Analysis
-
max time kernel
2670105s -
max time network
137s -
platform
android_x64 -
resource
android-x64-arm64-20231215-en -
resource tags
androidarch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20231215-enlocale:en-usos:android-11-x64system -
submitted
23-12-2023 13:42
Static task
static1
Behavioral task
behavioral1
Sample
23b953a83e3f3101ba29da72dacd6c9b0be1565926ab32e1ff44d11c82d96ca0.apk
Resource
android-x86-arm-20231215-en
Behavioral task
behavioral2
Sample
23b953a83e3f3101ba29da72dacd6c9b0be1565926ab32e1ff44d11c82d96ca0.apk
Resource
android-x64-arm64-20231215-en
General
-
Target
23b953a83e3f3101ba29da72dacd6c9b0be1565926ab32e1ff44d11c82d96ca0.apk
-
Size
13.1MB
-
MD5
b28f76d80faa701a1cdb34a3e9b2d47f
-
SHA1
2f15f9d1a92a06a423f00a0e444ed2ad9568a81f
-
SHA256
23b953a83e3f3101ba29da72dacd6c9b0be1565926ab32e1ff44d11c82d96ca0
-
SHA512
1ffe0056e9ad23df9ad825d3c12b6937dd23d4eb0220f74072a730b0c1b7bbb9cf3f07500ac51c03fe27c5c4ff0223e8abf3fc6cf27b7b16a8123d35e1e16885
-
SSDEEP
393216:WJoUQSpx28xHzoyJSOaWH0b322ZGuL+cVO2k:WJmkHHVJhxHwmFqPy
Malware Config
Signatures
-
Checks Android system properties for emulator presence. 6 IoCs
description ioc Process Accessed system property key: ro.bootmode com.tonglubao.quyibao Accessed system property key: ro.hardware com.tonglubao.quyibao Accessed system property key: ro.product.device com.tonglubao.quyibao Accessed system property key: ro.product.model com.tonglubao.quyibao Accessed system property key: ro.product.name com.tonglubao.quyibao Accessed system property key: ro.bootloader com.tonglubao.quyibao -
Checks Qemu related system properties. 7 IoCs
Checks for Android system properties related to Qemu for Emulator detection.
description ioc Process Accessed system property key: init.svc.qemud com.tonglubao.quyibao Accessed system property key: init.svc.qemu-props com.tonglubao.quyibao Accessed system property key: qemu.hw.mainkeys com.tonglubao.quyibao Accessed system property key: qemu.sf.fake_camera com.tonglubao.quyibao Accessed system property key: ro.kernel.android.qemud com.tonglubao.quyibao Accessed system property key: ro.kernel.qemu.gles com.tonglubao.quyibao Accessed system property key: ro.kernel.qemu com.tonglubao.quyibao -
Checks known Qemu pipes. 2 IoCs
Checks for known pipes used by the Android emulator to communicate with the host.
ioc Process /dev/socket/qemud com.tonglubao.quyibao /dev/qemu_pipe com.tonglubao.quyibao -
Checks the presence of a debugger
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
99KB
MD560e27bcb3aa654696983a16cf016466d
SHA1076232340af7cdaf8bbdd4b83b52f6a7b04ce569
SHA2563c0071db2a362396534d5b860b38cd4721ac9e2f701ef5236a34982586239e08
SHA512f1b61e2a69a4d363e1595dd1a2d53ac79a78c3024801796cdc03bbac206557502d058dc395936dc322031a582e2c3c40bca83bf894f62f777731619d1a73e12b