Analysis
-
max time kernel
178s -
max time network
146s -
platform
android_x86 -
resource
android-x86-arm-20240514-en -
resource tags
-
submitted
23-05-2024 12:21
General
-
Target
YS_Worker_0318_03.apk
-
Size
8.6MB
-
MD5
2312d606b646a42d8676797a1fe89206
-
SHA1
c7e1a36c0f5bb7887be8e1ffcabdc3acf9445296
-
SHA256
be16fafbed3b28c54f4a80c5f20342c14ce7cb16d362b899deeffd963e685158
-
SHA512
d72da83bce1ad4b86a27dda124f8c2350c664a0f8ac651931e10cba603a93865530961db11c7ff82074edfeb181bd8177149531c343452d53174d2130b4178f2
-
SSDEEP
196608:IILALb9OLXxU1MThVkH9TnJNjbD4aH66vkKIZISeDVL4PUt0Dg+fi:II81shVMNL6RKIZSDVkPI0Dgf
Malware Config
Signatures
-
Loads dropped Dex/Jar 1 TTPs 30 IoCs
Runs executable file dropped to the device during analysis.
-
Queries information about running processes on the device 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about running processes on the device.
-
Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.
-
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 27 IoCs
-
Checks if the internet connection is available 1 TTPs 28 IoCs
-
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 29 IoCs
Processes
-
com.ysdj.worker1⤵
- Loads dropped Dex/Jar
- Queries information about running processes on the device
- Queries information about the current Wi-Fi connection
- Checks if the internet connection is available
- Uses Crypto APIs (Might try to encrypt user data)
-
/system/bin/dex2oat --debuggable --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --debuggable --generate-mini-debug-info --dex-file=/data/user/0/com.ysdj.worker/app_push_lib/plugin-deploy.jar --output-vdex-fd=45 --oat-fd=46 --oat-location=/data/user/0/com.ysdj.worker/app_push_lib/oat/x86/plugin-deploy.odex --compiler-filter=quicken --class-loader-context=&2⤵
- Loads dropped Dex/Jar
-
-
com.ysdj.worker:bdservice_v11⤵
- Loads dropped Dex/Jar
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Checks if the internet connection is available
- Uses Crypto APIs (Might try to encrypt user data)
-
com.ysdj.worker:remote1⤵
- Loads dropped Dex/Jar
- Uses Crypto APIs (Might try to encrypt user data)
-
com.ysdj.worker:bdservice_v11⤵
- Loads dropped Dex/Jar
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Checks if the internet connection is available
- Uses Crypto APIs (Might try to encrypt user data)
-
com.ysdj.worker:bdservice_v11⤵
- Loads dropped Dex/Jar
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Checks if the internet connection is available
- Uses Crypto APIs (Might try to encrypt user data)
-
com.ysdj.worker:bdservice_v11⤵
- Loads dropped Dex/Jar
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Checks if the internet connection is available
- Uses Crypto APIs (Might try to encrypt user data)
-
com.ysdj.worker:bdservice_v11⤵
- Loads dropped Dex/Jar
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Checks if the internet connection is available
- Uses Crypto APIs (Might try to encrypt user data)
-
com.ysdj.worker:bdservice_v11⤵
- Loads dropped Dex/Jar
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Checks if the internet connection is available
- Uses Crypto APIs (Might try to encrypt user data)
-
com.ysdj.worker:bdservice_v11⤵
- Loads dropped Dex/Jar
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Checks if the internet connection is available
- Uses Crypto APIs (Might try to encrypt user data)
-
com.ysdj.worker:bdservice_v11⤵
- Loads dropped Dex/Jar
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Checks if the internet connection is available
- Uses Crypto APIs (Might try to encrypt user data)
-
com.ysdj.worker:bdservice_v11⤵
- Loads dropped Dex/Jar
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Checks if the internet connection is available
- Uses Crypto APIs (Might try to encrypt user data)
-
com.ysdj.worker:bdservice_v11⤵
- Loads dropped Dex/Jar
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Checks if the internet connection is available
- Uses Crypto APIs (Might try to encrypt user data)
-
com.ysdj.worker:bdservice_v11⤵
- Loads dropped Dex/Jar
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Checks if the internet connection is available
- Uses Crypto APIs (Might try to encrypt user data)
-
com.ysdj.worker:bdservice_v11⤵
- Loads dropped Dex/Jar
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Checks if the internet connection is available
- Uses Crypto APIs (Might try to encrypt user data)
-
com.ysdj.worker:bdservice_v11⤵
- Loads dropped Dex/Jar
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Checks if the internet connection is available
- Uses Crypto APIs (Might try to encrypt user data)
-
com.ysdj.worker:bdservice_v11⤵
- Loads dropped Dex/Jar
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Checks if the internet connection is available
- Uses Crypto APIs (Might try to encrypt user data)
-
com.ysdj.worker:bdservice_v11⤵
- Loads dropped Dex/Jar
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Checks if the internet connection is available
- Uses Crypto APIs (Might try to encrypt user data)
-
com.ysdj.worker:bdservice_v11⤵
- Loads dropped Dex/Jar
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Checks if the internet connection is available
- Uses Crypto APIs (Might try to encrypt user data)
-
com.ysdj.worker:bdservice_v11⤵
- Loads dropped Dex/Jar
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Checks if the internet connection is available
- Uses Crypto APIs (Might try to encrypt user data)
-
com.ysdj.worker:bdservice_v11⤵
- Loads dropped Dex/Jar
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Checks if the internet connection is available
- Uses Crypto APIs (Might try to encrypt user data)
-
com.ysdj.worker:bdservice_v11⤵
- Loads dropped Dex/Jar
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Checks if the internet connection is available
- Uses Crypto APIs (Might try to encrypt user data)
-
com.ysdj.worker:bdservice_v11⤵
- Loads dropped Dex/Jar
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Checks if the internet connection is available
- Uses Crypto APIs (Might try to encrypt user data)
-
com.ysdj.worker:bdservice_v11⤵
- Loads dropped Dex/Jar
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Checks if the internet connection is available
- Uses Crypto APIs (Might try to encrypt user data)
-
com.ysdj.worker:bdservice_v11⤵
- Loads dropped Dex/Jar
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Checks if the internet connection is available
- Uses Crypto APIs (Might try to encrypt user data)
-
com.ysdj.worker:bdservice_v11⤵
- Loads dropped Dex/Jar
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Checks if the internet connection is available
- Uses Crypto APIs (Might try to encrypt user data)
-
com.ysdj.worker:bdservice_v11⤵
- Loads dropped Dex/Jar
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Checks if the internet connection is available
- Uses Crypto APIs (Might try to encrypt user data)
-
com.ysdj.worker:bdservice_v11⤵
- Loads dropped Dex/Jar
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Checks if the internet connection is available
- Uses Crypto APIs (Might try to encrypt user data)
-
com.ysdj.worker:bdservice_v11⤵
- Loads dropped Dex/Jar
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Checks if the internet connection is available
- Uses Crypto APIs (Might try to encrypt user data)
-
com.ysdj.worker:bdservice_v11⤵
- Loads dropped Dex/Jar
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Checks if the internet connection is available
- Uses Crypto APIs (Might try to encrypt user data)
Network
MITRE ATT&CK Mobile v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
206KB
MD502fe22caeb17a9d7c7f5c3914e3cda29
SHA17e3293216263ab967ca6e9a3c55ba589444e3de7
SHA2560fba8eedb44faf95448ed7e25bcba48b49aa981e1e1e154fcbd90e48447813a4
SHA512020324dd3b38d6d75fbb54f18caf0bfdff38e27b0c18aa83989b53e9da96a6d6c780f281b21da8f1b41e3de1206306954dc9d1e42aa2dd12f500b66e04f4c647
-
Filesize
76KB
MD53bbf69b4827d8ffc7e2806b1c429b450
SHA1463291794978fe53a8a7c7b5c0b7141a83fa5bf5
SHA256ece5e3630cf30373bb592b6ca6b151620efa6591d3b01940c8065907f612aca7
SHA5123bf0811a94e5dad686c9feeaa7ce000c71563ff3bf350f5e7ba63cd3fa1236110ab1bda9f75de20aced24b90df4c64a8afb97e293484e5ea24280838ca83f681
-
Filesize
1KB
MD525e57636aee83606d202f04f26c2913b
SHA11ef0ade456ba38aa31584d0fbce647d0ba74b399
SHA25689c56da41f0046c9e733fed330d2636d623510c217f72c2d025df3343dc66783
SHA5123a8d294b8be98abe4d18116cbf7c16d44a541d1d20dd4dfbbbf3bbd8cb7997abcbaf51790bbc1978135d888c4e89868a9a2575d9cfed65a331969de77ba07326
-
Filesize
172B
MD5caaa975d7bf4952bd5dd695ade33f1da
SHA1119373fbb2db036712df72ec9b26c0c2840dfbb1
SHA256d0f94264a6b5c355dbf5c0516202c732bcae471a2401542b2ca43307727a0d02
SHA512db2acdecd236eab67cb67151032f53e51c9c04e754f3c21d74e05cacb1ea5edecbbccbd66ee760624b9cac97b8dd77f568324e8abc2b9c16aa73131db81c8b06
-
Filesize
684KB
MD537c7d7a469620c696b8812831a527d62
SHA12e54375cde7ad35666184f5c7aeb65d5887f746c
SHA256f3f542caf19e546f5cc1d265d5e6e35fa5ff32bb24e9282a60ef21d4c8588d9e
SHA5128726878886379a8174b1ea11bb0c21dc6ef9bfe0ff2eafdfc4260a8c8666be82e3fd95309915aa0b40ad1a34b2f8f62f7c33860247562e84cac7e156dbf995bb
-
Filesize
131KB
MD5db362e36518c847ae80caca571e3c8c8
SHA1610911bf7869016fb7c9a2026b3024eacf0b4593
SHA25695549560fbb3d96dc791c2d16fdd5f098784eee75ac293556fe9688fb2f0ec9d
SHA51241fa2b9b61c131b0926d0f47f86eea56859ca0d4e44ac23647a73ff4b98214183cb0a523336dcae4e2ddb4be932e994e1950365fd3590eb2f7c3b96bd4bb8a41
-
Filesize
119KB
MD56034f2a3f8bc9639ae820bd977bde4a0
SHA1599f7994853b61bc5ee09a75b6383a13a5a685f7
SHA256753705cb1ab2a676a9ef48881cfb036f212c4a7e7a5d34d9f8708075078e5818
SHA512acaf0d146e4e3739eeaa40d46f7002776ebc4074bb89d12a5c25b12f53190a0e367ef0bd3225835e7e4b39a70b06e9f7328b1e342a9c5829af7610c14d41898f
-
Filesize
3KB
MD51e4b535871c4feb2010b614713def5c7
SHA14c5dc67838d12b795b6882c6dbbcc6767e42184f
SHA256efa3ec85127a21a8c8a74640acc5fe1d992952964d4f257682f832f63c2ad3fc
SHA5120c5443dbfdafab2e6cb7740587f48ca9a2c971b93afafcebccd17691edaa7c7fb75dfd1b6c939dd591a5aa65977f55e64b6c3690ab0a660432269fc43bf3133c
-
Filesize
69KB
MD54baa4ede52eacda76bd26d5838cc2de3
SHA138b65c75440581f43ddb32ef17480e5c87f0153f
SHA256c0f2b002adafe50265789ca04bc8dab8c176e6a7eaae164fdb98ebcb9ff98eb2
SHA51258fef595b1db5f8fa7dbfcaa3b6b676bdbec8931ffa833858e2452c2f35a1b192746d2315acd27551594377ac121ec80574deee632d4bfa94b6315b8a0d33feb
-
Filesize
10KB
MD5c16f5ca1517683c46e02a6b71aab3c00
SHA12d09a048d1b8d556d89d4d723947e9e234b5e59b
SHA25613d4fbc0d1cb7c2761641a3632c440f6f1d919dce731b8c32cb35e652b0b39f9
SHA512a692b79382747548fd8be8ed94c06198b143c167be1e96f60d8ea7ee9432a0eb1a0cd73d0704523e487d59443bf7ad13eb36e47b67864e227917d33225e3e62b
-
Filesize
1KB
MD56c495e47c754a9b25437ff9a88c7a51e
SHA18c4e36fda1e1f80918a3a8f1812c4e68b2326a4f
SHA256e68e66e643d690d203a5153156e9cd6383ae1b3c481afa4b19e903d4a82289a3
SHA512f3c030504cf50fdbd284acbdd893c948fb7ddb7544ce01d11c94fb00fb554f878949b1867fd5ab6c25e76c4be717aa819a917d4f25c8eba904df1a2819becf1c
-
Filesize
69KB
MD565685a117c72fe8fbf5a92b07073c99e
SHA1b115b527f74e4c291edcaab19b316a446aca8f5b
SHA25619bcea79613a5c3bb71dfe6b311241fcbf3534b538f0b147c7e849b58b24b2b8
SHA512e5821a5212f0790db33ec7274f018b08f499557ff7f2f118021a7905573e8dd66e716fb02144919d96eeec7da9db921c756a88cf0a050f65a9f8de3894dcc253
-
Filesize
10KB
MD5cc3fad9057e0940ad4d4c7ad27922023
SHA1403cbbcd7b819733b5caf49ed2a58d654441e99d
SHA256f6d90bd8621889ab994374b4f51a1c3f9b028aab1a2129b8b3b0e1d7c5c37864
SHA512ebaf2b8c56bc15826ef38b36e72ae41765fc723470c6dcc40bf9f31118f252777072ad39a535a79f53b6aa29811b4b21cebbc9810c47e34ef9400246d789ab21
-
Filesize
1KB
MD51c6abcbbd253448057930ad1cc59ac75
SHA1a5845d1c4bc87b8b4785b456d76edcb8309eda4e
SHA256a46b498ba6586aaa2f246bb34e47f4290ac60273cb86ff662475b0def7172136
SHA51271aba5b2a1020d1925b3844c861cbe595de3b21d665eedb13f1ef0d80477fc091663e0625b09c5f49d4f9d0770970dd0d188b84635e9c75c1bdba9f2a7171631
-
Filesize
127B
MD5e962c995c0664b5cd8d067db1561cad7
SHA1263524863998525598f663ba7134ecec2ab592b2
SHA256b83792f572112503fa2c542595047271d632318a775061ae3a964948738639f8
SHA5127337967c5759f8a078eed90adc45054e5642b1e319800549c80395dcdc1956baa8d9741348e1dc0be931f24cdb899b95d4beec35e52995703dad8d0feb04ab26
-
Filesize
6B
MD55f7335045aed321b93c6ebb7a4d7417a
SHA135fbd4bee538b385d7abfc56df4e701615f73784
SHA256f9d1a10b6885f6c28d841e07df992a2f620dd69e65d0a318523c232982158ed9
SHA512ae94d011816076c988605e82e75c18ca6cb1708a20f079ac6dadc4c874c16b653a9ade7ec1015deec39bf98b840be69eb6e0d3705321e0bc59c8460c4de6ec4f
-
Filesize
516KB
MD56eece12bef4636ee00537a00972783d6
SHA170cdeff33805ef11d6ca6b6f11a0218d01a4612f
SHA256de6be84627740fa2bcb1932a928a147270f525ba4e565ad7a8d49dac8100fe55
SHA512c1d4d9e29506c4916b498afdc86536578ac4ee55bc31678fe2377bc3491ec9b1040b030a8edaf76194b378e2e8134d665b1246cc153ccec593bdd382d87ac726
-
Filesize
89B
MD5e0e7579a3ec068b5191902707a857e54
SHA172f30cb32f6e9186a7eca9e54612db055a3fb093
SHA256fe9c76ee6dba8bb8a421ddafa4acd8b08145c98e92670335988189ecb97cadfc
SHA5121de03044023199e1c880cbafa808283727091b1c8a5978434cbcbad593f84dee1918bc7a42a9320b141574ed97a21d801473d6f3de2fe016890ae318eb352164
-
Filesize
24KB
MD5bd487e0d3bfe6277c484855c1516cfc7
SHA16d270e31f04ea1de11e7623e9bc203420021c70e
SHA25664d103744c87416ca42b856314a4771faf1b22fa95aed67101854adbd62b750d
SHA5125eac1381cb1b8c3c7606cda475dbf342f91357bc40f47ab011a8faebafcd223f88ca4570c42466cddac397ad4017a67a4fd73b7fe8be52518f22231a4b75609a
-
Filesize
28KB
MD5cf845a781c107ec1346e849c9dd1b7e8
SHA1b44ccc7f7d519352422e59ee8b0bdbac881768a7
SHA25618619b678a5c207a971a0aa931604f48162e307c57ecdec450d5f095fe9f32c7
SHA5124802861ea06dc7fb85229a3c8f04e707a084f1ba516510c6f269821b33c8ee4ebf495258fe5bee4850668a5aac1a45f0edf51580da13b7ee160a29d067c67612
-
Filesize
68KB
MD579b41f3507763f2289289a835707ab4c
SHA19ce300c4dd13bf73faaaa255e557a4c6d0889a3d
SHA256f970e20a511d6a14bde5d50993848d3bb6af9a2ee5008c26909f6128ea21a666
SHA5120ccd06ccb858c673cbdc176956b4568c9431211366f78c75081ee361b65909e58d5aa60daa238fd331b8ece52dbbd3fdd6ff639e38beb60d5249b2c22dbd6fae