Failed to unpack this sample

[cryptax]

This malicious sample of Android/BianLian is not unpacked by BlackDex64.

sha256: 2e84fd3484fcde105c437f1c0366954f4bdee7c1d3b334e2daa366a6592e4432
(beware, the sample is malicious).

APKiD says it is packed with DexProtector, but I think it's another packer.

# apkid 2e84fd3484fcde105c437f1c0366954f4bdee7c1d3b334e2daa366a6592e4432.apk 
[+] APKiD 2.1.5 :: from RedNaga :: rednaga.io
[*] 2e84fd3484fcde105c437f1c0366954f4bdee7c1d3b334e2daa366a6592e4432.apk
 |-> packer : DexProtector
[*] 2e84fd3484fcde105c437f1c0366954f4bdee7c1d3b334e2daa366a6592e4432.apk!classes.dex
 |-> anti_vm : possible Build.SERIAL check, possible VM check
 |-> compiler : dexlib 2.x

You can unpack quite easily with a Frida script that prevents file deletion. The unpacked payload will be in /storage/emulated/0/Android/obb/com.grand.snail/dp/dp-a.a. Or Medusa with file_system/prevent_delete module.

My environment:

• Android emulator 13
• BlackDex64 v3.2.0

[Maherfatiq23]

98503436