Analysis Report D6pnpvG2z7

Overview

General Information

Joe Sandbox Version:	23.0.0
Analysis ID:	60798
Start date:	21.09.2018
Start time:	21:18:46
Joe Sandbox Product:	Cloud
Overall analysis duration:	0h 4m 31s
Hypervisor based Inspection enabled:	false
Report type:	full
Sample file name:	D6pnpvG2z7
Cookbook file name:	defaultandroidfilecookbook.jbs
Analysis system description:	Android 5.1 Native (Motorola Moto G 3rd Generation)
Detection:	MAL
Classification:	mal88.troj.evad.mine.and@0/251@5/0
Warnings:	Show All No interacted views Not all executed log events are in report (maximum 10 identical API calls) Report size exceeded maximum capacity and may have missing dynamic data code.

Detection

Strategy	Score	Range	Reporting	Detection
Threshold	88	0 - 100	Report FP / FN

Classification

Signature Overview

Click to jump to signature section

AV Detection:

Antivirus detection for submitted file

Show sources

Source: D6pnpvG2z7	Avira: Label: PUA/CoinMiner.zuzcl
Source: D6pnpvG2z7	Avira: Label: PUA/CoinMiner.jinae
Source: D6pnpvG2z7	Avira: Label: ANDROID/CoinMiner.FNA.Gen

Multi AV Scanner detection for submitted file

Show sources

Source: D6pnpvG2z7

virustotal: Detection: 56%

Perma Link

Privilege Escalation:

Checks if the device administrator is active

Show sources

Source: com.android.sesupdate.services.FirstService;->spamDeviceAdmin:30	API Call: android.app.admin.DevicePolicyManager.isAdminActive
Source: com.android.sesupdate.receivers.DeviceAdmin$1;->run:7	API Call: android.app.admin.DevicePolicyManager.isAdminActive

Tries to add a new device administrator

Show sources

Source: com.android.sesupdate.MainActivity;->requestDeviceAdmin:12

API Call: android.content.Intent.<init> android.app.action.ADD_DEVICE_ADMIN

Requests root access

Show sources

Source: Lio/fabric/sdk/android/services/common/CommonUtils;->getDeviceState(Landroid/content/Context;)I	Method string: "/system/xbin/su"
Source: Lio/fabric/sdk/android/services/common/CommonUtils;->isRooted(Landroid/content/Context;)Z	Method string: "/system/xbin/su"
Source: Lcom/crashlytics/android/core/CrashlyticsController;->writeSessionOS(Ljava/lang/String;)V	Method string: "/system/xbin/su"

Bitcoin Miner:

Found strings related to Crypto-Mining

Show sources

Source: libcpuminer.so	String found in binary or memory: stratum+tcp://
Source: libcpuminer.so	String found in binary or memory: scanhash_cryptonight
Source: libcpuminer.so	String found in binary or memory: stratum+tcp://

Spreading:

Accesses external storage location

Show sources

Source: io.fabric.sdk.android.services.persistence.FileStoreImpl;->getExternalCacheDir:21	API Call: android.os.Environment.getExternalStorageDirectory
Source: io.fabric.sdk.android.services.persistence.FileStoreImpl;->getExternalFilesDir:35	API Call: android.os.Environment.getExternalStorageDirectory
Source: io.fabric.sdk.android.services.persistence.FileStoreImpl;->isExternalStorageAvailable:48	API Call: android.os.Environment.getExternalStorageState

Networking:

Detected TCP or UDP traffic on non-standard ports

Show sources

Source: global traffic

TCP traffic: 192.34.76.230:54171 -> 45.125.194.34:3333

Checks an internet connection is available

Show sources

Source: io.fabric.sdk.android.services.common.CommonUtils;->canTryConnection:15	API Call: android.net.ConnectivityManager.getActiveNetworkInfo
Source: io.fabric.sdk.android.services.common.CommonUtils;->canTryConnection:16	API Call: android.net.NetworkInfo.isConnectedOrConnecting

Connects to IPs without corresponding DNS lookups

Show sources

Source: unknown	UDP traffic detected without corresponding DNS query: 192.34.76.230
Source: unknown	UDP traffic detected without corresponding DNS query: 192.34.76.230
Source: unknown	TCP traffic detected without corresponding DNS query: 192.34.76.230
Source: unknown	TCP traffic detected without corresponding DNS query: 192.34.76.230
Source: unknown	TCP traffic detected without corresponding DNS query: 192.34.76.230
Source: unknown	TCP traffic detected without corresponding DNS query: 192.34.76.230
Source: unknown	TCP traffic detected without corresponding DNS query: 192.34.76.230
Source: unknown	TCP traffic detected without corresponding DNS query: 192.34.76.230
Source: unknown	TCP traffic detected without corresponding DNS query: 192.34.76.230
Source: unknown	TCP traffic detected without corresponding DNS query: 192.34.76.230
Source: unknown	TCP traffic detected without corresponding DNS query: 192.34.76.230
Source: unknown	TCP traffic detected without corresponding DNS query: 192.34.76.230
Source: unknown	TCP traffic detected without corresponding DNS query: 192.34.76.230
Source: unknown	TCP traffic detected without corresponding DNS query: 192.34.76.230
Source: unknown	TCP traffic detected without corresponding DNS query: 192.34.76.230
Source: unknown	TCP traffic detected without corresponding DNS query: 192.34.76.230
Source: unknown	TCP traffic detected without corresponding DNS query: 192.34.76.230
Source: unknown	TCP traffic detected without corresponding DNS query: 192.34.76.230
Source: unknown	TCP traffic detected without corresponding DNS query: 192.34.76.230
Source: unknown	TCP traffic detected without corresponding DNS query: 192.34.76.230
Source: unknown	TCP traffic detected without corresponding DNS query: 192.34.76.230
Source: unknown	TCP traffic detected without corresponding DNS query: 192.34.76.230
Source: unknown	TCP traffic detected without corresponding DNS query: 192.34.76.230
Source: unknown	TCP traffic detected without corresponding DNS query: 192.34.76.230
Source: unknown	TCP traffic detected without corresponding DNS query: 192.34.76.230
Source: unknown	TCP traffic detected without corresponding DNS query: 192.34.76.230
Source: unknown	TCP traffic detected without corresponding DNS query: 192.34.76.230
Source: unknown	TCP traffic detected without corresponding DNS query: 192.34.76.230
Source: unknown	UDP traffic detected without corresponding DNS query: 192.34.76.230
Source: unknown	UDP traffic detected without corresponding DNS query: 192.34.76.230
Source: unknown	UDP traffic detected without corresponding DNS query: 192.34.76.230
Source: unknown	TCP traffic detected without corresponding DNS query: 192.34.76.230
Source: unknown	TCP traffic detected without corresponding DNS query: 192.34.76.230
Source: unknown	TCP traffic detected without corresponding DNS query: 192.34.76.230
Source: unknown	TCP traffic detected without corresponding DNS query: 192.34.76.230
Source: unknown	TCP traffic detected without corresponding DNS query: 192.34.76.230
Source: unknown	TCP traffic detected without corresponding DNS query: 192.34.76.230
Source: unknown	TCP traffic detected without corresponding DNS query: 192.34.76.230
Source: unknown	TCP traffic detected without corresponding DNS query: 192.34.76.230
Source: unknown	TCP traffic detected without corresponding DNS query: 192.34.76.230
Source: unknown	TCP traffic detected without corresponding DNS query: 192.34.76.230
Source: unknown	TCP traffic detected without corresponding DNS query: 192.34.76.230
Source: unknown	TCP traffic detected without corresponding DNS query: 192.34.76.230
Source: unknown	TCP traffic detected without corresponding DNS query: 192.34.76.230
Source: unknown	TCP traffic detected without corresponding DNS query: 192.34.76.230
Source: unknown	TCP traffic detected without corresponding DNS query: 192.34.76.230
Source: unknown	TCP traffic detected without corresponding DNS query: 192.34.76.230
Source: unknown	TCP traffic detected without corresponding DNS query: 192.34.76.230
Source: unknown	TCP traffic detected without corresponding DNS query: 192.34.76.230
Source: unknown	TCP traffic detected without corresponding DNS query: 192.34.76.230

Opens an internet connection

Show sources

Source: io.fabric.sdk.android.services.network.HttpRequest$ConnectionFactory$1;->create:2	API Call: java.net.URL.openConnection("https://settings.crashlytics.com/spi/v2/platforms/android/apps/com.android.sesupdate/settings?icon_hash=2e2f12c9caf18e6c264f29a759e5477fa62a7720&display_version=3.0&source=4&instance=a70c5b872411d0a0d40da8f7f831148fe10d2556&build_version=3")
Source: io.fabric.sdk.android.services.network.HttpRequest$ConnectionFactory$1;->create:2	API Call: java.net.URL.openConnection("https://e.crashlytics.com/spi/v2/events")
Source: com.android.sesupdate.ApkUtils$sendTask;->doInBackground:9	API Call: java.net.URL.openConnection (not executed)
Source: io.fabric.sdk.android.services.network.HttpRequest$ConnectionFactory$1;->create:3	API Call: java.net.URL.openConnection (not executed)

Found strings which match to known social media urls

Show sources

Source: io.fabric.sdk.android.fabric.properties

Performs DNS lookups

Show sources

Source: unknown

DNS traffic detected: queries for: www.google.ch

Urls found in memory or binary data

Show sources

Source: libcurl.so	String found in binary or memory: http://curl.haxx.se/docs/http-cookies.html
Source: classes.dex, android	String found in binary or memory: http://debujxe.com/click.php?cnv_id=
Source: activity_main.xml	String found in binary or memory: http://schemas.android.com/apk/res/android
Source: io.fabric.sdk.android.fabric.properties	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: android	String found in binary or memory: https://api.crashlytics.com/spi/v1/platforms/android/apps/com.android.sesupdate
Source: android	String found in binary or memory: https://e.crashlytics.com/spi/v2/events
Source: classes.dex	String found in binary or memory: https://e.crashlytics.com/spi/v2/eventsJhttps://settings.crashlytics.com/spi/v2/platforms/android/ap
Source: classes.dex, android	String found in binary or memory: https://fabric.io/sign_up
Source: android	String found in binary or memory: https://reports.crashlytics.com/sdk-api/v1/platforms/android/apps/com.android.sesupdate/minidumps
Source: android	String found in binary or memory: https://reports.crashlytics.com/spi/v1/platforms/android/apps/com.android.sesupdate/reports
Source: classes.dex, android	String found in binary or memory: https://settings.crashlytics.com/spi/v2/platforms/android/apps/%s/settings
Source: android	String found in binary or memory: https://settings.crashlytics.com/spi/v2/platforms/android/apps/com.android.sesupdate/settings
Source: android	String found in binary or memory: https://settings.crashlytics.com/spi/v2/platforms/android/apps/com.android.sesupdate/settings?icon_h

Uses HTTP for connecting to the internet

Show sources

Source: com.android.sesupdate.ApkUtils$sendTask;->doInBackground:15

API Call: java.net.HttpURLConnection.connect

Uses HTTPS

Show sources

Source: unknown	Network traffic detected: HTTP traffic on port 49650 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49651 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49651
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49650
Source: unknown	Network traffic detected: HTTP traffic on port 44125 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54603
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 44125
Source: unknown	Network traffic detected: HTTP traffic on port 54603 -> 443

Operating System Destruction:

Lists and deletes files in the same context

Show sources

Source: com.crashlytics.android.core.CrashlyticsController;->recursiveDelete:298	API Calls in same method context: File.listFiles,File.delete
Source: com.crashlytics.android.core.LogFileManager;->discardOldLogFiles:29	API Calls in same method context: File.listFiles,File.delete
Source: com.crashlytics.android.core.Utils;->capFileCount:7	API Calls in same method context: File.listFiles,File.delete

Change of System Appearance:

Acquires a wake lock

Show sources

Source: com.android.sesupdate.services.FirstService;->startWakeLock:54

API Call: android.os.PowerManager$WakeLock.acquire

System Summary:

APK is signed by a suspicious certificate

Show sources

Source: APK Certificate

APK Parser: C=US,O=Android,CN=Android Debug C=US,O=Android,CN=Android Debug

Executes native commands

Show sources

Source: com.android.sesupdate.DeviceUtil;->checkForNeon:6

API Call: java.lang.ProcessBuilder.start

Requests potentially dangerous permissions

Show sources

Source: submitted apk	Request permission: android.permission.INTERNET
Source: submitted apk	Request permission: android.permission.READ_PHONE_STATE
Source: submitted apk	Request permission: android.permission.WAKE_LOCK
Source: submitted apk	Request permission: android.permission.WRITE_EXTERNAL_STORAGE

Classification label

Show sources

Source: classification engine

Classification label: mal88.troj.evad.mine.and@0/251@5/0

Loads native libraries

Show sources

Source: com.kangaderoo.neoneonminer.MyNeoNeonMinerGlobals;-><init>:3	API Call: java.lang.System.loadLibrary ("curl")
Source: com.kangaderoo.neoneonminer.MyNeoNeonMinerGlobals;-><init>:5	API Call: java.lang.System.loadLibrary ("gmp")
Source: com.kangaderoo.neoneonminer.MyNeoNeonMinerGlobals;-><init>:7	API Call: java.lang.System.loadLibrary ("cpuminer")

Reads shares settings

Show sources

Source: io.fabric.sdk.android.services.common.AdvertisingInfoProvider;->getInfoFromPreferences:61	API Call: "advertising_id":
Source: io.fabric.sdk.android.services.common.IdManager;->getAppInstallIdentifier:115	API Call: "crashlytics.installation.id": null
Source: io.fabric.sdk.android.services.common.IdManager;->createInstallationUUID:44	API Call: "crashlytics.installation.id": null
Source: io.fabric.sdk.android.services.common.IdManager;->getAppInstallIdentifier:115	API Call: "crashlytics.installation.id": 727b1e1c99ed48bfa431dd3ed82456db
Source: io.fabric.sdk.android.services.settings.DefaultSettingsController;->getStoredBuildInstanceIdentifier:57	API Call: "existing_instance_identifier":
Source: com.crashlytics.android.answers.AnswersPreferenceManager;->hasAnalyticsLaunched:8	API Call: android.content.SharedPreferences.getBoolean
Source: io.fabric.sdk.android.services.common.AdvertisingInfoProvider;->getInfoFromPreferences:65	API Call: android.content.SharedPreferences.getBoolean
Source: io.fabric.sdk.android.services.common.IdManager;->flushInstallationIdIfNecessary:64	API Call: android.content.SharedPreferences.getString
Source: com.crashlytics.android.core.PreferenceManager;->create:4	API Call: android.content.SharedPreferences.getBoolean
Source: com.crashlytics.android.core.PreferenceManager;->create:14	API Call: android.content.SharedPreferences.getBoolean
Source: com.crashlytics.android.core.PreferenceManager;->shouldAlwaysSendReports:33	API Call: android.content.SharedPreferences.getBoolean
Source: io.fabric.sdk.android.services.persistence.PreferenceStoreStrategy;->restore:11	API Call: android.content.SharedPreferences.getString

Data Obfuscation:

Uses reflection

Show sources

Source: com.crashlytics.android.answers.AppMeasurementEventLogger;->getInstance:11	API Call: java.lang.reflect.Method.invoke
Source: com.crashlytics.android.answers.AppMeasurementEventLogger;->logEvent:18	API Call: java.lang.reflect.Method.invoke
Source: io.fabric.sdk.android.services.common.AdvertisingInfoReflectionStrategy;->getAdvertisingId:8	API Call: java.lang.reflect.Method.invoke
Source: io.fabric.sdk.android.services.common.AdvertisingInfoReflectionStrategy;->getInfo:18	API Call: java.lang.reflect.Method.invoke
Source: io.fabric.sdk.android.services.common.AdvertisingInfoReflectionStrategy;->isLimitAdTrackingEnabled:28	API Call: java.lang.reflect.Method.invoke
Source: io.fabric.sdk.android.services.common.AdvertisingInfoReflectionStrategy;->isGooglePlayServiceAvailable:43	API Call: java.lang.reflect.Method.invoke

Persistence and Installation Behavior:

Creates files

Show sources

Source: io.fabric.sdk.android.services.settings.DefaultSettingsController;->loadSettingsData:70	API Call: java.io.FileWriter.<init>
Source: io.fabric.sdk.android.services.settings.DefaultCachedSettingsIo;->writeCachedSettings:40	API Call: java.io.FileWriter.<init>

Boot Survival:

Has permission to execute code after phone reboot

Show sources

Source: submitted apk

Request permission: android.permission.RECEIVE_BOOT_COMPLETED

Installs a new wake lock (to get activate on phone screen on)

Show sources

Source: com.android.sesupdate.services.FirstService;->startWakeLock:52

API Call: android.os.PowerManager.newWakeLock

Starts/registers a service/receiver on phone boot (autostart)

Show sources

Source: com.android.sesupdate.receivers.BootReceiver;->onReceive:3

API Call: android.content.Context.startService (not executed)

Hooking and other Techniques for Hiding and Protection:

Queries list of running processes/tasks

Show sources

Source: io.fabric.sdk.android.services.common.CommonUtils;->getAppProcessInfo:100

API Call: android.app.ActivityManager.getRunningAppProcesses

Queries package code path (often used for patching other applications)

Show sources

Source: io.fabric.sdk.android.Fabric;->getKitsFinderFuture:89

API Call: android.content.Context.getPackageCodePath

Removes its application launcher (likely to stay hidden)

Show sources

Source: com.android.sesupdate.receivers.DeviceAdmin;->hideAppIcon:4

API Call: android.content.pm.PackageManager.setComponentEnabledSetting

Uses Crypto APIs

Show sources

Source: io.fabric.sdk.android.services.common.CommonUtils;->hash:183	API Call: java.security.MessageDigest.getInstance
Source: io.fabric.sdk.android.services.common.CommonUtils;->hash:185	API Call: java.security.MessageDigest.update
Source: io.fabric.sdk.android.services.common.CommonUtils;->sha1:301	API Call: java.security.MessageDigest.digest
Source: io.fabric.sdk.android.services.common.CommonUtils;->hash:185	API Call: java.security.MessageDigest.update
Source: io.fabric.sdk.android.services.common.CommonUtils;->sha1:301	API Call: java.security.MessageDigest.digest
Source: io.fabric.sdk.android.services.common.CommonUtils;->hash:195	API Call: java.security.MessageDigest.getInstance
Source: io.fabric.sdk.android.services.common.CommonUtils;->hash:196	API Call: java.security.MessageDigest.update
Source: io.fabric.sdk.android.services.common.CommonUtils;->hash:194	API Call: java.security.MessageDigest.digest
Source: io.fabric.sdk.android.services.common.CommonUtils;->hash:196	API Call: java.security.MessageDigest.update
Source: io.fabric.sdk.android.services.common.CommonUtils;->hash:194	API Call: java.security.MessageDigest.digest
Source: io.fabric.sdk.android.services.common.CommonUtils;->hash:196	API Call: java.security.MessageDigest.update
Source: io.fabric.sdk.android.services.common.CommonUtils;->hash:194	API Call: java.security.MessageDigest.digest
Source: io.fabric.sdk.android.services.common.CommonUtils;->hash:196	API Call: java.security.MessageDigest.update
Source: io.fabric.sdk.android.services.common.CommonUtils;->hash:194	API Call: java.security.MessageDigest.digest
Source: io.fabric.sdk.android.services.common.CommonUtils;->hash:191	API Call: java.security.MessageDigest.digest
Source: io.fabric.sdk.android.services.common.CommonUtils;->hash:197	API Call: java.security.MessageDigest.digest
Source: io.fabric.sdk.android.services.network.PinningTrustManager;->isValidPin:46	API Call: java.security.MessageDigest.getInstance
Source: io.fabric.sdk.android.services.network.PinningTrustManager;->isValidPin:49	API Call: java.security.MessageDigest.digest

Malware Analysis System Evasion:

Tries to detect Android x86

Show sources

Source: Lcom/android/sesupdate/DeviceUtil;->isEmulator()Z

Method string: "Android SDK built for x86"

Tries to detect the analysis device (e.g. the Android emulator)

Show sources

Source: Lcom/android/sesupdate/DeviceUtil;->isEmulator()Z

Method string: "Emulator"

Accesses /proc

Show sources

Source: Lio/fabric/sdk/android/services/common/CommonUtils;->getTotalRamInBytes()J

Method string: "/proc/meminfo"

Accesses android OS build fields

Show sources

Source: io.fabric.sdk.android.services.settings.Settings;->initialize:34	Field Access: android.os.Build.MANUFACTURER
Source: io.fabric.sdk.android.services.settings.Settings;->initialize:34	Field Access: android.os.Build.MODEL
Source: com.android.sesupdate.MainApplication;->onCreate:5	Field Access: android.os.Build.FINGERPRINT
Source: com.android.sesupdate.MainApplication;->onCreate:5	Field Access: android.os.Build.MODEL
Source: com.android.sesupdate.MainApplication;->onCreate:5	Field Access: android.os.Build.MANUFACTURER
Source: com.android.sesupdate.MainApplication;->onCreate:5	Field Access: android.os.Build.BRAND
Source: com.android.sesupdate.MainApplication;->onCreate:5	Field Access: android.os.Build.PRODUCT
Source: com.android.sesupdate.MainActivity;->onCreate:6	Field Access: android.os.Build.FINGERPRINT
Source: com.android.sesupdate.MainActivity;->onCreate:6	Field Access: android.os.Build.MODEL
Source: com.android.sesupdate.MainActivity;->onCreate:6	Field Access: android.os.Build.MANUFACTURER
Source: com.android.sesupdate.MainActivity;->onCreate:6	Field Access: android.os.Build.BRAND
Source: com.android.sesupdate.MainActivity;->onCreate:6	Field Access: android.os.Build.PRODUCT
Source: com.crashlytics.android.answers.SessionMetadataCollector;->getMetadata:21	Field Access: android.os.Build.MANUFACTURER
Source: com.crashlytics.android.answers.SessionMetadataCollector;->getMetadata:21	Field Access: android.os.Build.MODEL
Source: com.kangaderoo.neoneonminer.MyNeoNeonMinerGlobals;->start:14	Field Access: android.os.Build.MANUFACTURER
Source: io.fabric.sdk.android.services.common.CommonUtils;->isRooted:236	Field Access: android.os.Build.PRODUCT
Source: com.crashlytics.android.core.CrashlyticsController;->writeSessionOS:636	Field Access: android.os.Build.TAGS
Source: io.fabric.sdk.android.services.common.CommonUtils;->getCpuArchitectureInt:125	Field Access: android.os.Build.CPU_ABI
Source: com.crashlytics.android.core.CrashlyticsController;->writeSessionDevice:579	Field Access: android.os.Build.PRODUCT
Source: io.fabric.sdk.android.services.common.CommonUtils;->getDeviceState:127	Field Access: android.os.Build.PRODUCT
Source: io.fabric.sdk.android.services.common.CommonUtils;->getDeviceState:128	Field Access: android.os.Build.TAGS
Source: com.crashlytics.android.core.CrashlyticsController$24;->writeTo:2	Field Access: android.os.Build.MODEL
Source: com.crashlytics.android.core.CrashlyticsController$24;->writeTo:2	Field Access: android.os.Build.MANUFACTURER
Source: com.android.sesupdate.DeviceUtil;->isEmulator:36	Field Access: android.os.Build.FINGERPRINT
Source: com.android.sesupdate.DeviceUtil;->isEmulator:39	Field Access: android.os.Build.FINGERPRINT
Source: com.android.sesupdate.DeviceUtil;->isEmulator:42	Field Access: android.os.Build.MODEL
Source: com.android.sesupdate.DeviceUtil;->isEmulator:45	Field Access: android.os.Build.MODEL
Source: com.android.sesupdate.DeviceUtil;->isEmulator:48	Field Access: android.os.Build.MODEL
Source: com.android.sesupdate.DeviceUtil;->isEmulator:51	Field Access: android.os.Build.MANUFACTURER
Source: com.android.sesupdate.DeviceUtil;->isEmulator:54	Field Access: android.os.Build.BRAND
Source: com.android.sesupdate.DeviceUtil;->isEmulator:57	Field Access: android.os.Build.DEVICE
Source: com.android.sesupdate.DeviceUtil;->isEmulator:61	Field Access: android.os.Build.PRODUCT
Source: io.fabric.sdk.android.services.common.CommonUtils$Architecture;->getValue:49	Field Access: android.os.Build.CPU_ABI
Source: io.fabric.sdk.android.services.common.CommonUtils;->isEmulator:230	Field Access: android.os.Build.PRODUCT
Source: io.fabric.sdk.android.services.common.CommonUtils;->isEmulator:233	Field Access: android.os.Build.PRODUCT
Source: io.fabric.sdk.android.services.common.CommonUtils;->isRooted:237	Field Access: android.os.Build.TAGS
Source: io.fabric.sdk.android.services.common.IdManager;->getModelName:143	Field Access: android.os.Build.MANUFACTURER
Source: io.fabric.sdk.android.services.common.IdManager;->getModelName:145	Field Access: android.os.Build.MODEL
Source: io.fabric.sdk.android.services.common.IdManager;->getOsDisplayVersionString:150	Field Access: android.os.Build$VERSION.RELEASE
Source: com.crashlytics.android.core.CrashlyticsController$21;->writeTo:2	Field Access: android.os.Build$VERSION.RELEASE
Source: com.crashlytics.android.core.CrashlyticsController$22$1;-><init>:3	Field Access: android.os.Build$VERSION.RELEASE
Source: com.crashlytics.android.core.CrashlyticsController$23;->writeTo:2	Field Access: android.os.Build.MODEL
Source: com.crashlytics.android.core.CrashlyticsController$23;->writeTo:4	Field Access: android.os.Build.MANUFACTURER
Source: com.crashlytics.android.core.CrashlyticsController$23;->writeTo:5	Field Access: android.os.Build.PRODUCT
Source: com.crashlytics.android.core.CrashlyticsController$24$1;-><init>:7	Field Access: android.os.Build.MODEL
Source: com.crashlytics.android.core.CrashlyticsController$24$1;-><init>:34	Field Access: android.os.Build.MANUFACTURER
Source: com.crashlytics.android.core.CrashlyticsController$24$1;-><init>:37	Field Access: android.os.Build.PRODUCT

Checks CPU details

Show sources

Source: Lcom/android/sesupdate/DeviceUtil;->getNumCoresOldPhones()I

Method string: "/sys/devices/system/cpu/"

Queries several sensitive phone informations

Show sources

Source: Lio/fabric/sdk/android/services/settings/AbstractAppSpiCall;->applyHeadersTo(Lio/fabric/sdk/android/services/network/HttpRequest;Lio/fabric/sdk/android/services/settings/AppRequestData;)Lio/fabric/sdk/android/services/network/HttpRequest;	Method string: "android"
Source: Lcom/crashlytics/android/answers/SessionEventTransform;->buildJsonForEvent(Lcom/crashlytics/android/answers/SessionEvent;)Lorg/json/JSONObject;	Method string: "type"
Source: Lcom/crashlytics/android/core/CrashlyticsController$22$1;-><init>(Lcom/crashlytics/android/core/CrashlyticsController$22;)V	Method string: "version"
Source: Lio/fabric/sdk/android/services/common/CommonUtils;->isEmulator(Landroid/content/Context;)Z	Method string: "sdk"

Queries the unique operating system id (ANDROID_ID)

Show sources

Source: io.fabric.sdk.android.services.common.IdManager;->getAndroidId:105	API Call: android.provider.Settings.Secure.getString
Source: io.fabric.sdk.android.services.common.CommonUtils;->isEmulator:228	API Call: android.provider.Settings.Secure.getString

Tries to query CPU info

Show sources

Source: com.android.sesupdate.DeviceUtil;->checkForNeon:6

API Call: java.lang.ProcessBuilder.start

Anti Debugging:

Checks if debugger is running

Show sources

Source: io.fabric.sdk.android.services.common.CommonUtils;->isDebuggerAttached:224

API Call: android.os.Debug.isDebuggerConnected

Language, Device and Operating System Detection:

Checks if phone is rooted (checks for Superuser.apk)

Show sources

Source: com.crashlytics.android.core.CrashlyticsController;->writeSessionOS:636	API Call: java.io.File.<init>("/system/app/Superuser.apk")
Source: io.fabric.sdk.android.services.common.CommonUtils;->getDeviceState:128	API Call: java.io.File.<init>("/system/app/Superuser.apk")
Source: io.fabric.sdk.android.services.common.CommonUtils;->isRooted:241	API Call: java.io.File.<init>("/system/app/Superuser.apk")

Checks if phone is rooted (checks for test-keys build tags)

Show sources

Source: io.fabric.sdk.android.services.common.CommonUtils;->isRooted:239

API Call: java.lang.String.contains("test-keys")

Stealing of Sensitive Information:

Has permission to read the phones state (phone number, device IDs, active call ect.)

Show sources

Source: submitted apk

Request permission: android.permission.READ_PHONE_STATE

Antivirus Detection

Initial Sample

Source	Detection	Scanner	Label	Link
D6pnpvG2z7	57%	virustotal		Browse
D6pnpvG2z7	100%	Avira	PUA/CoinMiner.zuzcl
D6pnpvG2z7	100%	Avira	PUA/CoinMiner.jinae
D6pnpvG2z7	100%	Avira	ANDROID/CoinMiner.FNA.Gen

Dropped Files

No Antivirus matches

Domains

No Antivirus matches

URLs

Source	Detection	Scanner	Label	Link
http://debujxe.com/click.php?cnv_id=	1%	virustotal		Browse

Yara Overview

Initial Sample

No yara matches

PCAP (Network Traffic)

No yara matches

Dropped Files

No yara matches

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading ...

Warning!

Analysis Report D6pnpvG2z7

Overview

General Information

Detection

Classification

Signature Overview

AV Detection:

Privilege Escalation:

Bitcoin Miner:

Spreading:

Networking:

Operating System Destruction:

Change of System Appearance:

System Summary:

Data Obfuscation:

Persistence and Installation Behavior:

Boot Survival:

Hooking and other Techniques for Hiding and Protection:

Malware Analysis System Evasion:

Anti Debugging:

Language, Device and Operating System Detection:

Stealing of Sensitive Information:

Antivirus Detection

Initial Sample

Dropped Files

Domains

URLs

Yara Overview

Initial Sample

PCAP (Network Traffic)

Dropped Files

Screenshots

Thumbnails