Analysis
-
max time kernel
2263008s -
max time network
139s -
platform
android_x86 -
resource
android-x86-arm-20231215-en -
resource tags
-
submitted
19-12-2023 23:49
General
-
Target
6eeb683ee4674fd5553fdc2ca32d77ee733de0e654c6f230f881abf5752696ba.apk
-
Size
2.9MB
-
MD5
b0c5b2b4d6678c9faa5140a040a1ab73
-
SHA1
ca101ddfcf6746ffa171dc3a0545ebd017bf689a
-
SHA256
6eeb683ee4674fd5553fdc2ca32d77ee733de0e654c6f230f881abf5752696ba
-
SHA512
4ac35472e292b4491e96d32ccd73f73fef10ed90070bcc16d1c69b0c800762a47fde01871a75274b2036eeb76705767c9a4d282e1f57bf55931da9011195e2fd
-
SSDEEP
49152:duRML7jNf7mUqyKD/09lXUKhoHvoiUc/l9tZ5yHKhs76ry5K+X6j1VHzfjqD:1jN7xLG/Ul70RUcN9tXkj7eH+Xu1JzfS
Malware Config
Signatures
-
Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 IoCs
-
Removes its main activity from the application launcher 1 IoCs
-
Requests cell location 1 IoCs
Uses Android APIs to to get current cell location.
-
Acquires the wake lock 1 IoCs
-
Reads information about phone network operator.
-
Requests disabling of battery optimizations (often used to enable hiding in the background). 1 IoCs
Processes
-
com.tencent.mobileqq1⤵
- Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)
- Removes its main activity from the application launcher
- Requests cell location
- Acquires the wake lock
- Requests disabling of battery optimizations (often used to enable hiding in the background).
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
/data/data/com.tencent.mobileqq/databases/com.google.android.datatransport.eventsFilesize
4KB
MD5f2b4b0190b9f384ca885f0c8c9b14700
SHA1934ff2646757b5b6e7f20f6a0aa76c7f995d9361
SHA2560a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514
SHA512ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1
-
/data/data/com.tencent.mobileqq/databases/com.google.android.datatransport.events-journalFilesize
512B
MD5984527f95ccdd4d36bc04d1f94c2637f
SHA121e964a217d3454ebb609520fbe0e8fb75e25256
SHA2567075ace8f7bf28aeb033ca3a5533a943f2bc1d32a34c81cd435c29c4b63181fb
SHA512892bfdc8788dd122e890d4fee7d3599e9c10e28a18bf1e26aef4a9946f75ccf128c1d0302ecd4abd9d641cad052eb2699a6b874b35d84772043bdc749a8eaf3b
-
/data/data/com.tencent.mobileqq/databases/com.google.android.datatransport.events-shmFilesize
28KB
MD5cf845a781c107ec1346e849c9dd1b7e8
SHA1b44ccc7f7d519352422e59ee8b0bdbac881768a7
SHA25618619b678a5c207a971a0aa931604f48162e307c57ecdec450d5f095fe9f32c7
SHA5124802861ea06dc7fb85229a3c8f04e707a084f1ba516510c6f269821b33c8ee4ebf495258fe5bee4850668a5aac1a45f0edf51580da13b7ee160a29d067c67612
-
/data/data/com.tencent.mobileqq/databases/com.google.android.datatransport.events-walFilesize
52KB
MD5e79da00f4e6aa6a025913e6ee79980f0
SHA14c087f60ebd101737478824ba0b5cc7a5b2a7918
SHA256a0d593ed8965224a7bc37e92503cc03871e06d4846fa8bca24fd49e75d7f4946
SHA51274a3fa20387219d565cb2420de66c304143eb1abbd92ccff32770a66841f771b76b5b002e58246a4b0ddbd3689378b9a68c6b357a909349d259e2376bfbf166d
-
/data/data/com.tencent.mobileqq/files/PersistedInstallation5153832385256936000tmpFilesize
114B
MD5ad0aa5f81a84afe027ac29ed87f3bed9
SHA19aaf147bc30560c3a2f343ee6a05c58741c45eb6
SHA256b0915872cb1f1de37061438d29adcdbc55b919fca9694c8426f878da8be526f6
SHA51229d6604589501786e88c0e6c7502c1074493ad790de47c096e0c33e4092f9e951e690d4c510c9db94014f6921c4bf69cb2f6fe99c120c9e6a4dbbf008b6c7401
-
/data/data/com.tencent.mobileqq/files/PersistedInstallation8385883201036675768tmpFilesize
90B
MD5e198ff53b3f256c5c7d325c73f970ed3
SHA19d9cf1cbf996822bda1a00ed2fba76f49d6bdddc
SHA2566a4c78230a52bffab21ce35b6c821d8f0ef426ee515700a4f27e211db7020bd6
SHA512483465ffb3029534fdbebabc2b8184bf4b402cc76c07b2de42b1d230ab8d7bf04b78037866d53de4d2836592ab5eb5ea5e9ce669c2c6e5bdcd906e26c08c9cbe