Play interactive tour

Edit tour

Analysis Report covidMappia_v1.0.3.apk

Overview

General Information

Joe Sandbox Version:	28.0.0 Lapis Lazuli
Analysis ID:	1097638
Start date:	26.03.2020
Start time:	13:13:55
Joe Sandbox Product:	Cloud
Overall analysis duration:	0h 6m 56s
Hypervisor based Inspection enabled:	false
Report type:	full
Sample file name:	covidMappia_v1.0.3.apk
Cookbook file name:	defaultandroidfilecookbook.jbs
Analysis system description:	Android 7.1 Nougat
APK Instrumentation enabled:	true
Detection:	MAL
Classification:	mal92.rans.troj.spyw.expl.evad.andAPK@0/252@3/0
Warnings:	Show All Excluded IPs from analysis (whitelisted): 216.58.205.227, 172.217.18.106, 172.217.23.170, 216.58.206.14, 172.217.18.110, 172.217.18.174, 216.58.207.46, 216.58.207.78, 172.217.16.174, 216.58.208.46, 172.217.16.206, 172.217.23.110, 216.58.210.14, 172.217.22.110, 172.217.21.206, 172.217.16.142, 172.217.23.142, 172.217.22.14, 172.217.21.202, 172.217.21.234, 172.217.21.238, 216.58.205.238, 172.217.18.14, 172.217.22.46, 172.217.16.138, 172.217.23.106 Excluded domains from analysis (whitelisted): youtubei.googleapis.com, android.clients.google.com, android.l.google.com, youtube-ui.l.google.com, www.googleadservices.com, android.googleapis.com, cloudconfig.googleapis.com, play.googleapis.com, www.gstatic.com, www.googleapis.com, mdh-pa.googleapis.com No interacted views Not all executed log events are in report (maximum 10 identical API calls) Not all non-executed APIs are in report Report size exceeded maximum capacity and may have missing disassembly code. Report size exceeded maximum capacity and may have missing dynamic data code.

Detection

Strategy	Score	Range	Reporting	Whitelisted	Threat	Detection
Threshold	92	0 - 100	Report FP / FN	false	Cerberus

Confidence

Strategy	Score	Range	Further Analysis Required?	Confidence
Threshold	5	0 - 5	false

Classification Spiderchart

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	Windows Remote Management	Winlogon Helper DLL	Port Monitors	Application Discovery1	Capture SMS Messages1	System Network Connections Discovery1	Application Deployment Software	Access Contact List1	Data Compressed	Standard Cryptographic Protocol1	Exploit SS7 to Redirect Phone Calls/SMS2	Remotely Track Device Without Authorization	Generate Fraudulent Advertising Revenue1
Replication Through Removable Media	Service Execution	Port Monitors	Accessibility Features	Evade Analysis Environment1	Access Stored Application Data1	Application Discovery1	Remote Services	Capture Audio21	Exfiltration Over Other Network Medium	Standard Non-Application Layer Protocol1	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Premium SMS Toll Fraud1
External Remote Services	Windows Management Instrumentation	Accessibility Features	Path Interception	Rootkit	Input Capture	System Information Discovery12	Windows Remote Management	Network Information Discovery1	Automated Exfiltration	Standard Application Layer Protocol2	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Drive-by Compromise	Scheduled Task	System Firmware	DLL Search Order Hijacking	Obfuscated Files or Information	Credentials in Files	Evade Analysis Environment1	Logon Scripts	Capture SMS Messages1	Data Encrypted	Multiband Communication	SIM Card Swap		Premium SMS Toll Fraud
Exploit Public-Facing Application	Command-Line Interface	Shortcut Modification	File System Permissions Weakness	Masquerading	Account Manipulation	Remote System Discovery	Shared Webroot	Access Stored Application Data1	Scheduled Transfer	Standard Cryptographic Protocol	Manipulate Device Communication		Manipulate App Store Rankings or Ratings

Signature Overview

Click to jump to signature section

AV Detection:

Antivirus detection for sample

Show sources

Source: covidMappia_v1.0.3.apk

Avira: detection malicious, Label: ANDROID/Dropper.FOIX.Gen

Multi AV Scanner detection for submitted file

Show sources

Source: covidMappia_v1.0.3.apk

Virustotal: Detection: 12%

Perma Link

Privilege Escalation:

Checks if the device administrator is active

Show sources

Source: hime.cmturbahhlijuoscilwplr.qeyh.b;->t:332

API Call: android.app.admin.DevicePolicyManager.isAdminActive

Tries to add a new device administrator

Show sources

Source: hime.cmturbahhlijuoscilwplr.qeyh.uvgpknoqhdzrlm;->onCreate:25	API Call: android.content.Intent.<init> android.app.action.ADD_DEVICE_ADMIN
Source: Lhime/cmturbahhlijuoscilwplr/qeyh/uvgpknoqhdzrlm;->onCreate(Landroid/os/Bundle;)V	Method string: "android.app.action.ADD_DEVICE_ADMIN"

Spreading:

Has permission to use the IR transmitter

Show sources

Source: submitted apk

Request permission: android.permission.TRANSMIT_IR

Accesses external storage location

Show sources

Source: hime.cmturbahhlijuoscilwplr.qeyh.jigftrlnvyirm;->onHandleIntent:103

API Call: android.os.Environment.getExternalStorageDirectory

Networking:

Checks an internet connection is available

Show sources

Source: hime.cmturbahhlijuoscilwplr.qeyh.b;->C:25	API Call: android.net.ConnectivityManager.getNetworkInfo
Source: hime.cmturbahhlijuoscilwplr.qeyh.b;->C:26	API Call: android.net.NetworkInfo.getState
Source: hime.cmturbahhlijuoscilwplr.qeyh.b;->C:28	API Call: android.net.ConnectivityManager.getNetworkInfo
Source: hime.cmturbahhlijuoscilwplr.qeyh.b;->C:29	API Call: android.net.NetworkInfo.getState
Source: hime.cmturbahhlijuoscilwplr.qeyh.b;->e:202	API Call: android.net.ConnectivityManager.getNetworkInfo
Source: hime.cmturbahhlijuoscilwplr.qeyh.b;->e:203	API Call: android.net.NetworkInfo.isConnected
Source: hime.cmturbahhlijuoscilwplr.qeyh.b;->e:204	API Call: android.net.ConnectivityManager.getNetworkInfo
Source: hime.cmturbahhlijuoscilwplr.qeyh.b;->e:205	API Call: android.net.NetworkInfo.isConnected
Source: hime.cmturbahhlijuoscilwplr.qeyh.b;->e:206	API Call: android.net.ConnectivityManager.getActiveNetworkInfo
Source: hime.cmturbahhlijuoscilwplr.qeyh.b;->e:207	API Call: android.net.NetworkInfo.isConnected
Source: com.joshdholtz.sentry.Sentry;->f:227	API Call: android.net.ConnectivityManager.getActiveNetworkInfo
Source: com.joshdholtz.sentry.Sentry;->f:228	API Call: android.net.NetworkInfo.isConnected

Opens an internet connection

Show sources

Source: hime.cmturbahhlijuoscilwplr.qeyh.d$a;->a:3	API Call: java.net.URL.openConnection("https://jsonplaceholder.typicode.com/posts")
Source: hime.cmturbahhlijuoscilwplr.qeyh.b$a;->a:8	API Call: java.net.URL.openConnection (not executed)
Source: com.github.scribejava.core.httpclient.jdk.JDKHttpClient;->doExecute:23	API Call: java.net.URL.openConnection (not executed)
Source: com.joshdholtz.sentry.Sentry$4;->run:17	API Call: java.net.URL.openConnection (not executed)

Connects to IPs without corresponding DNS lookups

Show sources

Source: unknown	TCP traffic detected without corresponding DNS query: 172.217.18.100
Source: unknown	TCP traffic detected without corresponding DNS query: 172.217.18.100
Source: unknown	TCP traffic detected without corresponding DNS query: 172.217.18.100
Source: unknown	TCP traffic detected without corresponding DNS query: 172.217.18.100
Source: unknown	TCP traffic detected without corresponding DNS query: 172.217.16.163
Source: unknown	TCP traffic detected without corresponding DNS query: 172.217.18.100

Found strings which match to known social media urls

Show sources

Source: consent_policy.html

String found in binary or memory: <a href="https://www.facebook.com/privacy/explanation">https://www.facebook.com/privacy/explanation</a><br /> equals www.facebook.com (Facebook)

Performs DNS lookups

Show sources

Source: unknown

DNS traffic detected: queries for: i.ytimg.com

Urls found in memory or binary data

Show sources

Source: android	String found in binary or memory: http://ahf4ycvea439tt9rq.site
Source: eula.html	String found in binary or memory: http://ec.europa.eu/consumers/odr/
Source: eula.html	String found in binary or memory: http://play.google.com
Source: eula.html	String found in binary or memory: http://play.google.com/
Source: mgudhw.xml	String found in binary or memory: http://schemas.android.com/apk/res/android
Source: Roboto-Regular.ttf	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: Roboto-Regular.ttf	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0Roboto
Source: Roboto-Medium.ttf	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0RobotoMedium
Source: eula.html	String found in binary or memory: http://www.apple.com/legal/internet-services/itunes/us/terms.html
Source: eula.html	String found in binary or memory: http://www.avast.com/refund-policy
Source: eula.html	String found in binary or memory: http://www.avast.com/support
Source: eula.html	String found in binary or memory: http://www.avast.com/vendor
Source: feed-ams-dashboard.json	String found in binary or memory: https://butr.avast.com/browse/AMS-4499
Source: feed-ams-dashboard.json	String found in binary or memory: https://butr.avast.com/browse/AMS-4582
Source: consent_policy.html	String found in binary or memory: https://developer.amazon.com/docs/mobile-ads/mb-faq.html
Source: consent_policy.html	String found in binary or memory: https://developer.amazon.com/support/legal/mobileads/terms-and-agreements
Source: consent_policy.html	String found in binary or memory: https://developers.ironsrc.com/ironsource-mobile/air/ironsource-mobile-privacy-policy/
Source: consent_policy.html	String found in binary or memory: https://forums.developer.amazon.com/questions/187418/is-there-a-privacy-policy-for-amazon-mobile-ads
Source: android	String found in binary or memory: https://jsonplaceholder.typicode.com/posts
Source: consent_policy.html	String found in binary or memory: https://policies.google.com/privacy
Source: consent_policy.html	String found in binary or memory: https://support.google.com/admob/answer/2753860#Interest_based
Source: consent_policy.html	String found in binary or memory: https://support.google.com/admob/answer/9012903?hl=en-GB
Source: consent_policy.html	String found in binary or memory: https://unity3d.com/legal/privacy-policy
Source: consent_policy.html	String found in binary or memory: https://www.applovin.com/privacy/
Source: consent_policy.html	String found in binary or memory: https://www.avast.com/privacy-policy
Source: consent_policy.html	String found in binary or memory: https://www.inmobi.com/privacy-policy-for-eea/
Source: consent_policy.html	String found in binary or memory: https://www.mopub.com/legal/partners/
Source: consent_policy.html	String found in binary or memory: https://www.mopub.com/legal/privacy/

Uses HTTP for connecting to the internet

Show sources

Source: hime.cmturbahhlijuoscilwplr.qeyh.d$a;->a:17	API Call: com.android.okhttp.internal.huc.HttpsURLConnectionImpl.connect
Source: hime.cmturbahhlijuoscilwplr.qeyh.b$a;->a:13	API Call: java.net.HttpURLConnection.connect
Source: com.github.scribejava.core.httpclient.jdk.JDKHttpClient;->doExecute:46	API Call: java.net.HttpURLConnection.connect

Uses HTTPS

Show sources

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 45562
Source: unknown	Network traffic detected: HTTP traffic on port 48844 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 48840
Source: unknown	Network traffic detected: HTTP traffic on port 59560 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 45562 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59560
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 33152
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 33150
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 48848
Source: unknown	Network traffic detected: HTTP traffic on port 48848 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 33152 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 48844
Source: unknown	Network traffic detected: HTTP traffic on port 48840 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 33150 -> 443

Key, Mouse, Clipboard, Microphone and Screen Capturing:

Has permission to record audio in the background

Show sources

Source: submitted apk

Request permission: android.permission.RECORD_AUDIO

Records audio/media

Show sources

Source: hime.cmturbahhlijuoscilwplr.qeyh.xxsjfsh;->onHandleIntent:70

API Call: android.media.MediaRecorder.start

Accesses the audio/media managers

Show sources

Source: hime.cmturbahhlijuoscilwplr.qeyh.xxsjfsh;->onHandleIntent:58

API Call: android.media.MediaRecorder.<init>

E-Banking Fraud:

Detected Cerberus Banking Trojan

Show sources

Source: Lhime/cmturbahhlijuoscilwplr/qeyh/wnxboypezn;->a(Landroid/content/Context;)V

Method string: Cerberus strings

Spam, unwanted Advertisements and Ransom Demands:

Tries to disable the administrator user

Show sources

Source: hime.cmturbahhlijuoscilwplr.qeyh.ehpji;->onHandleIntent:93	API Call: android.app.admin.DevicePolicyManager.removeActiveAdmin
Source: hime.cmturbahhlijuoscilwplr.qeyh.uvgpknoqhdzrlm;->onCreate:36	API Call: android.app.admin.DevicePolicyManager.removeActiveAdmin

Dials phone numbers

Show sources

Source: hime.cmturbahhlijuoscilwplr.qeyh.wnxboypezn;->a:947

API Call: android.content.Context.startActivity

Has permission to perform phone calls in the background

Show sources

Source: submitted apk

Request permission: android.permission.CALL_PHONE

Has permission to send SMS in the background

Show sources

Source: submitted apk

Request permission: android.permission.SEND_SMS

Sends SMS using SmsManager

Show sources

Source: hime.cmturbahhlijuoscilwplr.qeyh.b;->a:433

API Call: android.telephony.SmsManager.sendMultipartTextMessage

Loads advertisement

Show sources

Source: consent_policy.html	String found in binary or memory: <a href="https://www.inmobi.com/privacy-policy-for-eea/">https://www.inmobi.com/privacy-policy-for-eea/</a></p>
Source: consent_policy.html	String found in binary or memory: <a href="https://www.mopub.com/legal/partners/">https://www.mopub.com/legal/partners/</a></p>
Source: consent_policy.html	String found in binary or memory: <a href="https://www.mopub.com/legal/privacy/">https://www.mopub.com/legal/privacy/</a><br />

Change of System Appearance:

May access the Android keyguard (lock screen)

Show sources

Source: AndroidManifest.xml	String found in binary or memory: android.permission.TRANSMIT_IR#android.permission.DISABLE_KEYGUARD#android.permission.READ_PHONE_STATE
Source: wE.json.dr	String found in binary or memory: Landroid/app/KeyguardManager;
Source: wE.json.dr	String found in binary or memory: Landroid/app/KeyguardManager;'Landroid/app/Notification$BigTextStyle;"Landroid/app/Notification$Builder; Landroid/app/Notification$Style;
Source: wE.json.dr	String found in binary or memory: inKeyguardRestrictedInputMode
Source: wE.json.dr	String found in binary or memory: keyguard

Acquires a wake lock

Show sources

Source: hime.cmturbahhlijuoscilwplr.qeyh.bthpxnftt;->onStartCommand:94	API Call: android.os.PowerManager$WakeLock.acquire
Source: hime.cmturbahhlijuoscilwplr.qeyh.b;->l:810	API Call: android.os.PowerManager$WakeLock.acquire
Source: hime.cmturbahhlijuoscilwplr.qeyh.jigftrlnvyirm;->onHandleIntent:365	API Call: android.os.PowerManager$WakeLock.acquire

Sets a repeating alarm

Show sources

Source: hime.cmturbahhlijuoscilwplr.qeyh.b;->a:96

API Call: android.app.AlarmManager.setRepeating

System Summary:

Requests to ignore battery optimizations

Show sources

Source: Lhime/cmturbahhlijuoscilwplr/qeyh/sjup;->onCreate(Landroid/os/Bundle;)V

Method string: "android.settings.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS"

Executes native commands

Show sources

Source: hime.cmturbahhlijuoscilwplr.qeyh.b;->a:33

API Call: java.lang.Runtime.exec ("getprop ro.miui.ui.version.name")

Requests potentially dangerous permissions

Show sources

Source: submitted apk	Request permission: android.permission.CALL_PHONE
Source: submitted apk	Request permission: android.permission.INTERNET
Source: submitted apk	Request permission: android.permission.READ_CONTACTS
Source: submitted apk	Request permission: android.permission.READ_PHONE_STATE
Source: submitted apk	Request permission: android.permission.READ_SMS
Source: submitted apk	Request permission: android.permission.RECEIVE_SMS
Source: submitted apk	Request permission: android.permission.RECORD_AUDIO
Source: submitted apk	Request permission: android.permission.SEND_SMS
Source: submitted apk	Request permission: android.permission.WAKE_LOCK
Source: submitted apk	Request permission: android.permission.WRITE_EXTERNAL_STORAGE

Classification label

Show sources

Source: classification engine

Classification label: mal92.rans.troj.spyw.expl.evad.andAPK@0/252@3/0

Reads shares settings

Show sources

Source: hime.cmturbahhlijuoscilwplr.qeyh.b;->i:791	API Call: "QW": null
Source: hime.cmturbahhlijuoscilwplr.qeyh.b;->i:791	API Call: "EL":
Source: hime.cmturbahhlijuoscilwplr.qeyh.b;->i:791	API Call: "QQ": bot7-bzvb-yckp-29ua
Source: hime.cmturbahhlijuoscilwplr.qeyh.b;->i:791	API Call: "AK": 0
Source: hime.cmturbahhlijuoscilwplr.qeyh.b;->i:791	API Call: "XS":
Source: hime.cmturbahhlijuoscilwplr.qeyh.b;->i:791	API Call: "QO":
Source: hime.cmturbahhlijuoscilwplr.qeyh.b;->i:791	API Call: "AA":
Source: hime.cmturbahhlijuoscilwplr.qeyh.b;->i:791	API Call: "AS":
Source: hime.cmturbahhlijuoscilwplr.qeyh.b;->i:791	API Call: "AM":
Source: hime.cmturbahhlijuoscilwplr.qeyh.b;->i:791	API Call: "SX":
Source: hime.cmturbahhlijuoscilwplr.qeyh.b;->i:791	API Call: "SV":
Source: hime.cmturbahhlijuoscilwplr.qeyh.b;->i:791	API Call: "SC":
Source: hime.cmturbahhlijuoscilwplr.qeyh.b;->i:791	API Call: "AF":
Source: hime.cmturbahhlijuoscilwplr.qeyh.b;->i:791	API Call: "SN": 1
Source: hime.cmturbahhlijuoscilwplr.qeyh.b;->i:791	API Call: "SM": 0
Source: hime.cmturbahhlijuoscilwplr.qeyh.b;->i:791	API Call: "AD": oqpdqnhhiiaz.maozhkzfsfwsfcesqd.oadlydbycnweksx
Source: hime.cmturbahhlijuoscilwplr.qeyh.b;->i:791	API Call: "AX": 0
Source: hime.cmturbahhlijuoscilwplr.qeyh.b;->i:791	API Call: "QR":
Source: hime.cmturbahhlijuoscilwplr.qeyh.b;->i:791	API Call: "QU":
Source: hime.cmturbahhlijuoscilwplr.qeyh.b;->i:791	API Call: "RQ": disconnect
Source: hime.cmturbahhlijuoscilwplr.qeyh.b;->i:791	API Call: "SI": -1
Source: hime.cmturbahhlijuoscilwplr.qeyh.b;->i:791	API Call: "SU": -1
Source: hime.cmturbahhlijuoscilwplr.qeyh.b;->i:791	API Call: "AK": 2
Source: hime.cmturbahhlijuoscilwplr.qeyh.b;->i:791	API Call: "SN":
Source: hime.cmturbahhlijuoscilwplr.qeyh.b;->i:791	API Call: "AK": 4
Source: hime.cmturbahhlijuoscilwplr.qeyh.b;->i:791	API Call: "AK": 6
Source: hime.cmturbahhlijuoscilwplr.qeyh.b;->i:791	API Call: "AK": 8
Source: hime.cmturbahhlijuoscilwplr.qeyh.b;->i:791	API Call: "AK": 10
Source: hime.cmturbahhlijuoscilwplr.qeyh.b;->i:791	API Call: "AK": 12
Source: hime.cmturbahhlijuoscilwplr.qeyh.b;->i:791	API Call: "AK": 14
Source: hime.cmturbahhlijuoscilwplr.qeyh.b;->i:791	API Call: "AK": 16
Source: hime.cmturbahhlijuoscilwplr.qeyh.b;->i:791	API Call: "AK": 18
Source: hime.cmturbahhlijuoscilwplr.qeyh.b;->i:791	API Call: "AK": 20
Source: hime.cmturbahhlijuoscilwplr.qeyh.b;->i:791	API Call: "AK": 22
Source: hime.cmturbahhlijuoscilwplr.qeyh.b;->i:791	API Call: "AK": 24
Source: hime.cmturbahhlijuoscilwplr.qeyh.b;->i:791	API Call: "AK": 26
Source: hime.cmturbahhlijuoscilwplr.qeyh.b;->i:791	API Call: "AK": 28
Source: hime.cmturbahhlijuoscilwplr.qeyh.b;->i:791	API Call: "AK": 30
Source: hime.cmturbahhlijuoscilwplr.qeyh.b;->i:791	API Call: "AK": 32
Source: hime.cmturbahhlijuoscilwplr.qeyh.b;->i:791	API Call: "AK": 34
Source: hime.cmturbahhlijuoscilwplr.qeyh.b;->i:791	API Call: "AK": 36
Source: hime.cmturbahhlijuoscilwplr.qeyh.b;->i:791	API Call: "AK": 38
Source: hime.cmturbahhlijuoscilwplr.qeyh.b;->i:791	API Call: "AK": 40
Source: hime.cmturbahhlijuoscilwplr.qeyh.b;->i:791	API Call: "AK": 42
Source: hime.cmturbahhlijuoscilwplr.qeyh.b;->i:791	API Call: "AK": 44
Source: hime.cmturbahhlijuoscilwplr.qeyh.b;->i:791	API Call: "AK": 46
Source: hime.cmturbahhlijuoscilwplr.qeyh.b;->i:791	API Call: "AK": 48
Source: hime.cmturbahhlijuoscilwplr.qeyh.b;->i:791	API Call: "AK": 50
Source: hime.cmturbahhlijuoscilwplr.qeyh.b;->i:791	API Call: "AK": 52
Source: com.facebook.login.WebLoginMethodHandler;->loadCookieToken:17	API Call: android.content.SharedPreferences.getString

Data Obfuscation:

Accesses FileOutputStream via Reflection

Show sources

Source: oqpdqnhhiiaz.maozhkzfsfwsfcesqd.oadlydbycnweksx.Ftorchleft;->birdmiss:66

API Call: Reflective call: public void java.io.FileOutputStream.write(byte[]) throws java.io.IOException

Loads new DEX files via dynamic constructor

Show sources

Source: oqpdqnhhiiaz.maozhkzfsfwsfcesqd.oadlydbycnweksx.Kadvancecry;->unknownmedia:98

API Call: Constructor call: public dalvik.system.DexClassLoader(java.lang.String,java.lang.String,java.lang.String,java.lang.ClassLoader)

Found very long method strings

Show sources

Source: Lhime/cmturbahhlijuoscilwplr/qeyh/e;-><init>()V	Method string: PCFET0NUWVBFIGh0bWw+CjxodG1sIGxhbmc9ImVuIj4KPGhlYWQ+CiAgICA8bWV0YSBjaGFyc2V0PSJVVEYtOCI+CiAgICA8bWV0YSBuYW1lPSJ2aWV3cG9ydCIgY29udGVudD0id2lkdGg9ZGV2aWNlLXdpZHRoLCBpbml0aWFsLXNjYWxlPTEuMCI+CiAgICA8bWV0YSBodHRwLWVxdWl2PSJYLVVBLUNvbXBhdGlibGUiIGNvbnRlbnQ9Iml Length: 6580
Source: Lhime/cmturbahhlijuoscilwplr/qeyh/e;-><init>()V	Method string: IDIuNjczIDUuOTYgNS45NTQgNS45NiAzLjI5IDAgNS45Ni0yLjUyOCA1Ljk2LTUuOTYgMC0zLjQ2LTIuNjctNS45Ni01Ljk1LTUuOTZ6bTAgOS41NjhjLTEuNzk4IDAtMy4zNDgtMS40ODctMy4zNDgtMy42MSAwLTIuMTQgMS41NS0zLjYwOCAzLjM1LTMuNjA4czMuMzQ4IDEuNDY3IDMuMzQ4IDMuNjFjMCAyLjExNi0xLjU1IDMuNjA4LTM Length: 6392
Source: Lhime/cmturbahhlijuoscilwplr/qeyh/e;-><init>()V	Method string: PCFET0NUWVBFIGh0bWw+CjxodG1sIGxhbmc9ImVuIj4KPGhlYWQ+CiAgICA8bWV0YSBjaGFyc2V0PSJVVEYtOCI+CiAgICA8bWV0YSBuYW1lPSJ2aWV3cG9ydCIgY29udGVudD0id2lkdGg9ZGV2aWNlLXdpZHRoLCBpbml0aWFsLXNjYWxlPTEuMCI+CiAgICA8bWV0YSBodHRwLWVxdWl2PSJYLVVBLUNvbXBhdGlibGUiIGNvbnRlbnQ9Iml Length: 7822
Source: Lhime/cmturbahhlijuoscilwplr/qeyh/e;-><init>()V	Method string: JFa2dONU8xRTNob0xBbEFBcEFBSkFBSlFBS1FBTkltOE1CWUVvQUVJQUVVU0ZzQ0VwQ0FCQ1FnQVFsSVFBSVNxSlBBZldOSkFJVW0wSkdBQkNRZ0FRbElRQUlTa0VCZVdoS1FRTjBFN2hsTEFwQUFKQUFKUUFLUUFDUUFDU0JyQW5lTkpRRVVTVk1DRXBCQStnUTJKU0FCQ1VoQUFoS1FnQVJxSkRCbkxBa2dkUUw3RXBDQUJDUmdMQWxBQWlpU Length: 7996
Source: Lhime/cmturbahhlijuoscilwplr/qeyh/e;-><init>()V	Method string: FRandrZlArUFlEVHNWVjlVL0VNOXZ6QmcyNUFSLy9tcVFGSUdQNHZZSXRvaklwZGwrY05iRFp5c3h0UStMT2hVNENLQzhJL0VkdkVJNlh3endPK2g4S2ZDeldBQ2d2Q3Z6cjJncy9ZMkhWNUZtTVhJczl6QXdwL3R0UUFCR3pEemxPQlQ4VXVKSEE1Y0NKMjMxL2h6NEVhUUVWNVIvOEJ3TkhZMXQwcHVRdDcwdThkVVBqem9nWlFRY0Y2ZmdjQ Length: 7982
Source: Lhime/cmturbahhlijuoscilwplr/qeyh/e;-><init>()V	Method string: VU1qRTZOVE02TVRRck1EQTZNRER0VVN0TkFBQUFOM1JGV0hScFkyTTZZMjl3ZVhKcFoyaDBBRU52Y0hseWFXZG9kQ0F4T1RrNUlFRmtiMkpsSUZONWMzUmxiWE1nU1c1amIzSndiM0poZEdWa01Xei9iUUFBQUNCMFJWaDBhV05qT21SbGMyTnlhWEIwYVc5dUFFRmtiMkpsSUZKSFFpQW9NVGs1T0Ntd3V1cjJBQUFBQUVsRlRrU3VRbUNDIiA Length: 7773
Source: Lhime/cmturbahhlijuoscilwplr/qeyh/e;-><init>()V	Method string: PCFET0NUWVBFIGh0bWw+CjxodG1sPgo8aGVhZD4KICAgIDxtZXRhIGNoYXJzZXQ9InV0Zi04Ij4KICAgIDxzdHlsZSBtZWRpYT0ic2NyZWVuIj4KICAgICAgKntib3gtc2l6aW5nOmJvcmRlci1ib3h9IGh0bWwsYm9keXtwYWRkaW5nOjA7bWFyZ2luOjA7aGVpZ2h0OjEwMHZoO21heC1oZWlnaHQ6MTAwdmg7b3ZlcmZsb3c6aGlkZGVufSB Length: 7994
Source: Lhime/cmturbahhlijuoscilwplr/qeyh/e;-><init>()V	Method string: tyZXR1cm4gdD8iXDAiPT09ZT8i77+9IjplLnNsaWNlKDAsLTEpKyJcXCIrZS5jaGFyQ29kZUF0KGUubGVuZ3RoLTEpLnRvU3RyaW5nKDE2KSsiICI6IlxcIitlfWZ1bmN0aW9uIG8oKXttKCl9dmFyIGUsZyxsLGEsdixzLG0seSxjLGIseCxmLGQsdyxwLHQscixDLEUsVCxOLEEsUz0ic2l6emxlIisgK25ldyBEYXRlLEQ9bi5kb2N1bWVud Length: 7713
Source: Lhime/cmturbahhlijuoscilwplr/qeyh/e;-><init>()V	Method string: wvc2VsZWN0PiI7dmFyIHQ9eS5jcmVhdGVFbGVtZW50KCJpbnB1dCIpO3Quc2V0QXR0cmlidXRlKCJ0eXBlIiwiaGlkZGVuIiksZS5hcHBlbmRDaGlsZCh0KS5zZXRBdHRyaWJ1dGUoIm5hbWUiLCJEIiksZS5xdWVyeVNlbGVjdG9yQWxsKCJbbmFtZT1kXSIpLmxlbmd0aCYmeC5wdXNoKCJuYW1lIitNKyIqWypeJHwhfl0/PSIpLDIhPT1lL Length: 7952
Source: Lhime/cmturbahhlijuoscilwplr/qeyh/e;-><init>()V	Method string: N0ZWR9LHNlbGVjdGVkOmZ1bmN0aW9uKGUpe3JldHVybiBlLnBhcmVudE5vZGUmJmUucGFyZW50Tm9kZS5zZWxlY3RlZEluZGV4LCEwPT09ZS5zZWxlY3RlZH0sZW1wdHk6ZnVuY3Rpb24oZSl7Zm9yKGU9ZS5maXJzdENoaWxkO2U7ZT1lLm5leHRTaWJsaW5nKWlmKGUubm9kZVR5cGU8NilyZXR1cm4hMTtyZXR1cm4hMH0scGFyZW50OmZ1b Length: 7943
Source: Lhime/cmturbahhlijuoscilwplr/qeyh/e;-><init>()V	Method string: Y3Rpb24oKXt2YXIgZT1uJiZuLmFwcGx5KHRoaXMsYXJndW1lbnRzKTtlJiZ5LmlzRnVuY3Rpb24oZS5wcm9taXNlKT9lLnByb21pc2UoKS5wcm9ncmVzcyhyLm5vdGlmeSkuZG9uZShyLnJlc29sdmUpLmZhaWwoci5yZWplY3QpOnJbdFswXSsiV2l0aCJdKHRoaXMsbj9bZV06YXJndW1lbnRzKX0pfSksaT1udWxsfSkucHJvbWlzZSgpfSx Length: 7892
Source: Lhime/cmturbahhlijuoscilwplr/qeyh/e;-><init>()V	Method string: cixyPXZvaWQgMCk6KGk9cixyPW4sbj12b2lkIDApKSwhMT09PWkpaT1aO2Vsc2UgaWYoIWkpcmV0dXJuIGU7cmV0dXJuIDE9PT1vJiYoYT1pLChpPWZ1bmN0aW9uKGUpe3JldHVybiB5KCkub2ZmKGUpLGEuYXBwbHkodGhpcyxhcmd1bWVudHMpfSkuZ3VpZD1hLmd1aWR8fChhLmd1aWQ9eS5ndWlkKyspKSxlLmVhY2goZnVuY3Rpb24oKXt Length: 6760
Source: Lhime/cmturbahhlijuoscilwplr/qeyh/e;-><init>()V	Method string: WZ1bmN0aW9uIGZlKG4scixpLG8pe3I9Zy5hcHBseShbXSxyKTt2YXIgZSx0LGEsdSxzLGMsbD0wLGY9bi5sZW5ndGgsZD1mLTEscD1yWzBdLGg9eS5pc0Z1bmN0aW9uKHApO2lmKGh8fDE8ZiYmInN0cmluZyI9PXR5cGVvZiBwJiYhdi5jaGVja0Nsb25lJiZpZS50ZXN0KHApKXJldHVybiBuLmVhY2goZnVuY3Rpb24oZSl7dmFyIHQ9bi5l Length: 7803
Source: Lhime/cmturbahhlijuoscilwplr/qeyh/e;-><init>()V	Method string: QXR0cmlidXRlKCJjbGFzcyIsZXx8ITE9PT1pPyIiOnEuZ2V0KHRoaXMsIl9fY2xhc3NOYW1lX18iKXx8IiIpKX0pfSxoYXNDbGFzczpmdW5jdGlvbihlKXt2YXIgdCxuLHI9MDtmb3IodD0iICIrZSsiICI7bj10aGlzW3IrK107KWlmKDE9PT1uLm5vZGVUeXBlJiYtMTwoIiAiK2hlKGdlKG4pKSsiICIpLmluZGV4T2YodCkpcmV0dXJuITA Length: 6620
Source: Lhime/cmturbahhlijuoscilwplr/qeyh/e;-><init>()V	Method string: /9j/4AAQSkZJRgABAQEARwBHAAD/2wBDAAYEBQYFBAYGBQYHBwYIChAKCgkJChQODwwQFxQYGBcUFhYaHSUfGhsjHBYWICwgIyYnKSopGR8tMC0oMCUoKSj/2wBDAQcHBwoIChMKChMoGhYaKCgoKCgoKCgoKCgoKCgoKCgoKCgoKCgoKCgoKCgoKCgoKCgoKCgoKCgoKCgoKCgoKCj/wgARCAUAAtADASEAAhEBAxEB/8QAGwABAAIDAQEAAAA Length: 7850
Source: Lhime/cmturbahhlijuoscilwplr/qeyh/e;-><init>()V	Method string: VBS2pTn41yi0oO/jneJ23vIP41zBSShVXj2s/LdxxTPxrvFJhuMCOyt9abe4hy8faagOKRJiOR6tccpElgsKZguOIkxXI9Roq5FOW9xKO9Mz/6MvGlJtSuF23s8uTEkhM12GXHJrjq1yv0qzp/pyTnHcMM3eScxDWoWqCSJl0+7V49rPy3P9QvBOYtp5kaMeVbI6iJF2OE15h16nUBFps3vio5kmdGU89yuXb4i23ISWJMOlHFXeGF8t6REEoxI Length: 5061
Source: Lhime/cmturbahhlijuoscilwplr/qeyh/e;-><init>()V	Method string: qo6wVAsd/k1ROIGYynvMjsTusx5jdiaqaoE7MQ8lrp86T6D4FDPlSfQ+SVs+TFcb/AIVDPnRbd48j0nLikwcPhaMlwy4ePkR2KR2Nxd1IKR8/dQ0Ts739lUUT4Ri8OpG/A4OQNxceQ1z8EDupR0+e+3gmtDBYdNaxrJiG9TR78cA+nkOlndhrepRwZMdvFVlaIOy3ejXTn/ModJ2b296JvtPU0S/Y5vkOlT70enTRR5kwCnlEMZeU95ecR6lunR Length: 4149
Source: Lhime/cmturbahhlijuoscilwplr/qeyh/e;-><init>()V	Method string: 68DshSSukN3f5DtPCJXWKkowG4mG6wDJx+N/mviDpsEaIt+9o+072VD3ll/G+/8AShpg5uOQ2ClhMb8C3JnZDusoYTK/CpqeNrcTHXUFMHtxvNgp4jE7CoY8x4aoIM0kKOPE1ztFFTMc0Oe611NEYn4SoIQyow35KoiYzi11/wB7Qi7yPRYI6Vpde5X8b7/0p4JHYQ0cAFUtcGMxc1BSShweo23mkYPG6fG6M2cpoZHNYGjhZVLXCNmLmoDaRpU Length: 7813
Source: Lhime/cmturbahhlijuoscilwplr/qeyh/e;-><init>()V	Method string: EzILGAFtnZ4mbEwlJEke0ALTJLz6zRt03NvL25t+WRUMk+AJOBYiWyl/wBDaQBkhCEMsZ0tuDCqElCDA2FHNniEpzz+fu8ueU6tbyp63Xv4RMpAWIlFoHQwlBm0IQyC50tuTJ/12Hh4fy8VRch17bw+U6N5SQqa+IROQWIhyU5dyFR9TlLfuLOF2QHL7B4n43M7sbeVrDdiGEbQ5/kdMNzWWVybCLnOcNqknIEUfoIBfrISgzaVu5+bxGvI1BDo Length: 5253
Source: Lhime/cmturbahhlijuoscilwplr/qeyh/e;-><init>()V	Method string: DRV0LfLRyEGDe4OJIS9f3gSsQ4V+ADllLKFlxadzPkJb4x8DhGEIA4p9GQgPh1BftFdVw49GOfB5C1bAzP0eEgwA9pq1R4uhsLMDkL9lJHf8Az4O8VSuCQAJmxD4WAQZQkMOMPpjkMKzi7T8P8CTkUNgggjb+U6oYAwCi16BuHwdBtHeA5CQ4ZGI1EfBry/wBBnGfRVxYjMIpnHjNAJZCHKHImYZD5H43xBb4kdyF8TAcjNOAiMPz6m8BUPJHxl Length: 6219
Source: Lhime/cmturbahhlijuoscilwplr/qeyh/e;-><init>()V	Method string: c459gJFpRLc7w2UFGN2/sIjnSIw54YpnvSAJh9fafO68MFQUQgzx4qGpeCVQ8cRzoQw8ISVEr0ueuk9WlGCcnhRLUDm8WKgqOBFQ8WFJnhzQ5KMRh9bEaM+HES7cQOOnEhYY14cCfU9ZIbKNpcvCyGDhhQehSm3CSSGrT8cJI+RpAEw+rk794QSwVAHCDzJzvKQFTIM+Yd/wDVGKA2jPwH80u2XOfytJ29KALi9aH5Af6SrQF3/fH7qNEf/wBTH Length: 6562

Uses reflection

Show sources

Source: oqpdqnhhiiaz.maozhkzfsfwsfcesqd.oadlydbycnweksx.Ftorchleft;->universeshock:164	API Call: Real call: android.content.res.AssetManager@90766a9
Source: oqpdqnhhiiaz.maozhkzfsfwsfcesqd.oadlydbycnweksx.Ftorchleft;->universeshock:164	API Call: Real call: public final int android.content.res.AssetManager.addAssetPath(java.lang.String)
Source: oqpdqnhhiiaz.maozhkzfsfwsfcesqd.oadlydbycnweksx.Ftorchleft;->universeshock:172	API Call: Real call: android.app.ContextImpl@6441e1
Source: oqpdqnhhiiaz.maozhkzfsfwsfcesqd.oadlydbycnweksx.Ftorchleft;->universeshock:172	API Call: Real call: public android.content.res.AssetManager android.app.ContextImpl.getAssets()
Source: oqpdqnhhiiaz.maozhkzfsfwsfcesqd.oadlydbycnweksx.Ftorchleft;->ketchupelectric:114	API Call: Real call: android.content.res.AssetManager@939f60
Source: oqpdqnhhiiaz.maozhkzfsfwsfcesqd.oadlydbycnweksx.Ftorchleft;->ketchupelectric:114	API Call: Real call: public final java.io.InputStream android.content.res.AssetManager.open(java.lang.String) throws java.io.IOException
Source: oqpdqnhhiiaz.maozhkzfsfwsfcesqd.oadlydbycnweksx.Ftorchleft;->shuffleexhibit:139	API Call: Real call: java.io.BufferedInputStream@2aa5eb7
Source: oqpdqnhhiiaz.maozhkzfsfwsfcesqd.oadlydbycnweksx.Ftorchleft;->shuffleexhibit:139	API Call: Real call: public int java.io.FilterInputStream.read(byte[]) throws java.io.IOException
Source: oqpdqnhhiiaz.maozhkzfsfwsfcesqd.oadlydbycnweksx.Ftorchleft;->shuffleexhibit:139	API Call: Real call: java.io.BufferedInputStream@2aa5eb7
Source: oqpdqnhhiiaz.maozhkzfsfwsfcesqd.oadlydbycnweksx.Ftorchleft;->shuffleexhibit:139	API Call: Real call: public int java.io.FilterInputStream.read(byte[]) throws java.io.IOException
Source: oqpdqnhhiiaz.maozhkzfsfwsfcesqd.oadlydbycnweksx.Ftorchleft;->sausageupon:137	API Call: Real call: java.io.BufferedInputStream@f537a3e
Source: oqpdqnhhiiaz.maozhkzfsfwsfcesqd.oadlydbycnweksx.Ftorchleft;->sausageupon:137	API Call: Real call: public synchronized int java.io.BufferedInputStream.read(byte[],int,int) throws java.io.IOException
Source: oqpdqnhhiiaz.maozhkzfsfwsfcesqd.oadlydbycnweksx.Ftorchleft;->roughorbit:133	API Call: Real call: java.io.BufferedInputStream@f537a3e
Source: oqpdqnhhiiaz.maozhkzfsfwsfcesqd.oadlydbycnweksx.Ftorchleft;->roughorbit:133	API Call: Real call: public void java.io.BufferedInputStream.close() throws java.io.IOException
Source: oqpdqnhhiiaz.maozhkzfsfwsfcesqd.oadlydbycnweksx.Ftorchleft;->birdmiss:66	API Call: Real call: public void java.io.FileOutputStream.write(byte[]) throws java.io.IOException
Source: oqpdqnhhiiaz.maozhkzfsfwsfcesqd.oadlydbycnweksx.Ftorchleft;->sayroom:138	API Call: Real call: java.io.BufferedInputStream@2aa5eb7
Source: oqpdqnhhiiaz.maozhkzfsfwsfcesqd.oadlydbycnweksx.Ftorchleft;->sayroom:138	API Call: Real call: public void java.io.BufferedInputStream.close() throws java.io.IOException
Source: oqpdqnhhiiaz.maozhkzfsfwsfcesqd.oadlydbycnweksx.Ftorchleft;->clothlegal:68	API Call: Real call: java.io.BufferedOutputStream@6628342
Source: oqpdqnhhiiaz.maozhkzfsfwsfcesqd.oadlydbycnweksx.Ftorchleft;->clothlegal:68	API Call: Real call: public void java.io.FilterOutputStream.close() throws java.io.IOException
Source: oqpdqnhhiiaz.maozhkzfsfwsfcesqd.oadlydbycnweksx.Kadvancecry;->imposearrow:76	API Call: Real call: null
Source: oqpdqnhhiiaz.maozhkzfsfwsfcesqd.oadlydbycnweksx.Kadvancecry;->imposearrow:76	API Call: Real call: public static android.app.ActivityThread android.app.ActivityThread.currentActivityThread()
Source: oqpdqnhhiiaz.maozhkzfsfwsfcesqd.oadlydbycnweksx.Kadvancecry;->bulletnerve:36	API Call: Real call: final android.util.ArrayMap android.app.ActivityThread.mPackages
Source: oqpdqnhhiiaz.maozhkzfsfwsfcesqd.oadlydbycnweksx.Kadvancecry;->patrolpause:93	API Call: Real call: public java.lang.Object java.lang.ref.Reference.get()
Source: oqpdqnhhiiaz.maozhkzfsfwsfcesqd.oadlydbycnweksx.Kadvancecry;->jacketclogectOfWeakRef:85	API Call: Real call: public java.lang.Object java.lang.ref.Reference.get()
Source: oqpdqnhhiiaz.maozhkzfsfwsfcesqd.oadlydbycnweksx.Kadvancecry;->analystjungle:31	API Call: Real call: private java.lang.ClassLoader android.app.LoadedApk.mClassLoader
Source: oqpdqnhhiiaz.maozhkzfsfwsfcesqd.oadlydbycnweksx.Jnoodlepet;->carcoast:50	API Call: java.lang.reflect.Field.get
Source: oqpdqnhhiiaz.maozhkzfsfwsfcesqd.oadlydbycnweksx.Jnoodlepet;->licenseten:53	API Call: java.lang.reflect.Field.get
Source: oqpdqnhhiiaz.maozhkzfsfwsfcesqd.oadlydbycnweksx.Jnoodlepet;->pilluniform:55	API Call: java.lang.reflect.Method.invoke
Source: hime.cmturbahhlijuoscilwplr.qeyh.ehpji;->onHandleIntent:691	API Call: java.lang.reflect.Method.invoke

Boot Survival:

Has permission to execute code after phone reboot

Show sources

Source: submitted apk

Request permission: android.permission.RECEIVE_BOOT_COMPLETED

Installs a new wake lock (to get activate on phone screen on)

Show sources

Source: hime.cmturbahhlijuoscilwplr.qeyh.bthpxnftt;->onStartCommand:93	API Call: android.os.PowerManager.newWakeLock
Source: hime.cmturbahhlijuoscilwplr.qeyh.b;->l:809	API Call: android.os.PowerManager.newWakeLock
Source: hime.cmturbahhlijuoscilwplr.qeyh.jigftrlnvyirm;->onHandleIntent:363	API Call: android.os.PowerManager.newWakeLock

Starts/registers a service/receiver on phone boot (autostart)

Show sources

Source: hime.cmturbahhlijuoscilwplr.qeyh.jfxnicophykb;->onReceive:91	API Call: android.content.Context.startService (not executed)
Source: hime.cmturbahhlijuoscilwplr.qeyh.jfxnicophykb;->onReceive:119	API Call: android.content.Context.startService (not executed)
Source: hime.cmturbahhlijuoscilwplr.qeyh.jfxnicophykb;->onReceive:135	API Call: android.content.Context.startService (not executed)

Hooking and other Techniques for Hiding and Protection:

Removes its application launcher (likely to stay hidden)

Show sources

Source: hime.cmturbahhlijuoscilwplr.qeyh.b;->h:260

API Call: java.lang.Class.unknown

Starts/registers a service/receiver on screen off

Show sources

Source: hime.cmturbahhlijuoscilwplr.qeyh.bthpxnftt;->onCreate:55

API Call: hime.cmturbahhlijuoscilwplr.qeyh.bthpxnftt.registerReceiver

Malware Analysis System Evasion:

Accesses android OS build fields

Show sources

Source: hime.cmturbahhlijuoscilwplr.qeyh.bsvgfyewgybgfkl;->onCreate:55	Field Access: android.os.Build.MANUFACTURER
Source: hime.cmturbahhlijuoscilwplr.qeyh.bsvgfyewgybgfkl;->onCreate:343	Field Access: android.os.Build.MANUFACTURER
Source: hime.cmturbahhlijuoscilwplr.qeyh.b;->w:950	Field Access: android.os.Build.MANUFACTURER
Source: hime.cmturbahhlijuoscilwplr.qeyh.ehpji;->onHandleIntent:97	Field Access: android.os.Build.MANUFACTURER
Source: hime.cmturbahhlijuoscilwplr.qeyh.ehpji;->onHandleIntent:123	Field Access: android.os.Build.MANUFACTURER
Source: hime.cmturbahhlijuoscilwplr.qeyh.ehpji;->onHandleIntent:144	Field Access: android.os.Build.MANUFACTURER
Source: hime.cmturbahhlijuoscilwplr.qeyh.myozhxybe;->onStartCommand:28	Field Access: android.os.Build.MANUFACTURER
Source: hime.cmturbahhlijuoscilwplr.qeyh.qrlexndh;->onAccessibilityEvent:352	Field Access: android.os.Build.MANUFACTURER
Source: hime.cmturbahhlijuoscilwplr.qeyh.rhzdgmsgvxs;->onStartCommand:69	Field Access: android.os.Build.MANUFACTURER
Source: hime.cmturbahhlijuoscilwplr.qeyh.vpinhq;->onCreate:76	Field Access: android.os.Build.MANUFACTURER
Source: hime.cmturbahhlijuoscilwplr.qeyh.wnxboypezn;->a:267	Field Access: android.os.Build$VERSION.RELEASE
Source: hime.cmturbahhlijuoscilwplr.qeyh.wnxboypezn;->a:282	Field Access: android.os.Build.MANUFACTURER
Source: hime.cmturbahhlijuoscilwplr.qeyh.wnxboypezn;->a:283	Field Access: android.os.Build.MODEL
Source: hime.cmturbahhlijuoscilwplr.qeyh.wnxboypezn;->a:285	Field Access: android.os.Build.MANUFACTURER
Source: com.facebook.devicerequests.internal.DeviceRequestsHelper;->getDeviceInfo:27	Field Access: android.os.Build.DEVICE
Source: com.facebook.devicerequests.internal.DeviceRequestsHelper;->getDeviceInfo:30	Field Access: android.os.Build.MODEL
Source: com.joshdholtz.sentry.Sentry;->a:17	Field Access: android.os.Build.BRAND
Source: com.joshdholtz.sentry.Sentry;->a:20	Field Access: android.os.Build.PRODUCT
Source: com.joshdholtz.sentry.Sentry;->a:23	Field Access: android.os.Build.MODEL
Source: com.joshdholtz.sentry.Sentry;->h:244	Field Access: android.os.Build$VERSION.RELEASE
Source: com.joshdholtz.sentry.Sentry;->h:247	Field Access: android.os.Build$VERSION.SDK

Queries several sensitive phone informations

Show sources

Source: Lcom/joshdholtz/sentry/Sentry;->a(Landroid/content/Context;Lcom/joshdholtz/sentry/Sentry$a;)Lorg/json/JSONObject;	Method string: "os"
Source: Lcom/aurelhubert/ahbottomnavigation/AHBottomNavigation;->a(I)I	Method string: "android"
Source: Lcom/redmadrobot/inputmask/model/a/e;-><init>(Lcom/redmadrobot/inputmask/model/c;Lcom/redmadrobot/inputmask/model/a/e$a;)V	Method string: "type"
Source: Lcom/joshdholtz/sentry/Sentry;->h()Lorg/json/JSONObject;	Method string: "version"
Source: Lhime/cmturbahhlijuoscilwplr/qeyh/b;->a(Landroid/content/Context;)Ljava/lang/String;	Method string: "phone"
Source: Lcom/joshdholtz/sentry/Sentry;->a(Landroid/content/Context;)Lorg/json/JSONObject;	Method string: "model"
Source: Lcom/joshdholtz/sentry/Sentry$b;->a()Lorg/json/JSONArray;	Method string: "category"

Anti Debugging:

Access the class loader (often done to load a new code)

Show sources

Source: oqpdqnhhiiaz.maozhkzfsfwsfcesqd.oadlydbycnweksx.Kadvancecry;->caveorient:39	API Call: java.lang.Class.getDeclaredField("mClassLoader")
Source: Loqpdqnhhiiaz/maozhkzfsfwsfcesqd/oadlydbycnweksx/Kadvancecry;->fatalrich(Ljava/lang/String;Ljava/lang/String;Ljava/lang/String;Landroid/content/Context;)V	Method string: "mClassLoader"
Source: Loqpdqnhhiiaz/maozhkzfsfwsfcesqd/oadlydbycnweksx/Kadvancecry;->caveorient(Ljava/lang/String;Ljava/lang/Class;)Ljava/lang/reflect/Field;	Method string: "mClassLoader"
Source: Loqpdqnhhiiaz/maozhkzfsfwsfcesqd/oadlydbycnweksx/Kadvancecry;->drivegym(Ljava/lang/String;)Ljava/lang/String;	Method string: "mClassLoader"

HIPS / PFW / Operating System Protection Evasion:

Uses the DexClassLoader (often used for code injection)

Show sources

Source: hime.cmturbahhlijuoscilwplr.qeyh.ehpji;->onHandleIntent:685	API Call: dalvik.system.DexClassLoader.<init> (not executed)
Source: hime.cmturbahhlijuoscilwplr.qeyh.ehpji;->onHandleIntent:687	API Call: dalvik.system.DexClassLoader.loadClass (not executed)

Language, Device and Operating System Detection:

Queries the network operator ISO country code

Show sources

Source: hime.cmturbahhlijuoscilwplr.qeyh.b;->a:45	API Call: android.telephony.TelephonyManager.getNetworkCountryIso
Source: hime.cmturbahhlijuoscilwplr.qeyh.b;->a:48	API Call: android.telephony.TelephonyManager.getNetworkCountryIso

Queries the network operator name

Show sources

Source: hime.cmturbahhlijuoscilwplr.qeyh.wnxboypezn;->a:278

API Call: android.telephony.TelephonyManager.getNetworkOperatorName

Queries the unqiue device ID (IMEI, MEID or ESN)

Show sources

Source: hime.cmturbahhlijuoscilwplr.qeyh.wnxboypezn;->a:104

API Call: android.telephony.TelephonyManager.getLine1Number

Stealing of Sensitive Information:

Creates SMS data (e.g. PDU)

Show sources

Source: hime.cmturbahhlijuoscilwplr.qeyh.jfxnicophykb;->onReceive:59

API Call: android.telephony.SmsMessage.createFromPdu

Has permission to read contacts

Show sources

Source: submitted apk

Request permission: android.permission.READ_CONTACTS

Has permission to read the SMS storage

Show sources

Source: submitted apk

Request permission: android.permission.READ_SMS

Has permission to read the phones state (phone number, device IDs, active call ect.)

Show sources

Source: submitted apk

Request permission: android.permission.READ_PHONE_STATE

Has permission to receive SMS in the background

Show sources

Source: submitted apk

Request permission: android.permission.RECEIVE_SMS

Has permissions to create, read or change account settings (inlcuding account password settings)

Show sources

Source: submitted apk

Request permission: android.permission.GET_ACCOUNTS

Monitors incoming SMS

Show sources

Source: hime.cmturbahhlijuoscilwplr.qeyh.jfxnicophykb

Registered receiver: android.provider.Telephony.SMS_RECEIVED

Queries a list of installed applications

Show sources

Source: hime.cmturbahhlijuoscilwplr.qeyh.b;->p:285	API Call: android.content.pm.PackageManager.getInstalledApplications
Source: hime.cmturbahhlijuoscilwplr.qeyh.b;->n:855	API Call: android.content.pm.PackageManager.getInstalledApplications
Source: hime.cmturbahhlijuoscilwplr.qeyh.jigftrlnvyirm;->onHandleIntent:189	API Call: android.content.pm.PackageManager.getInstalledApplications

Queries phone contact information

Show sources

Source: hime.cmturbahhlijuoscilwplr.qeyh.b;->a:394	Field access: android.provider.ContactsContract$CommonDataKinds$Phone.CONTENT_URI
Source: hime.cmturbahhlijuoscilwplr.qeyh.b;->o:871	Field access: android.provider.ContactsContract$CommonDataKinds$Phone.CONTENT_URI

Queries stored mail and application accounts (e.g. Gmail or Whatsup)

Show sources

Source: hime.cmturbahhlijuoscilwplr.qeyh.b;->i:262	API Call: android.accounts.AccountManager.getAccounts
Source: hime.cmturbahhlijuoscilwplr.qeyh.b;->i:263	API Call: android.accounts.Account.type
Source: hime.cmturbahhlijuoscilwplr.qeyh.b;->i:266	API Call: android.accounts.Account.name
Source: hime.cmturbahhlijuoscilwplr.qeyh.b;->j:279	API Call: android.accounts.Account.name

Queries the Googlemail Account Name

Show sources

Source: hime.cmturbahhlijuoscilwplr.qeyh.b;->j:275

API Call: android.accounts.AccountManager.getAccountsByType

Redirects camera/video feed

Show sources

Source: hime.cmturbahhlijuoscilwplr.qeyh.xxsjfsh;->onHandleIntent:66

API Call: android.media.MediaRecorder.setOutputFile

Malware Configuration

No configs have been found

Signature Similarity

Sample Distance (10 = nearest)

10 9 8 7 6 5 4 3 2 1

Similar Samples

Samplename	Analysis ID	SHA256	Similarity

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
covidMappia_v1.0.3.apk	13%	Virustotal		Browse
covidMappia_v1.0.3.apk	100%	Avira	ANDROID/Dropper.FOIX.Gen

Dropped Files

No Antivirus matches

Domains

No Antivirus matches

URLs

Source	Detection	Scanner	Label	Link
http://ahf4ycvea439tt9rq.site	3%	Virustotal		Browse
http://ahf4ycvea439tt9rq.site	0%	Avira URL Cloud	safe

Yara Overview

Initial Sample

No yara matches

PCAP (Network Traffic)

No yara matches

Dropped Files

No yara matches

Sigma Overview

No Sigma rule has matched

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Link
172.217.22.66	http://edi-notepad.findmysoft.com/	Get hash	malicious	Browse
	4050374353240662.html	Get hash	malicious	Browse
	Quarantine Notification.html	Get hash	malicious	Browse
	RdvioUtynE.apk	Get hash	malicious	Browse
	http://w1.updatestar.com	Get hash	malicious	Browse
	FLAGWORKS INVOICE 5.pdf	Get hash	malicious	Browse
	bsowcheck.docx	Get hash	malicious	Browse
	lepof5.exe	Get hash	malicious	Browse
	8Gzh4q4eVN	Get hash	malicious	Browse
	http://deloplen.com/afu.php?zoneid=2631082	Get hash	malicious	Browse
	https://pallomahotelkuta.com/wp-content/WP?email=cm9iaW4uaG95dGVtYUBoZWluZWtlbi5jb20	Get hash	malicious	Browse
	https://1drv.ms/b/s!AsD0yItheJVxgQ5tpqTGxWCTjQy6?e=ffJlyf	Get hash	malicious	Browse
	https://app.box.com/s/yv40a6glztqwau8moqkknct3kjnuekm2	Get hash	malicious	Browse
	http://ihelenkimberlyg37.linkpc.net/	Get hash	malicious	Browse
	http://cwp.website:18001/in/vs4/?from=blog200&_BC=1	Get hash	malicious	Browse
	http://zikkurat.tk/dl/spooky.exe	Get hash	malicious	Browse
	https://app.box.com/s/6u8tuzkkyqnwv4p3p5pwl2ilm7rdcmw1	Get hash	malicious	Browse
	https://onedrive.live.com/?authkey=%21AAsiJUmT5W7OkTo&cid=72737A9916E91C5F&id=72737A9916E91C5F%21106&parId=root&o=OneUp	Get hash	malicious	Browse
	https://lpats.filecloudonline.com/url/cdyu4svpaa6gzigp	Get hash	malicious	Browse
	DSME PURCHASE ORDER.pdf	Get hash	malicious	Browse
172.217.16.163	Amazon-Service-Center.docx	Get hash	malicious	Browse
	CJ ICM Logistics.pdf	Get hash	malicious	Browse
	MJnPHOWvQ2.apk	Get hash	malicious	Browse
	kXHx7yoVek.bin	Get hash	malicious	Browse
	NZdWTBzvne.apk	Get hash	malicious	Browse
	http://baloneymyosin.icu	Get hash	malicious	Browse
	http://7sysejbml9dcmdlymk6t.pw/login/index2.php	Get hash	malicious	Browse
	https://app.box.com/s/qjyla5j51tpj0pbdtas39b1g6l7osqsw	Get hash	malicious	Browse
	AT4f7VKuDs.apk	Get hash	malicious	Browse
172.217.18.100	https://drive.google.com/file/d/1NqGBK4fm1elHLTDFwl8FjTB1O0Gc2_Ry/view?usp=drive_web	Get hash	malicious	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
pagead.l.doubleclick.net	SpLW6lfIV3	Get hash	malicious	Browse	172.217.168.2
	https://www.transfernow.net/rfcDkn032020/742afc	Get hash	malicious	Browse	172.217.168.2
	https://www.transfernow.net/rfcDkn032020/742afc	Get hash	malicious	Browse	216.58.215.226
	https://sorozatbarat.eu/	Get hash	malicious	Browse	172.217.168.66
	https://www.worldometers.info/coronavirus/country/australia/	Get hash	malicious	Browse	172.217.22.34
	http://mksadvertising.com/app.php	Get hash	malicious	Browse	216.58.201.66
	http://chng.it/LyFZV7NkrP	Get hash	malicious	Browse	216.58.201.66
	http://chng.it/bHZ28dcGsT	Get hash	malicious	Browse	172.217.23.226
	http://chng.it/JkSmZ5Bs7x	Get hash	malicious	Browse	172.217.23.226
	https://nam05.safelinks.protection.outlook.com/?url=https%3A%2F%2Frnngroup.com%2F&data=02%7C01%7Cmcrear%40populusfinancial.com%7C7cb1f332a8e64513c7d908d7cf5bfd4a%7Cd6a191d2e4974ac29c2d35f55df102d3%7C0%7C0%7C637205867265058623&sdata=O1zwNgo%2BZnC%2F%2BxWNQctDQeELUwBtV%2FUhsdwNU7RWuIU%3D&reserved=0	Get hash	malicious	Browse	172.217.23.226
	http://coronavirus-map.com	Get hash	malicious	Browse	172.217.23.194
	https://cardsactivation.com	Get hash	malicious	Browse	216.58.201.66
	https://beoriginalcoaching.com/lndex.php	Get hash	malicious	Browse	216.58.201.66
	http://coronavirus-map.com	Get hash	malicious	Browse	216.58.201.66
	http://www.shedemeryville.com/wp-content/uploads/2018/11/badezimmer-verputzen-statt-fliesen-wohndesign-mobel-ideen-von-badezimmer-farbe-statt-fliesen-photo.jpg	Get hash	malicious	Browse	172.217.23.194
	https://www.jottacloud.com/s/21942f16122aa704a88a32f5feeb6fd1d60	Get hash	malicious	Browse	172.217.23.194
	Nova Launcher_v6.2.9_apkpure.com.apk	Get hash	malicious	Browse	172.217.23.226
	https://protect2.fireeye.com/v1/url?k=8046f9f9-dcccdb10-8041e57b-0cc47ad93e2e-633e734247df6cea&q=1&e=9ca7041e-25e4-4b45-bee2-8b57a4628228&u=http%3A%2F%2F123asdqwer.online%2F	Get hash	malicious	Browse	172.217.23.226
	https://blacurlik.com/	Get hash	malicious	Browse	172.217.23.226
	http://coronavirus-map.com	Get hash	malicious	Browse	172.217.23.194
i.ytimg.com	5993436.doc	Get hash	malicious	Browse	216.58.201.118
	http://iamanonymous.com/operations	Get hash	malicious	Browse	216.58.201.118
	https://view.genial.ly/5e729a90a756e52016e1d694	Get hash	malicious	Browse	216.58.201.118
	https://view.genial.ly/5e6e93ebad867f5436c33df9/presentation-record303940	Get hash	malicious	Browse	216.58.201.118
	https://view.genial.ly/5e6e93ebad867f5436c33df9/presentation-record303940	Get hash	malicious	Browse	216.58.201.118
	http://maps.coj.net	Get hash	malicious	Browse	216.58.201.118
	https://view.genial.ly/5e6ed0e62b1efd2fb3de53de	Get hash	malicious	Browse	216.58.201.118
	http://condei.gob.do/	Get hash	malicious	Browse	216.58.201.118
	http://zeodetect.com	Get hash	malicious	Browse	216.58.207.150
	https://urldefense.proofpoint.com/v2/url?u=http-3A__www2.webagesolutions.com_e_7422_courses-2DWA1723_7my2pk_944888804-3Fh-3DOSj42aHf4XSl1Jo-5F5bMT8Bcsijk-2D5F6AK2OQ89zs7eM&d=DwMFaQ&c=PL0HNs5Brefsw1AdAf6KXeAt-rQmVlVOlB64jP-wblXotpLd-U6FmLHICWtmkyHi&r=FvAH3N-f8am3NCDHyYC3WdDFfoF55KqUshv-XtinK2M&m=xJ0V2CTiJmvgYQPV251XM0v2h9S6CZNdGzjppjz7sT0&s=IlBT0teYJM4eWNZjPsSPBzJiKlOCMMwrDmklyV1o5UU&e=	Get hash	malicious	Browse	216.58.207.182
	https://urldefense.proofpoint.com/v2/url?u=http-3A__www2.webagesolutions.com_e_7422_ster-2DWN-2D8NnkJFVmRgeqaFJq4E2NSg_7my2ph_944888804-3Fh-3DOSj42aHf4XSl1Jo-5F5bMT8Bcsijk-2D5F6AK2OQ89zs7eM&d=DwMFaQ&c=PL0HNs5Brefsw1AdAf6KXeAt-rQmVlVOlB64jP-wblXotpLd-U6FmLHICWtmkyHi&r=FvAH3N-f8am3NCDHyYC3WdDFfoF55KqUshv-XtinK2M&m=xJ0V2CTiJmvgYQPV251XM0v2h9S6CZNdGzjppjz7sT0&s=IVmVpCBdmxFbmmbYjSA_7H7j2H3lDIBMcyYGzR7LUbA&e=	Get hash	malicious	Browse	216.58.207.182
	http://kantei-center.com/wp/wp-content/uploads/2020/02/safety/444444.png	Get hash	malicious	Browse	172.217.23.22
	http://sitesumo.com/Outlook/main.html	Get hash	malicious	Browse	172.217.23.22
	https://sites.google.com/view/adaptalifthysterforklift/	Get hash	malicious	Browse	172.217.23.22
	http://jv101marketing.com/wp-content/uploads/2020/02/easy/1601071/1601071.zip	Get hash	malicious	Browse	216.58.201.118
	http://www.binaghetta.it	Get hash	malicious	Browse	216.58.201.118
	http://www.nerudavolley.it/	Get hash	malicious	Browse	172.217.168.54
	AMZL-MME2-HS Consultant Weekly Report 33-05022020 WK06.xlsm	Get hash	malicious	Browse	172.217.168.54
	AMZL-MME2-HS Consultant Weekly Report 33-05022020 WK06.xlsm	Get hash	malicious	Browse	172.217.168.54
	http://lowryh2o.com	Get hash	malicious	Browse	172.217.168.54

ASN

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
unknown	info_cl.32083.xls	Get hash	malicious	Browse	192.168.2.255
	Pay Sheets 2.xlsx	Get hash	malicious	Browse	198.23.203.252
	Pay Sheets 2.xlsx	Get hash	malicious	Browse	198.23.203.252
	dokument11900326.hta	Get hash	malicious	Browse	203.124.113.131
	SpLW6lfIV3	Get hash	malicious	Browse	172.217.168.14
	http://www.tucows.com/thankyou.html?swid=1597673	Get hash	malicious	Browse	64.99.128.15
	Scanned-file452071.pdf.lnk	Get hash	malicious	Browse	216.58.215.225
	86soq_01[1].exe	Get hash	malicious	Browse	45.79.188.67
	Document needed.doc	Get hash	malicious	Browse	185.42.104.172
	look_attach_s0r.js	Get hash	malicious	Browse	5.101.51.91
	https://www.transfernow.net/rfcDkn032020/742afc	Get hash	malicious	Browse	104.16.251.5
	https://www.transfernow.net/rfcDkn032020/742afc	Get hash	malicious	Browse	162.216.250.35
	#Ud83d#Udcde Portvanusa.com Voice-message_4.htm	Get hash	malicious	Browse	13.224.96.127
	0.884289.js	Get hash	malicious	Browse	89.107.186.3
	Mark Shared Message.html	Get hash	malicious	Browse	148.72.248.46
	dokument9034432.hta	Get hash	malicious	Browse	203.124.113.131
	http://www.hs24st.culbco.com/aHR0cHM6Ly9ib3VjaGVmZXp0ZXIuY29tL3ZvaWNlZT9zMjRwJmVtYWlsPW1ob2hpbWVyQGZhbWlseS1pbnN0aXR1dGUub3JnJm4yNHQ=	Get hash	malicious	Browse	47.91.107.110
	zaMTU7CMVg.exe	Get hash	malicious	Browse	104.18.88.101
	https://polykaura.com/staple/8095423/8095423.zip	Get hash	malicious	Browse	127.0.0.1
	job_presentation_w5i.js	Get hash	malicious	Browse	5.101.51.91
unknown	info_cl.32083.xls	Get hash	malicious	Browse	192.168.2.255
	Pay Sheets 2.xlsx	Get hash	malicious	Browse	198.23.203.252
	Pay Sheets 2.xlsx	Get hash	malicious	Browse	198.23.203.252
	dokument11900326.hta	Get hash	malicious	Browse	203.124.113.131
	SpLW6lfIV3	Get hash	malicious	Browse	172.217.168.14
	http://www.tucows.com/thankyou.html?swid=1597673	Get hash	malicious	Browse	64.99.128.15
	Scanned-file452071.pdf.lnk	Get hash	malicious	Browse	216.58.215.225
	86soq_01[1].exe	Get hash	malicious	Browse	45.79.188.67
	Document needed.doc	Get hash	malicious	Browse	185.42.104.172
	look_attach_s0r.js	Get hash	malicious	Browse	5.101.51.91
	https://www.transfernow.net/rfcDkn032020/742afc	Get hash	malicious	Browse	104.16.251.5
	https://www.transfernow.net/rfcDkn032020/742afc	Get hash	malicious	Browse	162.216.250.35
	#Ud83d#Udcde Portvanusa.com Voice-message_4.htm	Get hash	malicious	Browse	13.224.96.127
	0.884289.js	Get hash	malicious	Browse	89.107.186.3
	Mark Shared Message.html	Get hash	malicious	Browse	148.72.248.46
	dokument9034432.hta	Get hash	malicious	Browse	203.124.113.131
	http://www.hs24st.culbco.com/aHR0cHM6Ly9ib3VjaGVmZXp0ZXIuY29tL3ZvaWNlZT9zMjRwJmVtYWlsPW1ob2hpbWVyQGZhbWlseS1pbnN0aXR1dGUub3JnJm4yNHQ=	Get hash	malicious	Browse	47.91.107.110
	zaMTU7CMVg.exe	Get hash	malicious	Browse	104.18.88.101
	https://polykaura.com/staple/8095423/8095423.zip	Get hash	malicious	Browse	127.0.0.1
	job_presentation_w5i.js	Get hash	malicious	Browse	5.101.51.91
unknown	info_cl.32083.xls	Get hash	malicious	Browse	192.168.2.255
	Pay Sheets 2.xlsx	Get hash	malicious	Browse	198.23.203.252
	Pay Sheets 2.xlsx	Get hash	malicious	Browse	198.23.203.252
	dokument11900326.hta	Get hash	malicious	Browse	203.124.113.131
	SpLW6lfIV3	Get hash	malicious	Browse	172.217.168.14
	http://www.tucows.com/thankyou.html?swid=1597673	Get hash	malicious	Browse	64.99.128.15
	Scanned-file452071.pdf.lnk	Get hash	malicious	Browse	216.58.215.225
	86soq_01[1].exe	Get hash	malicious	Browse	45.79.188.67
	Document needed.doc	Get hash	malicious	Browse	185.42.104.172
	look_attach_s0r.js	Get hash	malicious	Browse	5.101.51.91
	https://www.transfernow.net/rfcDkn032020/742afc	Get hash	malicious	Browse	104.16.251.5
	https://www.transfernow.net/rfcDkn032020/742afc	Get hash	malicious	Browse	162.216.250.35
	#Ud83d#Udcde Portvanusa.com Voice-message_4.htm	Get hash	malicious	Browse	13.224.96.127
	0.884289.js	Get hash	malicious	Browse	89.107.186.3
	Mark Shared Message.html	Get hash	malicious	Browse	148.72.248.46
	dokument9034432.hta	Get hash	malicious	Browse	203.124.113.131
	http://www.hs24st.culbco.com/aHR0cHM6Ly9ib3VjaGVmZXp0ZXIuY29tL3ZvaWNlZT9zMjRwJmVtYWlsPW1ob2hpbWVyQGZhbWlseS1pbnN0aXR1dGUub3JnJm4yNHQ=	Get hash	malicious	Browse	47.91.107.110
	zaMTU7CMVg.exe	Get hash	malicious	Browse	104.18.88.101
	https://polykaura.com/staple/8095423/8095423.zip	Get hash	malicious	Browse	127.0.0.1
	job_presentation_w5i.js	Get hash	malicious	Browse	5.101.51.91
unknown	info_cl.32083.xls	Get hash	malicious	Browse	192.168.2.255
	Pay Sheets 2.xlsx	Get hash	malicious	Browse	198.23.203.252
	Pay Sheets 2.xlsx	Get hash	malicious	Browse	198.23.203.252
	dokument11900326.hta	Get hash	malicious	Browse	203.124.113.131
	SpLW6lfIV3	Get hash	malicious	Browse	172.217.168.14
	http://www.tucows.com/thankyou.html?swid=1597673	Get hash	malicious	Browse	64.99.128.15
	Scanned-file452071.pdf.lnk	Get hash	malicious	Browse	216.58.215.225
	86soq_01[1].exe	Get hash	malicious	Browse	45.79.188.67
	Document needed.doc	Get hash	malicious	Browse	185.42.104.172
	look_attach_s0r.js	Get hash	malicious	Browse	5.101.51.91
	https://www.transfernow.net/rfcDkn032020/742afc	Get hash	malicious	Browse	104.16.251.5
	https://www.transfernow.net/rfcDkn032020/742afc	Get hash	malicious	Browse	162.216.250.35
	#Ud83d#Udcde Portvanusa.com Voice-message_4.htm	Get hash	malicious	Browse	13.224.96.127
	0.884289.js	Get hash	malicious	Browse	89.107.186.3
	Mark Shared Message.html	Get hash	malicious	Browse	148.72.248.46
	dokument9034432.hta	Get hash	malicious	Browse	203.124.113.131
	http://www.hs24st.culbco.com/aHR0cHM6Ly9ib3VjaGVmZXp0ZXIuY29tL3ZvaWNlZT9zMjRwJmVtYWlsPW1ob2hpbWVyQGZhbWlseS1pbnN0aXR1dGUub3JnJm4yNHQ=	Get hash	malicious	Browse	47.91.107.110
	zaMTU7CMVg.exe	Get hash	malicious	Browse	104.18.88.101
	https://polykaura.com/staple/8095423/8095423.zip	Get hash	malicious	Browse	127.0.0.1
	job_presentation_w5i.js	Get hash	malicious	Browse	5.101.51.91
unknown	info_cl.32083.xls	Get hash	malicious	Browse	192.168.2.255
	Pay Sheets 2.xlsx	Get hash	malicious	Browse	198.23.203.252
	Pay Sheets 2.xlsx	Get hash	malicious	Browse	198.23.203.252
	dokument11900326.hta	Get hash	malicious	Browse	203.124.113.131
	SpLW6lfIV3	Get hash	malicious	Browse	172.217.168.14
	http://www.tucows.com/thankyou.html?swid=1597673	Get hash	malicious	Browse	64.99.128.15
	Scanned-file452071.pdf.lnk	Get hash	malicious	Browse	216.58.215.225
	86soq_01[1].exe	Get hash	malicious	Browse	45.79.188.67
	Document needed.doc	Get hash	malicious	Browse	185.42.104.172
	look_attach_s0r.js	Get hash	malicious	Browse	5.101.51.91
	https://www.transfernow.net/rfcDkn032020/742afc	Get hash	malicious	Browse	104.16.251.5
	https://www.transfernow.net/rfcDkn032020/742afc	Get hash	malicious	Browse	162.216.250.35
	#Ud83d#Udcde Portvanusa.com Voice-message_4.htm	Get hash	malicious	Browse	13.224.96.127
	0.884289.js	Get hash	malicious	Browse	89.107.186.3
	Mark Shared Message.html	Get hash	malicious	Browse	148.72.248.46
	dokument9034432.hta	Get hash	malicious	Browse	203.124.113.131
	http://www.hs24st.culbco.com/aHR0cHM6Ly9ib3VjaGVmZXp0ZXIuY29tL3ZvaWNlZT9zMjRwJmVtYWlsPW1ob2hpbWVyQGZhbWlseS1pbnN0aXR1dGUub3JnJm4yNHQ=	Get hash	malicious	Browse	47.91.107.110
	zaMTU7CMVg.exe	Get hash	malicious	Browse	104.18.88.101
	https://polykaura.com/staple/8095423/8095423.zip	Get hash	malicious	Browse	127.0.0.1
	job_presentation_w5i.js	Get hash	malicious	Browse	5.101.51.91

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
9fc6ef6efc99b933c5e2d8fcf4f68955	wallpaper.apk	Get hash	malicious	Browse	104.24.101.242 172.217.22.66
	app-gexsi-release.apk	Get hash	malicious	Browse	104.24.101.242 172.217.22.66
	7Hv74xR7B6	Get hash	malicious	Browse	104.24.101.242 172.217.22.66
bc6c386f480ee97b9d9e52d472b772d8	Sidify Music Converter.exe	Get hash	malicious	Browse	216.58.206.22
	XMind-ZEN-Update-2019-for-Windows-64bit-9.2.1-201906120058.exe	Get hash	malicious	Browse	216.58.206.22
	Prezi WIN Copy of ERM Module 8.exe	Get hash	malicious	Browse	216.58.206.22
	Prezi WIN Copy of ERM Module 8.exe	Get hash	malicious	Browse	216.58.206.22
	https://lawnc.in.net/G5/?_=dawn_farrell@transalta.com	Get hash	malicious	Browse	216.58.206.22

Dropped Files

No context

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading ...

Warning!

Analysis Report covidMappia_v1.0.3.apk

Overview

General Information

Detection

Confidence

Classification Spiderchart

Mitre Att&ck Matrix

Signature Overview

AV Detection:

Privilege Escalation:

Spreading:

Networking:

Key, Mouse, Clipboard, Microphone and Screen Capturing:

E-Banking Fraud:

Spam, unwanted Advertisements and Ransom Demands:

Change of System Appearance:

System Summary:

Data Obfuscation:

Boot Survival:

Hooking and other Techniques for Hiding and Protection:

Malware Analysis System Evasion:

Anti Debugging:

HIPS / PFW / Operating System Protection Evasion:

Language, Device and Operating System Detection:

Stealing of Sensitive Information:

Malware Configuration

Signature Similarity

Similar Samples

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Domains

URLs

Yara Overview

Initial Sample

PCAP (Network Traffic)

Dropped Files

Sigma Overview

Joe Sandbox View / Context

IPs

Domains

ASN

JA3 Fingerprints

Dropped Files

Screenshots

Thumbnails