109d9efc48a9d4b0f80a41968258a666fe36c7a45c6530f1cf72c42e43751d8d

Analysis

max time kernel
4s
max time network
146s
platform
android_x64
resource
android-x64-20240221-en
resource tags

androidarch:x64arch:x86image:android-x64-20240221-enlocale:en-usos:android-10-x64system
submitted
02/04/2024, 10:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
01d840496d457504661cf29b0a9bb231411bd83bed375087f80824e4575d139b.apk
Size 2.0MB
Sample240402-mb5h2aef5z
SHA256 01d840496d457504661cf29b0a9bb231411bd83bed375087f80824e4575d139b
MD5 ee8dfc02c1dc19829501c2a72468a442
SHA1 f0e8d39e9dd4c8aec55777d11ff1c98abeafa269
SHA512 74822080cc8156e8ad5b02889fb647fe1373519178a8c551926b8890e525478c5278141c8498f9db0e7c8adca8c7d7f86bbf7c235881f30df6ffd641558de8fe
SSDEEP 49152:AsdkkgeXwYn1lDLXbJpemlMte1je0yfRidlRkYbTAXMWFo:Lkk5XhlDLL3evte1jCkdlRkEG6
MD5 SHA1 SHA512 SSDEEP

Score

6^/10

discovery

Malware Config

Signatures

Acquires the wake lock 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.lyufo.play

Reads information about phone network operator. 1 TTPs
discovery

System Network Configuration Discovery
T1422

com.lyufo.play
1⤵
- Acquires the wake lock
PID:5027

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Network Configuration Discovery

T1422

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

PersistedInstallation1422693057161880260tmp

Path /data/data/com.lyufo.play/files/PersistedInstallation1422693057161880260tmp
Size 90B
SHA256 9eb334ec6fdda4a12dd16e69480ac87ed233e63c89d0a12fa139f9805e089aba
MD5 88ce9810c623a5a611a2fde01bf6f336
SHA1 4e9a3dee670e3aacc17aac0b24eb60fb8cbceea7
SHA512 f3d073c3937067334eeb3b495256fdf27379f91a974b28ff176a851cf47e80db62317b8279c15f942a9fc209328314d727cfde386a749f19d9d552c5d6017dcb
MD5 SHA1 SHA512

Submit Download

PersistedInstallation921917385153194667tmp

Path /data/data/com.lyufo.play/files/PersistedInstallation921917385153194667tmp
Size 567B
SHA256 7bfba64cf24cd709fda2b1458f884bdef58625424d9e281c8a14555f3920736f
MD5 b69d79e1b4e30b7eff20e464fdceed47
SHA1 225280fe760e4717f58df7f288c2c1e38f961809
SHA512 6070ff75aaa13b94ce40e404345b2643ad86ae1c61561b0fa2fcefab2f2c23e470efbe891a1ec977a0c970542a474b150671d624acf77e2583602c510363bb68
MD5 SHA1 SHA512