Analysis
-
max time kernel
138s -
max time network
149s -
platform
android_x86 -
resource
android-x86-arm-20240221-en -
resource tags
-
submitted
27-04-2024 22:27
General
-
Target
muzhiwanapp.apk
-
Size
6.7MB
-
MD5
f166fff17a539f053550965c87c42054
-
SHA1
8be071793576b6e324db218f02a017439fe826a3
-
SHA256
efa8e431c5d5b3bda3cfc0da4392d14ef447643412bbea22536a155c7aae82b4
-
SHA512
26869689b5a58e52e63d95b07cf04f560c4580e9bd408a432a61acace492201ffe93cb7e4166a360530eff8fa3827ae0df83ee43e30daa7f670010d59a8bab8a
-
SSDEEP
98304:thCSkJBDmTuhW+7eF0JUQ4KMB6NQP4WfxRENHpxPOJHMMC1dh4Zadvtvc8Y6dtR3:nru6wUQMBj4WfOHp+HPC1z4mkKdYIx
Malware Config
Signatures
-
Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
-
Checks CPU information 2 TTPs 1 IoCs
Checks CPU information which indicate if the system is an emulator.
-
Loads dropped Dex/Jar 1 TTPs 3 IoCs
Runs executable file dropped to the device during analysis.
-
Queries information about running processes on the device 1 TTPs 3 IoCs
Application may abuse the framework's APIs to collect information about running processes on the device.
-
Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.
-
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
-
Acquires the wake lock 1 IoCs
-
Checks if the internet connection is available 1 TTPs 2 IoCs
-
Reads information about phone network operator. 1 TTPs
Processes
-
com.muzhiwan.market1⤵
- Checks CPU information
- Queries information about running processes on the device
- Queries information about the current Wi-Fi connection
- Acquires the wake lock
- Checks if the internet connection is available
-
getprop ro.board.platform2⤵
-
com.muzhiwan.market:mult1⤵
- Loads dropped Dex/Jar
- Queries information about running processes on the device
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Checks if the internet connection is available
-
/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/data/com.muzhiwan.market/data/mzw.apk --output-vdex-fd=50 --oat-fd=51 --oat-location=/data/data/com.muzhiwan.market/data/oat/x86/mzw.odex --compiler-filter=quicken --class-loader-context=&2⤵
- Loads dropped Dex/Jar
-
com.muzhiwan.market:mzwlogservice1⤵
- Loads dropped Dex/Jar
- Queries information about running processes on the device
-
sh2⤵
-
su2⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
/data/data/com.muzhiwan.market/data/mzw.apkFilesize
42KB
MD585d09558a30b56872ec4df7909292387
SHA1799259262e84952063d2013b843285d4b9865c5e
SHA256abffa567da8045874417654e8a98ef889f729455aa0e48b11a89b95e386e0ef8
SHA5123a97ecb531586f8b4d85877a2bfd5878c0b63c99ca12a6adb06d143fc676f67a5ee060e25a730c36eaa9693ab15048782f1810e818f5fd8005c60dd9465fe755
-
/data/data/com.muzhiwan.market/data/mzw.apkFilesize
17KB
MD5d1a020921eff5f91e5900a64bc558eeb
SHA1f03fec1fb79a3b528aced885a8e95fb0a7eb01ef
SHA256de8599fe345c0cf878b2887a98d921051edd36de036b5c1d8595a2c8f3738aa6
SHA51217f62c1182f869511ef89424cbc51140eddfb0e84a8999a5a4da94a6d398ccd92839a2d8a2705b976ecb59efbac90ede5122d3de8470dfbb75ce606a263b8d4e
-
/data/data/com.muzhiwan.market/data/mzw.apkFilesize
17KB
MD5e65188742e10046597a4c648d045699b
SHA137b2f1e3e89d3b0d8683737ccae2ee725e82a312
SHA256d0990058e5204d1a1bde2eff40893cb49d1e8972ee9b7e1b03ae35ac3cd5df8b
SHA5123859b177492c74ec9448f7c57cf37beb7c747dca9580125cbd7c2e1f3a7761a3736072b1ec2ee14fa1f844f13df4163aa167b5cb9010e7e7fd00b2724553d481
-
/data/data/com.muzhiwan.market/data/mzw.dFilesize
59KB
MD508bd167a18ea9107699a99290667d430
SHA124ea26b18af4d0340653f75bed34185710fdd492
SHA256cc2813abbe7d6d1215ec29c421ea986f8241cfc781276c812a455e6748d36cc5
SHA512aec4ae1588e2c1915a261d89472da0947a1d268e4025f3baf7bf247faa31fe636e36b7cfb0d7c86b6b711da5644cbedf651b59690566ee7ed7ab7e728560337c
-
/data/data/com.muzhiwan.market/data/mzw.gFilesize
42KB
MD531c07ebfd99e7a6fa40025c33e486e52
SHA14f35868a9b70906caf65444767ca7900ef332058
SHA256a872154216d0fcfcb1259fe494391689046c9c0448f16dac46760aa427be714a
SHA512ab83c98ce86d8c7cf1f9394af46337ddbc04d68ee5b935bdad812dd570beceb865602f12d620f974a0796d678f1580f7afe4a7c4e8864ac9e8fdb028bd381b01
-
/data/data/com.muzhiwan.market/databases/download-journalFilesize
512B
MD59af2b8d5a31e84b8ab058be1a75a1807
SHA1b996e36b8fd51578fd23b2c65c6f2d80e4b8f4a4
SHA2569fcee8db16115f11c504fdd5e492584fbe5394c6214d05f2a1e0ea27012b3362
SHA512e58e46c63b3e80fb71365c0afb36765cb3106bd3b231b63555fb6b838fa4fef59cc8139d44799aa1c44a1294d2562102b547b58475b366fca043fa6bdfc4f40b
-
/data/data/com.muzhiwan.market/databases/download-walFilesize
28KB
MD533fbc0a3ee7bf4eadde79364ce8db368
SHA13d61d8ee1d543cfd0dd9a231f245f481afac8ee1
SHA256d2de5582316bb739a5f003b981cb8c0839ecdbd26774c82f05b2e0a324215856
SHA512d4a7e56c03b37fa7c4fd9f78cb32306fd5cdddae324a06d4d4bf2d1d402d7d6dd1b4ff6279390909ff0625fd6fdde5d85929b91f84b351f67b2212bdd95d714b
-
/data/data/com.muzhiwan.market/databases/notes-dbFilesize
4KB
MD5f2b4b0190b9f384ca885f0c8c9b14700
SHA1934ff2646757b5b6e7f20f6a0aa76c7f995d9361
SHA2560a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514
SHA512ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1
-
/data/data/com.muzhiwan.market/databases/notes-db-journalFilesize
512B
MD5d4dc33a71974cba1adc2ad962e0a1005
SHA132fe4fefda0eacac1bd9a7ced384edf6ecac14fa
SHA25670d620e217d39292de1ba60c1bcbb0621486d891d7d6b3176cc2464d139efb88
SHA5127203d4f65f5d51a19527f30084662c1643fdec1a6335b7ebd5a2687c4abacbd7b83037afadf2362128953414e8c8a7716b88adc030bf6f64b8659d7708ab0a9c
-
/data/data/com.muzhiwan.market/databases/notes-db-shmFilesize
42KB
MD57bc525aa5cfd71cd4d2ad570fd72a906
SHA1b411e1b345b5e9e4a0e4f603b46277278981e921
SHA25614b68457395896d3ffe12b777f52fe2cc4182a6c9ba383555b12522c93657b00
SHA5125f1973360665bdeb536d8dc2a9c5d2077990fbc6fd3653747de9d54c7032a776151f39986792ab57773623a143b2d65cfbb585aa53c823197485eba9e75c8e2f
-
/data/data/com.muzhiwan.market/databases/notes-db-walFilesize
28KB
MD5cc29b620e175e810d884b147da7181c1
SHA13bb1bf8c5302102fcac8c0aa81adc299f74ee887
SHA256b9c06b12ce1d851e5443d8db3884273bbdf530d067db3df3964bd792e59453a5
SHA5120667690d1defeacd699ccd29270e000946dd887b0179148aaf0ab85b283e091b21bcc8668596f9f3799db11690ae85c0df13b0d59fdbf99db097d10c7ce55342
-
/data/data/com.muzhiwan.market/files/install_file_dirFilesize
5KB
MD595e8c0f41aa8ccea981c9893e0f72d30
SHA124cd083f7223552130189adc3ec132c13d33d877
SHA2569c7aa4702a91892412cb4b3974fb525b9b088d745b7c236c85d7847c140ae743
SHA51298b2aa33eccfbfa7fd849dcc3470c9433c6446c8443f42b4614354100139ee11c5ccfc087ee1ebdcc3d7994109ab207422c347fcfff9fd885cc9a5e88d1a8bf8
-
/data/data/com.muzhiwan.market/files/install_file_dir-journalFilesize
1KB
MD50a33fc0030b842efba5b056c85abf15d
SHA10fb77f4db742dbca10c6a30e997037664fae36e0
SHA256d4562c8de2eac39c2d3fb306b66bdcbce94515003bb41e72ad90564fab23a0dc
SHA512d07bea5acd094d9526ab1f64c6424194c1889aec10504eef9a545859a8a23e5b10d89d5543df4e8f2e5fd5206dbc1f43fd29999d3e31571117206c0421f2abb0
-
/data/data/com.muzhiwan.market/files/install_file_dir-shmFilesize
28KB
MD5cf845a781c107ec1346e849c9dd1b7e8
SHA1b44ccc7f7d519352422e59ee8b0bdbac881768a7
SHA25618619b678a5c207a971a0aa931604f48162e307c57ecdec450d5f095fe9f32c7
SHA5124802861ea06dc7fb85229a3c8f04e707a084f1ba516510c6f269821b33c8ee4ebf495258fe5bee4850668a5aac1a45f0edf51580da13b7ee160a29d067c67612
-
/data/data/com.muzhiwan.market/files/install_file_dir-walFilesize
3KB
MD592fb187a06b9bbe618109876be17222e
SHA11d717c050dbe68d0db0c2b935d96db26b449c2ea
SHA256a339dac97f0945df94e9f8e335e16a8abb8b00cff5284e80e9c8b0715418a166
SHA512339fd20fc4657f69a84c5118171b1842917578dcfa47979ff869072618adb00ead323d014497f4fea04adbf7307e87fe02a7cedf8f82de8d051650ab14d1d788
-
/storage/emulated/0/data/.systemmacFilesize
5KB
MD572a239b77072f4a325001408279d8756
SHA1779ff775879ecb0b2f0778ff8311de79b67eadd7
SHA25617adadfbe797cc54277c3236e9a84568c102dfc63c54ed64d073d02b6424e885
SHA5129087ecc8d32faf66d91b1f10cddcc7c8cd7d28d28de9014f08413cad8904683d3b81cd75b25892f5342ff4b8f013fb46edf97bde91648ac1dd48d44db7584c7c