c152018e118e7c2491f16cf9eb51696dc6afd9afa2d695ff4ade452dc65bde91

Analysis

max time kernel
144s
max time network
156s
platform
android_x86
resource
android-x86-arm-20240221-en
resource tags

androidarch:armarch:x86image:android-x86-arm-20240221-enlocale:en-usos:android-9-x86system
submitted
18/03/2024, 15:40

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

d3e1542b72682590a669ad24789a6f51.apk
Size

19.2MB
MD5

d3e1542b72682590a669ad24789a6f51
SHA1

f32a91e3488fc823f8803603c13aef6da0744274
SHA256

c152018e118e7c2491f16cf9eb51696dc6afd9afa2d695ff4ade452dc65bde91
SHA512

4cd0b8101c894d0237f26dd2e763820ad213d3734b82351294332a046bdda8d9199da2d775a825c123e4159383f71c2262a260daf76088d7b5145662bed57877
SSDEEP

393216:gZ8dmdNdldKdgdOdXdmd1dvsGMtQdgwrbsXGMWH470ylDMAWZARQ5+k3mo:gZMubzqI2NuD0LudR3MWH+RlIeCBmo

Score

6^/10

discovery

Malware Config

Signatures

Acquires the wake lock 2 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	cn.com.educloud.ui:pushservice
Framework service call	android.os.IPowerManager.acquireWakeLock	cn.com.educloud.ui

Reads information about phone network operator. 1 TTPs
discovery

System Network Configuration Discovery
T1422

cn.com.educloud.ui
1⤵
- Acquires the wake lock
PID:4190

cn.com.educloud.ui:ipc
1⤵
PID:4254

io.rong.push
1⤵
PID:4282

cn.com.educloud.ui:pushservice
1⤵
- Acquires the wake lock
PID:4306

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Network Configuration Discovery

T1422

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/cn.com.educloud.ui/databases/pushsdk.db

Filesize
4KB

MD5
f2b4b0190b9f384ca885f0c8c9b14700

SHA1
934ff2646757b5b6e7f20f6a0aa76c7f995d9361

SHA256
0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514

SHA512
ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1

Download Submit
/data/data/cn.com.educloud.ui/databases/pushsdk.db-journal

Filesize
512B

MD5
3f308b410f6e7b0ed1a3f5ec176705b2

SHA1
53cbcf2f22b9a4efd7687962737db87fb5b19a68

SHA256
87d5d7838a0fac023a31e64746be72b8e7e88c1e7fba3a34b9b81932ffc87bc7

SHA512
123aa020e5230e3d1d96a300e8154cc746bbb9709dacc6aef03fa546959afc5daf650b04cf428205d67935002841159814839ad124c951ef50c70035e7905dd9

Download Submit
/data/data/cn.com.educloud.ui/databases/pushsdk.db-shm

Filesize
28KB

MD5
cf845a781c107ec1346e849c9dd1b7e8

SHA1
b44ccc7f7d519352422e59ee8b0bdbac881768a7

SHA256
18619b678a5c207a971a0aa931604f48162e307c57ecdec450d5f095fe9f32c7

SHA512
4802861ea06dc7fb85229a3c8f04e707a084f1ba516510c6f269821b33c8ee4ebf495258fe5bee4850668a5aac1a45f0edf51580da13b7ee160a29d067c67612

Download Submit
/data/data/cn.com.educloud.ui/databases/pushsdk.db-wal

Filesize
80KB

MD5
0b15b1258e7de02dc4f65a48c01341d6

SHA1
13f38f49ca334ea88e9eb13f8c9277a68900cfbf

SHA256
3e5b6d4faa598f2bee784d3b2010e7133258213bc38cd017b24fa989407a50ee

SHA512
2c8b39c7581bbeb09e24468af95a0dadd21fb4343dd0131422770cd841e35286773f72512075d5ef17655863708a6972d32d5041115835d58a42ba781e356e2b

Download Submit
/storage/emulated/0/cn.com.educloud.ui/cache/image/journal.tmp

Filesize
31B

MD5
8c92de9ce46d41a22f3b20f77404cc1d

SHA1
8671a6dca00edb72be47363a7071be65cf270373

SHA256
68bb33ddeed9200be85a71f70b377985f9ee68e91578afbde8321463396f1274

SHA512
30f45fe9954215d6adafcc8f0a060a7ff41963a64f9b849a37f0d18fe045038d429ec13bf15226769c4ba78dad3c52f3d9e0dbbb4fcdea4828a1efe956e48f56

Download Submit