Overview

overview

7

Static

static

6

yswork.apk

android-9-x86

7

BaiduNaviS..._0.apk

android-9-x86

BaiduNaviS..._0.apk

android-10-x64

BaiduNaviS..._0.apk

android-11-x64

plugin-deploy.apk

android-9-x86

plugin-deploy.apk

android-10-x64

plugin-deploy.apk

android-11-x64

Analysis

  • max time kernel
    176s
  • max time network
    159s
  • platform
    android_x86
  • resource
    android-x86-arm-20240514-en
  • resource tags

    androidarch:armarch:x86image:android-x86-arm-20240514-enlocale:en-usos:android-9-x86system
  • submitted
    23-05-2024 11:47

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    yswork.apk

  • Size

    8.6MB

  • MD5

    2388bc69968ce751416ab508be34d6b3

  • SHA1

    0dd6f470df5f7ed1d405f8f47c8bfa5d60033008

  • SHA256

    83d768c51890e45f0b98f06a23ff6691f3142bbc58d330dcf536e61efd0a3fa5

  • SHA512

    557f17bd800ea7c9cf8f2a5d2b1ecea1ad678856ab0a77fc393373197e3611307d4201c31e7a3861cce549c593e163a256bc456fa54846e299eb55a22000b066

  • SSDEEP

    196608:XWLALb9OLXxU1M4wlEjG8ANjbD4aH6gvkKI+YBhq6xHvdk6BG/54Ze4p/:XW81qNL67KIPTq+HvdcOs4p/

Score
7/10
discoveryevasionimpactpersistence

Malware Config

Signatures

  • Loads dropped Dex/Jar 1 TTPs 29 IoCs

    Runs executable file dropped to the device during analysis.

    evasion
  • Queries information about running processes on the device 1 TTPs 1 IoCs

    Application may abuse the framework's APIs to collect information about running processes on the device.

    discovery
  • Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs

    Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.

    discovery
  • Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 26 IoCs
    persistence
  • Checks if the internet connection is available 1 TTPs 27 IoCs
    discovery
  • Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 28 IoCs
    impact

Processes

  • com.ysdj.worker
    1⤵
    • Loads dropped Dex/Jar
    • Queries information about running processes on the device
    • Queries information about the current Wi-Fi connection
    • Checks if the internet connection is available
    • Uses Crypto APIs (Might try to encrypt user data)
    PID:4301
    • /system/bin/dex2oat --debuggable --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --debuggable --generate-mini-debug-info --dex-file=/data/user/0/com.ysdj.worker/app_push_lib/plugin-deploy.jar --output-vdex-fd=45 --oat-fd=46 --oat-location=/data/user/0/com.ysdj.worker/app_push_lib/oat/x86/plugin-deploy.odex --compiler-filter=quicken --class-loader-context=&
      2⤵
      • Loads dropped Dex/Jar
      PID:4344
  • com.ysdj.worker:bdservice_v1
    1⤵
    • Loads dropped Dex/Jar
    • Registers a broadcast receiver at runtime (usually for listening for system events)
    • Checks if the internet connection is available
    • Uses Crypto APIs (Might try to encrypt user data)
    PID:4441
  • com.ysdj.worker:remote
    1⤵
    • Loads dropped Dex/Jar
    • Uses Crypto APIs (Might try to encrypt user data)
    PID:4477
  • com.ysdj.worker:bdservice_v1
    1⤵
    • Loads dropped Dex/Jar
    • Registers a broadcast receiver at runtime (usually for listening for system events)
    • Checks if the internet connection is available
    • Uses Crypto APIs (Might try to encrypt user data)
    PID:4589
  • com.ysdj.worker:bdservice_v1
    1⤵
    • Loads dropped Dex/Jar
    • Registers a broadcast receiver at runtime (usually for listening for system events)
    • Checks if the internet connection is available
    • Uses Crypto APIs (Might try to encrypt user data)
    PID:4649
  • com.ysdj.worker:bdservice_v1
    1⤵
    • Loads dropped Dex/Jar
    • Registers a broadcast receiver at runtime (usually for listening for system events)
    • Checks if the internet connection is available
    • Uses Crypto APIs (Might try to encrypt user data)
    PID:4696
  • com.ysdj.worker:bdservice_v1
    1⤵
    • Loads dropped Dex/Jar
    • Registers a broadcast receiver at runtime (usually for listening for system events)
    • Checks if the internet connection is available
    • Uses Crypto APIs (Might try to encrypt user data)
    PID:4734
  • com.ysdj.worker:bdservice_v1
    1⤵
    • Loads dropped Dex/Jar
    • Registers a broadcast receiver at runtime (usually for listening for system events)
    • Checks if the internet connection is available
    • Uses Crypto APIs (Might try to encrypt user data)
    PID:4772
  • com.ysdj.worker:bdservice_v1
    1⤵
    • Loads dropped Dex/Jar
    • Registers a broadcast receiver at runtime (usually for listening for system events)
    • Checks if the internet connection is available
    • Uses Crypto APIs (Might try to encrypt user data)
    PID:4836
  • com.ysdj.worker:bdservice_v1
    1⤵
    • Loads dropped Dex/Jar
    • Registers a broadcast receiver at runtime (usually for listening for system events)
    • Checks if the internet connection is available
    • Uses Crypto APIs (Might try to encrypt user data)
    PID:4890
  • com.ysdj.worker:bdservice_v1
    1⤵
    • Loads dropped Dex/Jar
    • Registers a broadcast receiver at runtime (usually for listening for system events)
    • Checks if the internet connection is available
    • Uses Crypto APIs (Might try to encrypt user data)
    PID:4935
  • com.ysdj.worker:bdservice_v1
    1⤵
    • Loads dropped Dex/Jar
    • Registers a broadcast receiver at runtime (usually for listening for system events)
    • Checks if the internet connection is available
    • Uses Crypto APIs (Might try to encrypt user data)
    PID:4974
  • com.ysdj.worker:bdservice_v1
    1⤵
    • Loads dropped Dex/Jar
    • Registers a broadcast receiver at runtime (usually for listening for system events)
    • Checks if the internet connection is available
    • Uses Crypto APIs (Might try to encrypt user data)
    PID:5017
  • com.ysdj.worker:bdservice_v1
    1⤵
    • Loads dropped Dex/Jar
    • Registers a broadcast receiver at runtime (usually for listening for system events)
    • Checks if the internet connection is available
    • Uses Crypto APIs (Might try to encrypt user data)
    PID:5055
  • com.ysdj.worker:bdservice_v1
    1⤵
    • Loads dropped Dex/Jar
    • Registers a broadcast receiver at runtime (usually for listening for system events)
    • Checks if the internet connection is available
    • Uses Crypto APIs (Might try to encrypt user data)
    PID:5091
  • com.ysdj.worker:bdservice_v1
    1⤵
    • Loads dropped Dex/Jar
    • Registers a broadcast receiver at runtime (usually for listening for system events)
    • Checks if the internet connection is available
    • Uses Crypto APIs (Might try to encrypt user data)
    PID:5129
  • com.ysdj.worker:bdservice_v1
    1⤵
    • Loads dropped Dex/Jar
    • Registers a broadcast receiver at runtime (usually for listening for system events)
    • Checks if the internet connection is available
    • Uses Crypto APIs (Might try to encrypt user data)
    PID:5167
  • com.ysdj.worker:bdservice_v1
    1⤵
    • Loads dropped Dex/Jar
    • Registers a broadcast receiver at runtime (usually for listening for system events)
    • Checks if the internet connection is available
    • Uses Crypto APIs (Might try to encrypt user data)
    PID:5210
  • com.ysdj.worker:bdservice_v1
    1⤵
    • Loads dropped Dex/Jar
    • Registers a broadcast receiver at runtime (usually for listening for system events)
    • Checks if the internet connection is available
    • Uses Crypto APIs (Might try to encrypt user data)
    PID:5248
  • com.ysdj.worker:bdservice_v1
    1⤵
    • Loads dropped Dex/Jar
    • Registers a broadcast receiver at runtime (usually for listening for system events)
    • Checks if the internet connection is available
    • Uses Crypto APIs (Might try to encrypt user data)
    PID:5287
  • com.ysdj.worker:bdservice_v1
    1⤵
    • Loads dropped Dex/Jar
    • Registers a broadcast receiver at runtime (usually for listening for system events)
    • Checks if the internet connection is available
    • Uses Crypto APIs (Might try to encrypt user data)
    PID:5325
  • com.ysdj.worker:bdservice_v1
    1⤵
    • Loads dropped Dex/Jar
    • Registers a broadcast receiver at runtime (usually for listening for system events)
    • Checks if the internet connection is available
    • Uses Crypto APIs (Might try to encrypt user data)
    PID:5366
  • com.ysdj.worker:bdservice_v1
    1⤵
    • Loads dropped Dex/Jar
    • Registers a broadcast receiver at runtime (usually for listening for system events)
    • Checks if the internet connection is available
    • Uses Crypto APIs (Might try to encrypt user data)
    PID:5404
  • com.ysdj.worker:bdservice_v1
    1⤵
    • Loads dropped Dex/Jar
    • Registers a broadcast receiver at runtime (usually for listening for system events)
    • Checks if the internet connection is available
    • Uses Crypto APIs (Might try to encrypt user data)
    PID:5443
  • com.ysdj.worker:bdservice_v1
    1⤵
    • Loads dropped Dex/Jar
    • Registers a broadcast receiver at runtime (usually for listening for system events)
    • Checks if the internet connection is available
    • Uses Crypto APIs (Might try to encrypt user data)
    PID:5485
  • com.ysdj.worker:bdservice_v1
    1⤵
    • Loads dropped Dex/Jar
    • Registers a broadcast receiver at runtime (usually for listening for system events)
    • Checks if the internet connection is available
    • Uses Crypto APIs (Might try to encrypt user data)
    PID:5530
  • com.ysdj.worker:bdservice_v1
    1⤵
    • Loads dropped Dex/Jar
    • Registers a broadcast receiver at runtime (usually for listening for system events)
    • Checks if the internet connection is available
    • Uses Crypto APIs (Might try to encrypt user data)
    PID:5570
  • com.ysdj.worker:bdservice_v1
    1⤵
    • Loads dropped Dex/Jar
    • Registers a broadcast receiver at runtime (usually for listening for system events)
    • Checks if the internet connection is available
    • Uses Crypto APIs (Might try to encrypt user data)
    PID:5608

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/data/com.ysdj.worker/app_push_lib/plugin-deploy.jar
    Filesize

    206KB

    MD5

    02fe22caeb17a9d7c7f5c3914e3cda29

    SHA1

    7e3293216263ab967ca6e9a3c55ba589444e3de7

    SHA256

    0fba8eedb44faf95448ed7e25bcba48b49aa981e1e1e154fcbd90e48447813a4

    SHA512

    020324dd3b38d6d75fbb54f18caf0bfdff38e27b0c18aa83989b53e9da96a6d6c780f281b21da8f1b41e3de1206306954dc9d1e42aa2dd12f500b66e04f4c647

    Download Submit
  • /data/data/com.ysdj.worker/app_push_lib/plugin-deploy.key
    Filesize

    76KB

    MD5

    eafa21ae6305aeed6a838f3180d61068

    SHA1

    10aa4474b298f8e6ef13f01114d95c65839b9f37

    SHA256

    b940841fdacd80a10cc7ce59813f2ced62e1523004cbb80b26ab06497da5db7e

    SHA512

    6b5f7d5c97c35f4cced3536f8509963235e6728d059593734e8e2c1e70cedeec7a0d15cdcc4b9e47ea496b0be551d1d716d663081f53e032a5d7695ed8b9d284

    Download Submit
  • /data/data/com.ysdj.worker/files/CMRequire.dat
    Filesize

    1KB

    MD5

    25e57636aee83606d202f04f26c2913b

    SHA1

    1ef0ade456ba38aa31584d0fbce647d0ba74b399

    SHA256

    89c56da41f0046c9e733fed330d2636d623510c217f72c2d025df3343dc66783

    SHA512

    3a8d294b8be98abe4d18116cbf7c16d44a541d1d20dd4dfbbbf3bbd8cb7997abcbaf51790bbc1978135d888c4e89868a9a2575d9cfed65a331969de77ba07326

    Download Submit
  • /data/data/com.ysdj.worker/files/VerDatset.dat
    Filesize

    172B

    MD5

    caaa975d7bf4952bd5dd695ade33f1da

    SHA1

    119373fbb2db036712df72ec9b26c0c2840dfbb1

    SHA256

    d0f94264a6b5c355dbf5c0516202c732bcae471a2401542b2ca43307727a0d02

    SHA512

    db2acdecd236eab67cb67151032f53e51c9c04e754f3c21d74e05cacb1ea5edecbbccbd66ee760624b9cac97b8dd77f568324e8abc2b9c16aa73131db81c8b06

    Download Submit
  • /data/data/com.ysdj.worker/files/cfg/a/ResPack.rs
    Filesize

    684KB

    MD5

    37c7d7a469620c696b8812831a527d62

    SHA1

    2e54375cde7ad35666184f5c7aeb65d5887f746c

    SHA256

    f3f542caf19e546f5cc1d265d5e6e35fa5ff32bb24e9282a60ef21d4c8588d9e

    SHA512

    8726878886379a8174b1ea11bb0c21dc6ef9bfe0ff2eafdfc4260a8c8666be82e3fd95309915aa0b40ad1a34b2f8f62f7c33860247562e84cac7e156dbf995bb

    Download Submit
  • /data/data/com.ysdj.worker/files/cfg/a/mapstyle.sty
    Filesize

    131KB

    MD5

    db362e36518c847ae80caca571e3c8c8

    SHA1

    610911bf7869016fb7c9a2026b3024eacf0b4593

    SHA256

    95549560fbb3d96dc791c2d16fdd5f098784eee75ac293556fe9688fb2f0ec9d

    SHA512

    41fa2b9b61c131b0926d0f47f86eea56859ca0d4e44ac23647a73ff4b98214183cb0a523336dcae4e2ddb4be932e994e1950365fd3590eb2f7c3b96bd4bb8a41

    Download Submit
  • /data/data/com.ysdj.worker/files/cfg/a/satellitestyle.sty
    Filesize

    119KB

    MD5

    6034f2a3f8bc9639ae820bd977bde4a0

    SHA1

    599f7994853b61bc5ee09a75b6383a13a5a685f7

    SHA256

    753705cb1ab2a676a9ef48881cfb036f212c4a7e7a5d34d9f8708075078e5818

    SHA512

    acaf0d146e4e3739eeaa40d46f7002776ebc4074bb89d12a5c25b12f53190a0e367ef0bd3225835e7e4b39a70b06e9f7328b1e342a9c5829af7610c14d41898f

    Download Submit
  • /data/data/com.ysdj.worker/files/cfg/a/trafficstyle.sty
    Filesize

    3KB

    MD5

    1e4b535871c4feb2010b614713def5c7

    SHA1

    4c5dc67838d12b795b6882c6dbbcc6767e42184f

    SHA256

    efa3ec85127a21a8c8a74640acc5fe1d992952964d4f257682f832f63c2ad3fc

    SHA512

    0c5443dbfdafab2e6cb7740587f48ca9a2c971b93afafcebccd17691edaa7c7fb75dfd1b6c939dd591a5aa65977f55e64b6c3690ab0a660432269fc43bf3133c

    Download Submit
  • /data/data/com.ysdj.worker/files/cfg/h/DVDirectory.cfg
    Filesize

    69KB

    MD5

    4baa4ede52eacda76bd26d5838cc2de3

    SHA1

    38b65c75440581f43ddb32ef17480e5c87f0153f

    SHA256

    c0f2b002adafe50265789ca04bc8dab8c176e6a7eaae164fdb98ebcb9ff98eb2

    SHA512

    58fef595b1db5f8fa7dbfcaa3b6b676bdbec8931ffa833858e2452c2f35a1b192746d2315acd27551594377ac121ec80574deee632d4bfa94b6315b8a0d33feb

    Download Submit
  • /data/data/com.ysdj.worker/files/cfg/h/DVHotMap.cfg
    Filesize

    10KB

    MD5

    c16f5ca1517683c46e02a6b71aab3c00

    SHA1

    2d09a048d1b8d556d89d4d723947e9e234b5e59b

    SHA256

    13d4fbc0d1cb7c2761641a3632c440f6f1d919dce731b8c32cb35e652b0b39f9

    SHA512

    a692b79382747548fd8be8ed94c06198b143c167be1e96f60d8ea7ee9432a0eb1a0cd73d0704523e487d59443bf7ad13eb36e47b67864e227917d33225e3e62b

    Download Submit
  • /data/data/com.ysdj.worker/files/cfg/h/DVHotcity.cfg
    Filesize

    1KB

    MD5

    6c495e47c754a9b25437ff9a88c7a51e

    SHA1

    8c4e36fda1e1f80918a3a8f1812c4e68b2326a4f

    SHA256

    e68e66e643d690d203a5153156e9cd6383ae1b3c481afa4b19e903d4a82289a3

    SHA512

    f3c030504cf50fdbd284acbdd893c948fb7ddb7544ce01d11c94fb00fb554f878949b1867fd5ab6c25e76c4be717aa819a917d4f25c8eba904df1a2819becf1c

    Download Submit
  • /data/data/com.ysdj.worker/files/cfg/l/DVDirectory.cfg
    Filesize

    69KB

    MD5

    65685a117c72fe8fbf5a92b07073c99e

    SHA1

    b115b527f74e4c291edcaab19b316a446aca8f5b

    SHA256

    19bcea79613a5c3bb71dfe6b311241fcbf3534b538f0b147c7e849b58b24b2b8

    SHA512

    e5821a5212f0790db33ec7274f018b08f499557ff7f2f118021a7905573e8dd66e716fb02144919d96eeec7da9db921c756a88cf0a050f65a9f8de3894dcc253

    Download Submit
  • /data/data/com.ysdj.worker/files/cfg/l/DVHotMap.cfg
    Filesize

    10KB

    MD5

    cc3fad9057e0940ad4d4c7ad27922023

    SHA1

    403cbbcd7b819733b5caf49ed2a58d654441e99d

    SHA256

    f6d90bd8621889ab994374b4f51a1c3f9b028aab1a2129b8b3b0e1d7c5c37864

    SHA512

    ebaf2b8c56bc15826ef38b36e72ae41765fc723470c6dcc40bf9f31118f252777072ad39a535a79f53b6aa29811b4b21cebbc9810c47e34ef9400246d789ab21

    Download Submit
  • /data/data/com.ysdj.worker/files/cfg/l/DVHotcity.cfg
    Filesize

    1KB

    MD5

    1c6abcbbd253448057930ad1cc59ac75

    SHA1

    a5845d1c4bc87b8b4785b456d76edcb8309eda4e

    SHA256

    a46b498ba6586aaa2f246bb34e47f4290ac60273cb86ff662475b0def7172136

    SHA512

    71aba5b2a1020d1925b3844c861cbe595de3b21d665eedb13f1ef0d80477fc091663e0625b09c5f49d4f9d0770970dd0d188b84635e9c75c1bdba9f2a7171631

    Download Submit
  • /data/data/com.ysdj.worker/files/cfg/l/DVVersion.cfg
    Filesize

    127B

    MD5

    e962c995c0664b5cd8d067db1561cad7

    SHA1

    263524863998525598f663ba7134ecec2ab592b2

    SHA256

    b83792f572112503fa2c542595047271d632318a775061ae3a964948738639f8

    SHA512

    7337967c5759f8a078eed90adc45054e5642b1e319800549c80395dcdc1956baa8d9741348e1dc0be931f24cdb899b95d4beec35e52995703dad8d0feb04ab26

    Download Submit
  • /data/data/com.ysdj.worker/files/ver.dat
    Filesize

    6B

    MD5

    5f7335045aed321b93c6ebb7a4d7417a

    SHA1

    35fbd4bee538b385d7abfc56df4e701615f73784

    SHA256

    f9d1a10b6885f6c28d841e07df992a2f620dd69e65d0a318523c232982158ed9

    SHA512

    ae94d011816076c988605e82e75c18ca6cb1708a20f079ac6dadc4c874c16b653a9ade7ec1015deec39bf98b840be69eb6e0d3705321e0bc59c8460c4de6ec4f

    Download Submit
  • /data/user/0/com.ysdj.worker/app_push_lib/plugin-deploy.jar
    Filesize

    516KB

    MD5

    6eece12bef4636ee00537a00972783d6

    SHA1

    70cdeff33805ef11d6ca6b6f11a0218d01a4612f

    SHA256

    de6be84627740fa2bcb1932a928a147270f525ba4e565ad7a8d49dac8100fe55

    SHA512

    c1d4d9e29506c4916b498afdc86536578ac4ee55bc31678fe2377bc3491ec9b1040b030a8edaf76194b378e2e8134d665b1246cc153ccec593bdd382d87ac726

    Download Submit
  • /storage/emulated/0/baidu/.cuid
    Filesize

    89B

    MD5

    c707a8015bfa1efc640b14d2c5ab1450

    SHA1

    fda361936b147d593dfa64c892df5309159e6854

    SHA256

    541dcad1683eb08d4f574be4945c262388a37228aacb3e1d04a5a53c374c6fab

    SHA512

    965f0b38fd4f70c34139e59ec48a2d48ffa92f807c9325afb5ac12b8e92f11b58b740f97e18323a721e4a4f5f355bcccfb929b769ea3376c25892c25e702a55f

    Download Submit
  • /storage/emulated/0/baidu/pushservice/database/storage/emulated/0/baidu/pushservice/database/pushstat_4.3.db-journal
    Filesize

    24KB

    MD5

    f37b27a3938e8b2b5c3575fd2e3b5512

    SHA1

    7ee8dc3f16d83159b2b10f5eceb5f8c4c4214d9f

    SHA256

    065822d4e8d1af85f1a22228ebc16742f0f26bf400df6f51162607d647026202

    SHA512

    5ba782f04f681492ee919b63023b76927ddb67369ade3bea85fcfefdd883fc24848cf18840c0e631149036cf5ce57e368f31e42e1f911c60a5868d93400ad4cd

    Download Submit
  • /storage/emulated/0/baidu/pushservice/database/storage/emulated/0/baidu/pushservice/database/pushstat_4.3.db-shm
    Filesize

    28KB

    MD5

    cf845a781c107ec1346e849c9dd1b7e8

    SHA1

    b44ccc7f7d519352422e59ee8b0bdbac881768a7

    SHA256

    18619b678a5c207a971a0aa931604f48162e307c57ecdec450d5f095fe9f32c7

    SHA512

    4802861ea06dc7fb85229a3c8f04e707a084f1ba516510c6f269821b33c8ee4ebf495258fe5bee4850668a5aac1a45f0edf51580da13b7ee160a29d067c67612

    Download Submit
  • /storage/emulated/0/baidu/pushservice/database/storage/emulated/0/baidu/pushservice/database/pushstat_4.3.db-wal
    Filesize

    68KB

    MD5

    fb907e49910b0a1086fc4d65021b17bf

    SHA1

    27c7ad609e44a23bed0eea43ac8ff606c2ae89d1

    SHA256

    7b53dc7ac02777f9be43f97e8e867971920df90544d4cc735eaf0f0aa44170e5

    SHA512

    d1b2e5b5cc44e8215495324302b6b287c528a5d75bbed14bafcb3cbb234091d94b6f60d151ecd61c1b42592f93e64aaa69ccfb0ec7e51c631cebd60b7ca98b3d

    Download Submit