Analysis
-
max time kernel
2960596s -
max time network
130s -
platform
android_x86 -
resource
android-x86-arm-20231215-en -
resource tags
androidarch:armarch:x86image:android-x86-arm-20231215-enlocale:en-usos:android-9-x86system -
submitted
24/12/2023, 02:22
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
bb9d3ea7f7259995d3e18344ba7b802b1d9627c00542d72c6c5debc0d49948a8.apk
Resource
android-x86-arm-20231215-en
1 signatures
150 seconds
General
-
Target
bb9d3ea7f7259995d3e18344ba7b802b1d9627c00542d72c6c5debc0d49948a8.apk
-
Size
9.2MB
-
MD5
1ace6314c16cdbe00c014e7ba2bff918
-
SHA1
0945c73eb56a2e74a5b650f589137ea810eb2d41
-
SHA256
bb9d3ea7f7259995d3e18344ba7b802b1d9627c00542d72c6c5debc0d49948a8
-
SHA512
36a3d0e91e2c833c1797dc06e3a20e294ba658232e7246819ccfb0b2169e640612a8f434e3f3dde028e851d86cbf510238f5f49cbf9f02fb30c6a11f89cc43d6
-
SSDEEP
196608:jmXgZGGn58olx3Z4q8SMH/Q+OhcWUq3JRC+kDWnTwp:jhoGn51lxArYOWUqZBkCnMp
Score
8/10
Malware Config
Signatures
-
Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 4 IoCs
description ioc Process Framework service call android.content.pm.IPackageManager.getInstalledApplications com.tengyeah.chat.demo Framework service call android.content.pm.IPackageManager.getInstalledApplications com.tengyeah.chat.demo:remote Framework service call android.content.pm.IPackageManager.getInstalledApplications com.tengyeah.chat.demo:remote Framework service call android.content.pm.IPackageManager.getInstalledApplications com.tengyeah.chat.demo:remote
Processes
-
com.tengyeah.chat.demo1⤵
- Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)
PID:4246
-
com.tengyeah.chat.demo:remote1⤵
- Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)
PID:4420
-
com.tengyeah.chat.demo:remote1⤵
- Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)
PID:4451
-
com.tengyeah.chat.demo:remote1⤵
- Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)
PID:4485