e71523aabf8ae22166bc3334a1bfb219a1369a2270a391eb505fb40ce865ea2e

Analysis

max time kernel
4s
max time network
148s
platform
android_x86
resource
android-x86-arm-20240221-en
resource tags

androidarch:armarch:x86image:android-x86-arm-20240221-enlocale:en-usos:android-9-x86system
submitted
16/03/2024, 05:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

cd45cb0a56fce993e870b13c3c4c2d28.apk
Size

6.4MB
MD5

cd45cb0a56fce993e870b13c3c4c2d28
SHA1

fde53726023ce5dcfe7c90427fcd26bd058918cf
SHA256

e71523aabf8ae22166bc3334a1bfb219a1369a2270a391eb505fb40ce865ea2e
SHA512

1bb6414c9d6d5141f2634140a2f94358e306251fbf0788bc36837d5eeadd34d66371074cf9474c9f39ff31021455f88291b54be6f88a8e74348f0bb55876cb83
SSDEEP

196608:AT0QxlKLpUP1G5b59Xj6dtHRl9N3gKvlw:brpUPyrXGdtxlzdw

Score

8^/10

banker discovery

Malware Config

Signatures

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs 1 IoCs

banker discovery

Security Software Discovery

T1418.001

description	ioc	Process
Framework service call	android.content.pm.IPackageManager.getInstalledApplications	com.cdnren.sfly

Reads information about phone network operator. 1 TTPs
discovery

System Network Configuration Discovery
T1422

com.cdnren.sfly
1⤵
- Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)
PID:4189

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Software Discovery

T1418

Security Software Discovery

T1418.001

System Network Configuration Discovery

T1422

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.cdnren.sfly/files/conf_version.json

Filesize
127B

MD5
3e7fd3271da0660849f53b4428c945d1

SHA1
0c932620cd9cf976423e9062a7f0e712cd40bdb3

SHA256
f1a1e9a849d8c6457e05b7a89ec9589c27d4969e499d4eaa2f960069700d1ec2

SHA512
932018b9506294d4bf2c5a29c8017c7ff2503d9beb19d1b6f3aefc5c8358181463881b5fef102235b0a7b3c78936ca854a6659a287f3c606206b027975321cbd

Download Submit
/data/data/com.cdnren.sfly/files/gfw.domain4exclude.conf

Filesize
4KB

MD5
8efeab184e759d309e5cb7e7e4ac7f33

SHA1
754f1109b6c49e119f9154bfcc3b0fb7c84e4671

SHA256
a8590006f1034034bb3e68d27e0e29ae472accaeca5a814a9a0da408df52f0df

SHA512
8e08d1da1eb51d846b75c2b201241056e2ef831a7778cd74e6e6342bcea1d5b6c590c9f8c2491fac6646f79e21b6e2004033e3b1eef9e98ad689ab06eda15c79

Download Submit
/data/data/com.cdnren.sfly/files/gfw.domain4include.conf

Filesize
4KB

MD5
4f75e604eb31799c48cee54c6a6d473c

SHA1
622d48cf0e930d444fcf78902958d66de0243141

SHA256
4fec808e6ea7df638824bfb8407fab15e0dfb0ab17fe9ab29932552d75447136

SHA512
5c3034c6c78963e9b2eccaa4a08d3f8560c94364aeae518f5de5d61ad05b260f80a23381aff9b8faf4e2dffe5a6b6541703b04570bc9a6ddc7adf4c85b34dce6

Download Submit
/data/data/com.cdnren.sfly/files/umeng_it.cache

Filesize
310B

MD5
8f1fc5e623b68f028387ab297159c3c0

SHA1
2cbcbe168cf8f8e450a7cae44cbb289c915a404a

SHA256
c559952adb84518f4418d71780d4ef33e87ad55e627f54d66eae49c0fa72fe36

SHA512
8494110c91f3a4e50afa12b00028d78645ef57c7d7a186cd90a9270e68c62a0519f2d32976b310bedb67090c8c2e19e4bc21b1ebaca4eb0a730f272fdc4b85ae

Download Submit