ddc1f2edb82739e7a92182aae6ddff254393d459c66b120ca09ce84627457efa

Analysis

max time kernel
149s
max time network
156s
platform
android_x86
resource
android-x86-arm-20240506-en
resource tags

androidarch:armarch:x86image:android-x86-arm-20240506-enlocale:en-usos:android-9-x86system
submitted
09/05/2024, 23:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

vending.apk
Size

309KB
MD5

296c9d95f922ed92f12f3425b70cb6a9
SHA1

e2903a070d76a15cad9a2eea95e5bac30e5c7d50
SHA256

752ed80071d53289a3ecaf168a4d9e8b9a46932ea77896f47dffb9f53114d7e5
SHA512

06533dfdfceac94add69bcd85e6eb7216c596fc00214ac24511b565955e9cdfcd59a34829555680360504c47c7a6a0c1c2a021a7c4164f3fb196abae738d36d6
SSDEEP

6144:a844OkUYokCNo5/d0gI6VP13JOb66F/3kqzZR6QuUb:vv1UYSW5/1P9JObR/kmZR6l8

Score

7^/10

discovery evasion persistence

Malware Config

Signatures

Checks CPU information 2 TTPs 1 IoCs

Checks CPU information which indicate if the system is an emulator.

evasion discovery

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	com.excean.android.vending

Checks memory information 2 TTPs 1 IoCs

Checks memory information which indicate if the system is an emulator.

evasion discovery

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	com.excean.android.vending

Queries the mobile country code (MCC) 1 TTPs 1 IoCs

discovery

System Network Configuration Discovery

T1422

description	ioc	Process
Framework service call	com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone	com.excean.android.vending

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs

persistence

Broadcast Receivers

T1624.001

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	com.excean.android.vending

Checks if the internet connection is available 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.excean.android.vending

com.excean.android.vending
1⤵
- Checks CPU information
- Checks memory information
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Checks if the internet connection is available
PID:4468

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Discovery

System Information Discovery

T1426

System Network Configuration Discovery

T1422

System Network Connections Discovery

T1421

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/storage/emulated/0/com.excean.android.vending/hook.js

Filesize
922B

MD5
3dc2e0358cd098ffab48dd777178231d

SHA1
3205a0259ada02818c19df9dc6469148dc560dec

SHA256
018f4a25446f519dbf49557da24ecd0b4d92d7b827748a27c6da5db243bf9004

SHA512
a05233fd1fe286d67d92c42fd6426f7fcc7f318c9ffc1117a66ceb920c570032ad3254f55822fb4320a89e0164c0b338f0449e60bb568450bb2f658cd790d464

Download Submit
/storage/emulated/0/com.excean.android.vending/tt.js

Filesize
4KB

MD5
e92fe1f2a29f509878e61217a2563a99

SHA1
c57d5fea1e372ebd538fd3f97b7533bc2f7cd5c0

SHA256
dc9ba26e3eb711105170b59195d0fe19e18d39b1834544a25436e9557bb4f572

SHA512
26a7eee6bf621486fb76d925392c4f81eacbab21a860ea55687c721f61551539f4c8710d4d13d3510194e064cb5f29f698f16b38c7791d8f73f9343719f9cb8a

Download Submit
/storage/emulated/0/com.excean.android.vending/xx.js

Filesize
438B

MD5
a27daa00d9ddbdecb227e27cb3372e68

SHA1
79405ced9eb6768362253abc54fef3e9fb768209

SHA256
78f4f184c43f3757306297516127d511a773b0545535013fc68548f26f15f749

SHA512
6f4d904f2551a8a24a5f37763165f4bcdefd90a4fa40a4da1c9a7ad5e1bf608a1b8a1840de026a92a674033d7e0b683d9fe0aa88219ef9cee715297652c8170d

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads