a754307414a4467ca04a1d1a70c30ae23b8e21a1ee8054b1b092b437631adee5

Analysis

max time kernel
139s
max time network
168s
platform
android_x64
resource
android-x64-20240221-en
resource tags

androidarch:x64arch:x86image:android-x64-20240221-enlocale:en-usos:android-10-x64system
submitted
27-04-2024 22:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

muzhiwanapp.apk
Size

6.7MB
MD5

f166fff17a539f053550965c87c42054
SHA1

8be071793576b6e324db218f02a017439fe826a3
SHA256

efa8e431c5d5b3bda3cfc0da4392d14ef447643412bbea22536a155c7aae82b4
SHA512

26869689b5a58e52e63d95b07cf04f560c4580e9bd408a432a61acace492201ffe93cb7e4166a360530eff8fa3827ae0df83ee43e30daa7f670010d59a8bab8a
SSDEEP

98304:thCSkJBDmTuhW+7eF0JUQ4KMB6NQP4WfxRENHpxPOJHMMC1dh4Zadvtvc8Y6dtR3:nru6wUQMBj4WfOHp+HPC1z4mkKdYIx

Score

7^/10

discovery evasion persistence

Malware Config

Signatures

Loads dropped Dex/Jar 1 TTPs 1 IoCs
Runs executable file dropped to the device during analysis.
evasion

T1407

Processes:

com.muzhiwan.market:mzwlogservice

ioc pid process

/data/data/com.muzhiwan.market/data/mzw.apk 5188 com.muzhiwan.market:mzwlogservice

ioc	pid	process
/data/data/com.muzhiwan.market/data/mzw.apk	5188	com.muzhiwan.market:mzwlogservice

Queries information about running processes on the device 1 TTPs 3 IoCs

Application may abuse the framework's APIs to collect information about running processes on the device.

discovery

T1424

Processes:

com.muzhiwan.marketcom.muzhiwan.market:multcom.muzhiwan.market:mzwlogservice

description	ioc	process
Framework service call	android.app.IActivityManager.getRunningAppProcesses	com.muzhiwan.market
Framework service call	android.app.IActivityManager.getRunningAppProcesses	com.muzhiwan.market:mult
Framework service call	android.app.IActivityManager.getRunningAppProcesses	com.muzhiwan.market:mzwlogservice

Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.
discovery

T1421

Processes:

com.muzhiwan.market

description ioc process

Framework service call android.net.wifi.IWifiManager.getConnectionInfo com.muzhiwan.market

description	ioc	process
Framework service call	android.net.wifi.IWifiManager.getConnectionInfo	com.muzhiwan.market

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 2 IoCs

persistence

T1624.001

Processes:

com.muzhiwan.market:multcom.muzhiwan.market

description	ioc	process
Framework service call	android.app.IActivityManager.registerReceiver	com.muzhiwan.market:mult
Framework service call	android.app.IActivityManager.registerReceiver	com.muzhiwan.market

Acquires the wake lock 1 IoCs

Processes:

com.muzhiwan.market

description ioc process

Framework service call android.os.IPowerManager.acquireWakeLock com.muzhiwan.market

description	ioc	process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.muzhiwan.market

Checks if the internet connection is available 1 TTPs 2 IoCs

discovery

T1421

Processes:

com.muzhiwan.market:multcom.muzhiwan.market

description	ioc	process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.muzhiwan.market:mult
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.muzhiwan.market

Queries the unique device ID (IMEI, MEID, IMSI) 1 TTPs
discovery

T1422
Reads information about phone network operator. 1 TTPs
discovery

T1422

com.muzhiwan.market
1⤵
- Queries information about running processes on the device
- Queries information about the current Wi-Fi connection
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Acquires the wake lock
- Checks if the internet connection is available
PID:5092

com.muzhiwan.market:mult
1⤵
- Queries information about running processes on the device
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Checks if the internet connection is available
PID:5134

com.muzhiwan.market:mzwlogservice
1⤵
- Loads dropped Dex/Jar
- Queries information about running processes on the device
PID:5188

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.muzhiwan.market/data/mzw.apk
Filesize
17KB

MD5
e65188742e10046597a4c648d045699b

SHA1
37b2f1e3e89d3b0d8683737ccae2ee725e82a312

SHA256
d0990058e5204d1a1bde2eff40893cb49d1e8972ee9b7e1b03ae35ac3cd5df8b

SHA512
3859b177492c74ec9448f7c57cf37beb7c747dca9580125cbd7c2e1f3a7761a3736072b1ec2ee14fa1f844f13df4163aa167b5cb9010e7e7fd00b2724553d481

Download Submit
/data/data/com.muzhiwan.market/databases/notes-db
Filesize
16KB

MD5
2667900bf3b5ab90121d0a3ff8ade390

SHA1
d82120444613139e2f4547f2872aa2c95ed9dbf5

SHA256
bddb108ff2c0d509cd953c8dfb2b7c4e838d205291a4da8ab6c65cb98986416e

SHA512
03db7a94d3760f47c9546e3c033647e853a984385e871d46d056509b8812422a2a3389551c30ec5a9360cebb5e1786315c6891611638c60642d3107dfd8006c3

Download Submit
/data/data/com.muzhiwan.market/databases/notes-db-journal
Filesize
42KB

MD5
c04d422c5a4bf58a127bbf2bf014965c

SHA1
3b1f3f4ad21fe0febe567e5a56996a7e61658cf9

SHA256
7a28fd857e1283e351d37931cc6e23cd6de5ad2fd4d3d23337a6f162b07f3978

SHA512
6cb2768a8344e3da470472ea906b5be2e33a24384efe35cdc3c0b0c24351c3b34444a4d2d6a9e21c48927b85554aaa3904fb0361071c0711841565222253e0a8

Download Submit
/data/data/com.muzhiwan.market/databases/notes-db-journal
Filesize
59KB

MD5
b2a8fd2dba92c8f75869f79c70d441da

SHA1
faaf88b3c3653fc205a3a125ccb77fbc87b76215

SHA256
2514431fe50d909ac1385e07341ed8878b5f2400df151df5a43a59b98a31ea02

SHA512
a66893a5bb935dfefdc12ea32c2407cf9d8d040ff82852b415c599beb94d002ce77ec15bbac3f78ae6758a8c7f5e83c799ad84fb8ce2e6763da88a9bb20aa7b6

Download Submit
/data/data/com.muzhiwan.market/databases/notes-db-journal
Filesize
8KB

MD5
4e2b68d3478e394e1fc0846ffa81f9e5

SHA1
64ffdb449e76d17fa9c3463b4b458d6fffc154c9

SHA256
01ab82a264d12832523c1575fd81d355833cec8c0c4b9e7410e48bc689d38757

SHA512
84cc8530ba837bfef8c05b0b9925241fb78c69a99d2a0b55d2042deac5d114cd3645065ed30c74a9a17a509001bd1733866fe006ed194f3a7c9da52da0c90c2f

Download Submit
/data/data/com.muzhiwan.market/files/install_file_dir-journal
Filesize
2KB

MD5
e5bd8217635e5bcaa93f3547c4f21e82

SHA1
41b31760dd1f61e9a6c30cf7592f005973e54a2a

SHA256
8a5b6be6c605b43ceb0f1fa7969bde434ec5450ef8c75e62ac59047d75c28c53

SHA512
cfc16feb0f4e269fb5fd07c02928aaa9c15beaf1a91aacc350581c413ac5748cfd97bc3329820a104836df9c1b937daf9c7e0c92428a74eb2c82fa2ccbf40158

Download Submit
/storage/emulated/0/data/.push_deviceid
Filesize
32B

MD5
549c98a28b2b9306ee4fcaca9512e1aa

SHA1
0590baa6c0f171ea1fcf8debf9e180232788edbc

SHA256
847ec036a16f29cee1fb6618728edbb995c96d40dd0e74e573c77a768ce1b50a

SHA512
bdf111129005163ba97f3fbe7a8fc8e7d5e8a6f99f75c342bd3c8594ca321cb719c0d8aeb835a529823ee103be1313d9e5f75adaafb2f25fb305c0132015f0e6

Download Submit
/storage/emulated/0/data/.systemid
Filesize
42KB

MD5
7bc525aa5cfd71cd4d2ad570fd72a906

SHA1
b411e1b345b5e9e4a0e4f603b46277278981e921

SHA256
14b68457395896d3ffe12b777f52fe2cc4182a6c9ba383555b12522c93657b00

SHA512
5f1973360665bdeb536d8dc2a9c5d2077990fbc6fd3653747de9d54c7032a776151f39986792ab57773623a143b2d65cfbb585aa53c823197485eba9e75c8e2f

Download Submit
/storage/emulated/0/data/.systemmac
Filesize
1KB

MD5
51110ecbce5d198d21bbf3e1940fe761

SHA1
4de4d27a822570c8374c3b1878b22182768cef22

SHA256
3b6ffaf28461a44ca4bcb4dbd0ede8a30fcda6775456e468c90a0a47a3a2bb50

SHA512
7efdb979627c4b526553b25319eedcc2d7101eaaa580c85bfb63fb14af7b085cb8423426c17c90b5e8290563e6fcc4bf52b5f25fc07b7dba3ac71464b4e0c794

Download Submit