ce819f1b5eeff0988d5cb131d850f2a3ac6c484e4b7f4ced566dbd081d0cc6042ab3caa344098650c0b1a4c5f691f7921d2cf1ca395e08e3222b7

/apex/com.android.art/javalib/okhttp.jar

MD5 a4b2495e244595af5f3e3ef446f3fb05
SHA1 5a19ef43d0ffe4cb740cefd5bef48da5bf60e774
SHA256 14d759d0257e1be79263f4ff0bd41548af7f83f7d5f8f5029dae5e58a4687ada
SHA512 5fe72bbed317af46c385cde578bbb9d47e429ff192f96799ce81e891098ee45ce5d6287373cc78ae07b664af168e0ed7e516184883442132664e659ae5d0aba8

/apex/com.android.art/javalib/core-libart.jar

MD5 9dfc76933503bef1af365e42ed68879c
SHA1 65c92169881f1a10fb26a407494f9c4b383ef84d
SHA256 eb3b040c7700fccdc6a637ff9628c0867b6f48ebac4b09c2b5bb4dd77baf3d38
SHA512 f8ffef274eae3e01003cc8643de1eade69a5747978f3ec60d910a02d18445d776d997024130dc42dd92287900c6ba57463bbddedf045064bc2374669f00a792d

/apex/com.android.art/javalib/core-oj.jar

MD5 f1a98ecb23b9134c358015fcab1f0215
SHA1 e71c1849677f17d5aa83a20853f3483136d449e4
SHA256 d9d541d074d858571d60e2964fd39fb74130217fa7c92d74ed1695b0962837cf
SHA512 8e2a6dd96a89d2195ac770320933a1938977dd55ac98bc822bf33646fec208a2354f1e2dee14463eb776da13b737517affe9bc336093fec1fa9bbc6c7b67f1d2