b12ddf2079cd8e588d406654eff4876e1642271b0d390ea66a344c8b7df2de73

Analysis

max time kernel
51s
max time network
149s
platform
android_x64
resource
android-x64-20240506-en
resource tags

androidarch:x64arch:x86image:android-x64-20240506-enlocale:en-usos:android-10-x64system
submitted
09/05/2024, 03:35

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

VqsVirtual1.apk
Size

3.0MB
MD5

6bb4b69cc2285d212d93831fe52bb6f7
SHA1

725bfd49a206f4d347d7105b7f278a4dc9ff5ddc
SHA256

4a12517417ce94bb25090760e60a92cf88b53479281af3f4e5104e2180410986
SHA512

ebc5f919b0c631eb791da1ac09c16813becac83189f67207a6d5b7d5391579799e2a17d8f6febd7b4cfc8afd798ca91a2c36cd084f93a442e88b0c9cf3b8ee18
SSDEEP

98304:LRKaWLkhyUnCnMeGnzWGLATAS4V0FvFP2bwojGy3m2Iv:LIaWLOnmMeGzWG8v00hFPHojGIIv

Score

8^/10

collection discovery evasion persistence

Malware Config

Signatures

Requests cell location 2 TTPs 1 IoCs

Uses Android APIs to to get current cell location.

collection discovery evasion

Location Tracking

T1430

Geofencing

T1627.001

description	ioc	Process
Framework service call	com.android.internal.telephony.ITelephony.getCellLocation	com.vqs.livewallpaper

Checks CPU information 2 TTPs 1 IoCs

Checks CPU information which indicate if the system is an emulator.

evasion discovery

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	com.vqs.livewallpaper

Queries information about running processes on the device 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about running processes on the device.

discovery

Process Discovery

T1424

description	ioc	Process
Framework service call	android.app.IActivityManager.getRunningAppProcesses	com.vqs.livewallpaper

Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.wifi.IWifiManager.getConnectionInfo	com.vqs.livewallpaper

Queries information about the current nearby Wi-Fi networks 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about the current nearby Wi-Fi networks.

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.wifi.IWifiManager.getScanResults	com.vqs.livewallpaper

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs

persistence

Broadcast Receivers

T1624.001

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	com.vqs.livewallpaper

Checks if the internet connection is available 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.vqs.livewallpaper

Queries the unique device ID (IMEI, MEID, IMSI) 1 TTPs
discovery

System Network Configuration Discovery
T1422

Listens for changes in the sensor environment (might be used to detect emulation) 1 TTPs 1 IoCs

evasion

User Evasion

T1628.002

description	ioc	Process
Framework API call	android.hardware.SensorManager.registerListener	com.vqs.livewallpaper

com.vqs.livewallpaper
1⤵
- Requests cell location
- Checks CPU information
- Queries information about running processes on the device
- Queries information about the current Wi-Fi connection
- Queries information about the current nearby Wi-Fi networks
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Checks if the internet connection is available
- Listens for changes in the sensor environment (might be used to detect emulation)
PID:5198

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Privilege Escalation

Defense Evasion

Execution Guardrails

T1627

Geofencing

T1627.001

Hide Artifacts

T1628

User Evasion

T1628.002

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Discovery

Location Tracking

T1430

Process Discovery

T1424

System Information Discovery

T1426

System Network Configuration Discovery

T1422

System Network Connections Discovery

T1421

Lateral Movement

Collection

Location Tracking

T1430

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.vqs.livewallpaper/databases/xUtils_http_cookie.db

Filesize
12KB

MD5
ea628e04765adaf4238a5dcdff4bbd51

SHA1
a801947619ea8c368efe9c006a324dc6339ac60b

SHA256
885e337c2156e4dbf2176a9677ade50418740532d222ccae5ad4aa371b54c6a4

SHA512
c0287b0e7b690a7231a37d1745c49f3d861b22aa65dd769ba6a8b5ab9da55443f749957781ee05a405019c39e1be45d37a971b821bffd62a1d5620bc39119abe

Download Submit
/data/data/com.vqs.livewallpaper/databases/xUtils_http_cookie.db

Filesize
4KB

MD5
28322998fd5d3911c5c892e19daf9b83

SHA1
67ff2566bc9e0377570856d21bfb8f3cf5c9bfc2

SHA256
edfa4ae4b326ad2b092ea797a2d596bd23b01ee2c47cea9cb9a451e6001a912f

SHA512
80e08b3e20d45aa0986c08ae8a5c3483c067b4aeb1365a29c480226e7251b63ce1e07aa56ec4b214ccac85c36c865b1d1eb328b83eeca1b3fbc2c3610a925c4a

Download Submit
/data/data/com.vqs.livewallpaper/databases/xUtils_http_cookie.db-journal

Filesize
512B

MD5
d11a0c50d66047f2c03f437009861f80

SHA1
89aa0b29eda817511f3f682d798bfbe52af9c56d

SHA256
c9bec8a3999b3cf79afb07c2b76934f13b2aaec972d64699f7ab0522399c3868

SHA512
500106160129f2e85e34087dd0f20e9c2fe135212548063b93b34954d9327354967ddf02389ad283307cc1b7aaf291e6758a05ef9c4d6233691f2d5fb0315a66

Download Submit
/data/data/com.vqs.livewallpaper/databases/xUtils_http_cookie.db-journal

Filesize
8KB

MD5
b179f0ac33ac90ae7da5f004de7c65ad

SHA1
86d744123aeaf98b1fef3bb062123b0282d2e132

SHA256
b4b9d4a4198b5011f490f0d782dc19e72ee0cf5950c302857323b156f1583838

SHA512
0da0cae3277c4cc279a5619c761d94118052d9194994efea4cc30e7a8ff82bee939d1c884466db69f1e9238683c29e8fd4bd5aa0bcd20d757a699dc28f8f030b

Download Submit
/data/data/com.vqs.livewallpaper/databases/xUtils_http_cookie.db-journal

Filesize
4KB

MD5
48cae67bcfc885b623ba0b250a8ade99

SHA1
3ea98a7b202a2ea59f7570d7254977d9b75550e4

SHA256
2a37c90c26c62bf7a7b56fd4670b48e1966194e509dd18b6df4003bfbe3d0bf4

SHA512
c32cd3dc65814d2ecf9d31c60418714a5396cc1d599e73e3b37f898a07d8dff3427329d15e13e2acf6614d84aedece2ec09282557b5d65051965c1dfdc9d5f2f

Download Submit
/data/data/com.vqs.livewallpaper/databases/xUtils_http_cookie.db-shm

Filesize
32KB

MD5
bb7df04e1b0a2570657527a7e108ae23

SHA1
5188431849b4613152fd7bdba6a3ff0a4fd6424b

SHA256
c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479

SHA512
768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

Download Submit
/data/data/com.vqs.livewallpaper/databases/xUtils_http_cookie.db-wal

Filesize
4KB

MD5
495e62d609fb3fa47d8d21f6f478bcfe

SHA1
839232e82682a8e93d1b6602054fbe77f47bf458

SHA256
08ef28da20116822e78d1f374cffdcf35b838bb472c721d7d1be92565637ed2f

SHA512
3aa72f146547c871dc8dfb7c26e8435f0b9b2a862d04764fd716715d808bdef47436836bf97b1a40229d7414012b0889bdac39239fb9d5ccd5b9fad87280f222

Download Submit
/data/data/com.vqs.livewallpaper/files/stateless/dW1weF9pbnRlcm5hbA== /dW1weF9pbnRlcm5hbF8xNzE1MjI1NzQwMTE3

Filesize
1KB

MD5
899f200c4e9af4c61a4f78dd1d74ccde

SHA1
177a77fbc966a16c352133e26807ed22273585eb

SHA256
8256572da23aa46508d38165e301f162e4728eb1b9d7e9ef0153d64520032807

SHA512
a6d7bd530d12b440a60cfb7170839f9d86f250fb4d4e6580aec97c5cbdd42518fa9f872c49e4dda2542941ea5058e957f96256dcbe27c03cd7395fbddce5aed0

Download Submit
/data/data/com.vqs.livewallpaper/files/stateless/dW1weF9pbnRlcm5hbA== /dW1weF9pbnRlcm5hbF8xNzE1MjI1NzcwMzY1

Filesize
1KB

MD5
ae028aeb9e8103d8628969ce3d3975ec

SHA1
a2614f84a906bdb330b2ace4ed676a85dc3f8194

SHA256
278ab6584b019deba13e4e0d1fea1e715e205ff724fd550695bdf6e5ad05a2b7

SHA512
c9a8203d489ec836b40605414e1a0f0ce9a94ad83996a7367f95e8eae2691f1319b77e26a4a751065772563a158356e151d789aec700983526b625f7919ea678

Download Submit
/data/data/com.vqs.livewallpaper/files/umeng_it.cache

Filesize
350B

MD5
c0afe9f7acfebcc85d9e68fd2fc99752

SHA1
1ef37fb4fb8011682c03f1c18a1e6af6b39e3d86

SHA256
7324c8bf5e171a84bf0c94e93e8d61c394f44e5b689ba45074c9f851e0f29240

SHA512
f841053139e766952bffb01e90196c33cad95568a07f3fa5de100cb55c5c1da9d10272fdbf210348e4dfc4993506a62de8e6b1c0cc5c1309463f43afbc112a92

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads