Analysis
-
max time kernel
285073s -
max time network
126s -
platform
android_x64 -
resource
android-x64 -
submitted
04-08-2021 11:45
Static task
static1
Behavioral task
behavioral1
Sample
fc6a458c907d921b376f36c461e22d90ca3a61e35c87b70c84043cb632bdd5c6.apk
Resource
android-x64
General
-
Target
fc6a458c907d921b376f36c461e22d90ca3a61e35c87b70c84043cb632bdd5c6.apk
-
Size
3.3MB
-
MD5
033d72e8cb52a46e7c24a4840ddaec47
-
SHA1
caf416e31345f606c8cd7fe6293328c7ce3fe14a
-
SHA256
fc6a458c907d921b376f36c461e22d90ca3a61e35c87b70c84043cb632bdd5c6
-
SHA512
b55a414aba8470427e2ac1611f77a32a251ac8abd67e99be4f8e40d7a3c12396304cc00d977f58ceeb4d73ff6c9cba9c29129ee978dbb7ede58189ec60d8e77f
Malware Config
Signatures
-
Loads dropped Dex/Jar 1 IoCs
Runs executable file dropped to the device during analysis.
Processes:
com.tencent.mobileqqioc pid process /data/user/0/com.tencent.mobileqq/code_cache/secondary-dexes/base.apk.classes1.zip 3591 com.tencent.mobileqq -
Requests enabling of the accessibility settings. 1 IoCs
Processes:
com.tencent.mobileqqdescription ioc process Intent action android.settings.ACCESSIBILITY_SETTINGS com.tencent.mobileqq -
Reads name of network operator 1 IoCs
Uses Android APIs to discover system information.
Processes:
com.tencent.mobileqqdescription ioc process Framework API call android.telephony.TelephonyManager.getNetworkOperatorName com.tencent.mobileqq -
Uses Crypto APIs (Might try to encrypt user data). 1 IoCs
Processes:
com.tencent.mobileqqdescription ioc process Framework API call javax.crypto.Cipher.doFinal com.tencent.mobileqq -
Uses reflection 64 IoCs
Processes:
com.tencent.mobileqqdescription pid process Invokes method android.view.ViewGroup.makeOptionalFitsSystemWindows 3591 com.tencent.mobileqq Acesses field com.android.okhttp.internal.tls.OkHostnameVerifier.INSTANCE 3591 com.tencent.mobileqq Acesses field javax.security.auth.x500.X500Principal.thisX500Name 3591 com.tencent.mobileqq Acesses field javax.security.auth.x500.X500Principal.thisX500Name 3591 com.tencent.mobileqq Acesses field javax.security.auth.x500.X500Principal.thisX500Name 3591 com.tencent.mobileqq Acesses field javax.security.auth.x500.X500Principal.thisX500Name 3591 com.tencent.mobileqq Acesses field javax.security.auth.x500.X500Principal.thisX500Name 3591 com.tencent.mobileqq Acesses field javax.security.auth.x500.X500Principal.thisX500Name 3591 com.tencent.mobileqq Acesses field javax.security.auth.x500.X500Principal.thisX500Name 3591 com.tencent.mobileqq Acesses field javax.security.auth.x500.X500Principal.thisX500Name 3591 com.tencent.mobileqq Acesses field javax.security.auth.x500.X500Principal.thisX500Name 3591 com.tencent.mobileqq Acesses field javax.security.auth.x500.X500Principal.thisX500Name 3591 com.tencent.mobileqq Acesses field javax.security.auth.x500.X500Principal.thisX500Name 3591 com.tencent.mobileqq Acesses field javax.security.auth.x500.X500Principal.thisX500Name 3591 com.tencent.mobileqq Acesses field javax.security.auth.x500.X500Principal.thisX500Name 3591 com.tencent.mobileqq Acesses field javax.security.auth.x500.X500Principal.thisX500Name 3591 com.tencent.mobileqq Acesses field javax.security.auth.x500.X500Principal.thisX500Name 3591 com.tencent.mobileqq Acesses field javax.security.auth.x500.X500Principal.thisX500Name 3591 com.tencent.mobileqq Acesses field javax.security.auth.x500.X500Principal.thisX500Name 3591 com.tencent.mobileqq Acesses field javax.security.auth.x500.X500Principal.thisX500Name 3591 com.tencent.mobileqq Acesses field javax.security.auth.x500.X500Principal.thisX500Name 3591 com.tencent.mobileqq Acesses field javax.security.auth.x500.X500Principal.thisX500Name 3591 com.tencent.mobileqq Acesses field javax.security.auth.x500.X500Principal.thisX500Name 3591 com.tencent.mobileqq Acesses field javax.security.auth.x500.X500Principal.thisX500Name 3591 com.tencent.mobileqq Acesses field javax.security.auth.x500.X500Principal.thisX500Name 3591 com.tencent.mobileqq Acesses field javax.security.auth.x500.X500Principal.thisX500Name 3591 com.tencent.mobileqq Acesses field javax.security.auth.x500.X500Principal.thisX500Name 3591 com.tencent.mobileqq Acesses field javax.security.auth.x500.X500Principal.thisX500Name 3591 com.tencent.mobileqq Acesses field javax.security.auth.x500.X500Principal.thisX500Name 3591 com.tencent.mobileqq Acesses field javax.security.auth.x500.X500Principal.thisX500Name 3591 com.tencent.mobileqq Acesses field javax.security.auth.x500.X500Principal.thisX500Name 3591 com.tencent.mobileqq Acesses field javax.security.auth.x500.X500Principal.thisX500Name 3591 com.tencent.mobileqq Acesses field javax.security.auth.x500.X500Principal.thisX500Name 3591 com.tencent.mobileqq Acesses field javax.security.auth.x500.X500Principal.thisX500Name 3591 com.tencent.mobileqq Acesses field javax.security.auth.x500.X500Principal.thisX500Name 3591 com.tencent.mobileqq Acesses field javax.security.auth.x500.X500Principal.thisX500Name 3591 com.tencent.mobileqq Acesses field javax.security.auth.x500.X500Principal.thisX500Name 3591 com.tencent.mobileqq Acesses field javax.security.auth.x500.X500Principal.thisX500Name 3591 com.tencent.mobileqq Acesses field javax.security.auth.x500.X500Principal.thisX500Name 3591 com.tencent.mobileqq Acesses field javax.security.auth.x500.X500Principal.thisX500Name 3591 com.tencent.mobileqq Acesses field javax.security.auth.x500.X500Principal.thisX500Name 3591 com.tencent.mobileqq Acesses field javax.security.auth.x500.X500Principal.thisX500Name 3591 com.tencent.mobileqq Acesses field javax.security.auth.x500.X500Principal.thisX500Name 3591 com.tencent.mobileqq Acesses field javax.security.auth.x500.X500Principal.thisX500Name 3591 com.tencent.mobileqq Acesses field javax.security.auth.x500.X500Principal.thisX500Name 3591 com.tencent.mobileqq Acesses field javax.security.auth.x500.X500Principal.thisX500Name 3591 com.tencent.mobileqq Acesses field javax.security.auth.x500.X500Principal.thisX500Name 3591 com.tencent.mobileqq Acesses field javax.security.auth.x500.X500Principal.thisX500Name 3591 com.tencent.mobileqq Acesses field javax.security.auth.x500.X500Principal.thisX500Name 3591 com.tencent.mobileqq Acesses field javax.security.auth.x500.X500Principal.thisX500Name 3591 com.tencent.mobileqq Acesses field javax.security.auth.x500.X500Principal.thisX500Name 3591 com.tencent.mobileqq Acesses field javax.security.auth.x500.X500Principal.thisX500Name 3591 com.tencent.mobileqq Acesses field javax.security.auth.x500.X500Principal.thisX500Name 3591 com.tencent.mobileqq Acesses field javax.security.auth.x500.X500Principal.thisX500Name 3591 com.tencent.mobileqq Acesses field javax.security.auth.x500.X500Principal.thisX500Name 3591 com.tencent.mobileqq Acesses field javax.security.auth.x500.X500Principal.thisX500Name 3591 com.tencent.mobileqq Acesses field javax.security.auth.x500.X500Principal.thisX500Name 3591 com.tencent.mobileqq Acesses field javax.security.auth.x500.X500Principal.thisX500Name 3591 com.tencent.mobileqq Acesses field javax.security.auth.x500.X500Principal.thisX500Name 3591 com.tencent.mobileqq Acesses field javax.security.auth.x500.X500Principal.thisX500Name 3591 com.tencent.mobileqq Acesses field javax.security.auth.x500.X500Principal.thisX500Name 3591 com.tencent.mobileqq Acesses field javax.security.auth.x500.X500Principal.thisX500Name 3591 com.tencent.mobileqq Acesses field javax.security.auth.x500.X500Principal.thisX500Name 3591 com.tencent.mobileqq Acesses field javax.security.auth.x500.X500Principal.thisX500Name 3591 com.tencent.mobileqq
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
/data/user/0/com.tencent.mobileqq/code_cache/secondary-dexes/MultiDex.lockMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
/data/user/0/com.tencent.mobileqq/code_cache/secondary-dexes/base.apk.classes1.zipMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
/data/user/0/com.tencent.mobileqq/code_cache/secondary-dexes/tmp-base.apk.classes515186448973019878.zipMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
/data/user/0/com.tencent.mobileqq/shared_prefs/Voicemail.xmlMD5
805d1a39c437547cb122a60205016f94
SHA136c9c3d67c99d0e1a7c1d1051a32f01cc490219a
SHA2569acf9f2bb2188ebe2068a238a3340ccaf618b8c360755f932c1127e2958fe745
SHA5126216675a9106320b8cf4db9ff6ed0fd407f403d8361b5771226a6a8be706679d4dcab5f884a63353f0549a81486bc2f3b15abfd19e175af2edd054208d8b5433
-
/data/user/0/com.tencent.mobileqq/shared_prefs/Voicemail.xmlMD5
28640394d55b8364f0dbecb2988a90c2
SHA139ab5a62ce0444d70541f4a2fdd54ef9c22198c3
SHA25644f6cf6fcac77df3d2e34b86aeda16534d2e41d31fb02584fd4282ceaed1d73f
SHA5121d74df68c20df73b74b57e9ab1f22b905d019c0e167aa16ded2e8a22fb1287c54cb0ecaa20c3c5bd911adc40e05c50678893084ec98f647fd7da8d34a3cf6c92
-
/data/user/0/com.tencent.mobileqq/shared_prefs/multidex.version.xmlMD5
11d75c463ea650b8dcf7248acf1d6823
SHA161943026103b53319f5684d3113df87f09dd68c8
SHA25686d29b226969713c8069c260e73c5ab33936ca950ea1fefc568a2b8c5e86bbe3
SHA51232dc84c225ed3a4f048a394f6072e483f06371e9e5ffc5c0fbfc4d06ad61d4c61e56cf2e076322df41c827b9ddec35131f3c2664ab1365b6ee8d26eb6a16d746