5c8dd6c1676d2c094b0ed7d36fb94e0993ccd7c74dc9f323e8fc98728ba27ef5

Analysis

max time kernel
137s
max time network
163s
platform
android_x64
resource
android-x64-arm64-20240506-en
resource tags

androidarch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20240506-enlocale:en-usos:android-11-x64system
submitted
12/05/2024, 14:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
muzhiwanapp.apk
Size 6.7MB
Sample240512-rw2ebsdf72
SHA256 efa8e431c5d5b3bda3cfc0da4392d14ef447643412bbea22536a155c7aae82b4
MD5 f166fff17a539f053550965c87c42054
SHA1 8be071793576b6e324db218f02a017439fe826a3
SHA512 26869689b5a58e52e63d95b07cf04f560c4580e9bd408a432a61acace492201ffe93cb7e4166a360530eff8fa3827ae0df83ee43e30daa7f670010d59a8bab8a
SSDEEP 98304:thCSkJBDmTuhW+7eF0JUQ4KMB6NQP4WfxRENHpxPOJHMMC1dh4Zadvtvc8Y6dtR3:nru6wUQMBj4WfOHp+HPC1z4mkKdYIx
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

banker collection credential_access discovery evasion impact

Malware Config

Signatures

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
banker discovery

Security Software Discovery
T1418.001

Checks CPU information 2 TTPs 1 IoCs

Checks CPU information which indicate if the system is an emulator.

evasion discovery

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	com.muzhiwan.market

Loads dropped Dex/Jar 1 TTPs 4 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/data/com.muzhiwan.market/data/mzw.apk	4951	com.muzhiwan.market
/data/data/com.muzhiwan.market/data/mzw.d	4951	com.muzhiwan.market
/data/data/com.muzhiwan.market/data/mzw.apk	4995	com.muzhiwan.market:mult
/data/data/com.muzhiwan.market/data/mzw.apk	5093	com.muzhiwan.market:mzwlogservice

Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs

Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.

collection credential_access impact

Clipboard Data

T1414

Transmitted Data Manipulation

T1641.001

description	ioc	Process
Framework service call	android.content.IClipboard.addPrimaryClipChangedListener	com.muzhiwan.market

Queries information about running processes on the device 1 TTPs 3 IoCs

Application may abuse the framework's APIs to collect information about running processes on the device.

discovery

Process Discovery

T1424

description	ioc	Process
Framework service call	android.app.IActivityManager.getRunningAppProcesses	com.muzhiwan.market:mult
Framework service call	android.app.IActivityManager.getRunningAppProcesses	com.muzhiwan.market:mzwlogservice
Framework service call	android.app.IActivityManager.getRunningAppProcesses	com.muzhiwan.market

Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.wifi.IWifiManager.getConnectionInfo	com.muzhiwan.market

Acquires the wake lock 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.muzhiwan.market

Checks if the internet connection is available 1 TTPs 2 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.muzhiwan.market
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.muzhiwan.market:mult

Reads information about phone network operator. 1 TTPs
discovery

System Network Configuration Discovery
T1422

com.muzhiwan.market
1⤵
- Checks CPU information
- Loads dropped Dex/Jar
- Obtains sensitive information copied to the device clipboard
- Queries information about running processes on the device
- Queries information about the current Wi-Fi connection
- Acquires the wake lock
- Checks if the internet connection is available
PID:4951

com.muzhiwan.market:mult
1⤵
- Loads dropped Dex/Jar
- Queries information about running processes on the device
- Checks if the internet connection is available
PID:4995

com.muzhiwan.market:mzwlogservice
1⤵
- Loads dropped Dex/Jar
- Queries information about running processes on the device
PID:5093

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Clipboard Data

T1414

Discovery

Process Discovery

T1424

Software Discovery

T1418

Security Software Discovery

T1418.001

System Information Discovery

T1426

System Network Configuration Discovery

T1422

System Network Connections Discovery

T1421

Lateral Movement

Collection

Clipboard Data

T1414

Command and Control

Exfiltration

Impact

Data Manipulation

T1641

Transmitted Data Manipulation

T1641.001

Replay Monitor

Loading Replay Monitor...

Downloads

mzw.apk

Path /data/data/com.muzhiwan.market/data/mzw.apk
Size 17KB
SHA256 d0990058e5204d1a1bde2eff40893cb49d1e8972ee9b7e1b03ae35ac3cd5df8b
MD5 e65188742e10046597a4c648d045699b
SHA1 37b2f1e3e89d3b0d8683737ccae2ee725e82a312
SHA512 3859b177492c74ec9448f7c57cf37beb7c747dca9580125cbd7c2e1f3a7761a3736072b1ec2ee14fa1f844f13df4163aa167b5cb9010e7e7fd00b2724553d481
SSDEEP 384:s5X5qqwv/p1FQkfP7EI5dPbh69aFw4GoXzOOo6MGd5Ij//LQf:GXjwpokfPAI5dPbh69aFuoHOjnLs
MD5 SHA1 SHA512 SSDEEP

Download

mzw.d

Path /data/data/com.muzhiwan.market/data/mzw.d
Size 59KB
SHA256 f504965dcb90e138323c40cd153fe635f8485696c70dd4521b9202e20600b20f
MD5 d298011c4d28afbafe6f8eec94f19e65
SHA1 2aafd7454cd18efe0e9501258a3d4dc666961824
SHA512 322bdc154c211b9444d7eb44cec942002018ca0f4ab7513051e5548c891eece4a5505d178a716fcb1fd8e76d3d1ac12771b935b601e96f6cea3dd75b95757a83
SSDEEP 1536:tY3qpcH/obgLKxe7wust6XTyLaFcBowg/pL2Nka2MXX3C:QqKH/BKxXMXTym/pyKiXnC
MD5 SHA1 SHA512 SSDEEP

Submit Download

mzw.d

Path /data/data/com.muzhiwan.market/data/mzw.d
Size 33KB
SHA256 d9c6e60caf46fbde6806d9a435bf1cf9e75cd079e6ffdf15c7646455d1fc68e6
MD5 b29b924ea036a89d3fe128ad672b44d7
SHA1 de946ed8fa199708a925c144f816a60ce4679d50
SHA512 f8706d824ef68815b8ca5cdc01138fbe63afe6c9832cc757d94633c4b140809fe0a5018b7bf825c630870abd35e710ddc521ba1aabae8ef3d8223037537b739f
SSDEEP 768:Orfmq7x7olxUWtZZYvyzJGRuxC8Idm0nfR9REU/qAJodsC1L/71:Orfmq7x7olzJz7C8Idm0fR9RN/qAJoL/
MD5 SHA1 SHA512 SSDEEP

Download

mzw.g

Path /data/data/com.muzhiwan.market/data/mzw.g
Size 42KB
SHA256 7a28fd857e1283e351d37931cc6e23cd6de5ad2fd4d3d23337a6f162b07f3978
MD5 c04d422c5a4bf58a127bbf2bf014965c
SHA1 3b1f3f4ad21fe0febe567e5a56996a7e61658cf9
SHA512 6cb2768a8344e3da470472ea906b5be2e33a24384efe35cdc3c0b0c24351c3b34444a4d2d6a9e21c48927b85554aaa3904fb0361071c0711841565222253e0a8
SSDEEP 768:ccPeR+EU5maX9WkB/gUrXFWLKxe7X+Fu9hRv6Xf3QpD+X7aFkuzkjEC:ccPeRiNWkZbgLKxe7wuzt6XCyLaFm3
MD5 SHA1 SHA512 SSDEEP

Submit Download

download

Path /data/user/0/com.muzhiwan.market/databases/download
Size 16KB
SHA256 8007d95e9f9cea362d7e6c352267afaba8f8c0dc4b31395e1d49b8f2d28006f2
MD5 b8390048bd31b299472e248b8a7b7afb
SHA1 711d6e64e28199649b22692ef48291974eb78ce6
SHA512 812d1fa18385aa792e0befd8f0d99ebaa251103c6016eb3ee1ee4349000fdd2c9fb6e04b6c6f4fd6da2e6c525f4cd4e70834f2e450622adb151a37630a527767
SSDEEP 12:TLp/C8qPgJ0XJHx4ISuSFiA7I24+s3hyx4wzRmBEyPbBvOw:TLACCX7/SDEmfMGSN
MD5 SHA1 SHA512 SSDEEP

Submit Download

download-journal

Path /data/user/0/com.muzhiwan.market/databases/download-journal
Size 512B
SHA256 9e676e2581045eb2019537cd13118e4e92267a0bf54999fa8db81b70bac08d9b
MD5 c234a6e415df349f1475e3377ebecbe6
SHA1 f7870464b726c8d02c7bd3d1c9b38a44183de19b
SHA512 b2937492e312eb856de9d9083a22a611722d47c848f7ec9f02354e81224854170b4073b2a61106f4f34233bb7698dbeaec93f3114949a8056d66fe387ce25f12
MD5 SHA1 SHA512

Submit Download

download-journal

Path /data/user/0/com.muzhiwan.market/databases/download-journal
Size 8KB
SHA256 c5bcc1deba467dae90a07db09da33d9ab055074a908444a5591b0b38d97ee3b0
MD5 f7b228e8c688500d071966bb4eda3e68
SHA1 44d0009e4a482fe88ea0617195e48157ab104c63
SHA512 e2890d7fb5698713d7771c557e349baf11010fb482395fa5af0f02a5ca03474411b3ad4b0a793a929ccc85ba63d46fb7266a1920b403244089b4139b7701aced
SSDEEP 6:7+/l9Gn1hvg9bNFlEuWdN/kPlOERX4PBX4ogLugMBX4suuKK:7+t8qLiuWdYRmBEyPbF
MD5 SHA1 SHA512 SSDEEP

Submit Download

download-journal

Path /data/user/0/com.muzhiwan.market/databases/download-journal
Size 8KB
SHA256 15628f0d838667a1747544874b813acd6feec10ae40bdbcedcc1f0b5ac638c9d
MD5 49add7623c53b183906b4b1f6b9372e8
SHA1 43968b62cd3c51a3c827b9de1022603c2f619101
SHA512 7d8b490100c95c3176c2eed231a768b8275528b4182ee79425c45da9b7b646237b5685adcb9017d21d24b0b61083426fde75f529cf1d294b030e5a23e77ad13d
SSDEEP 6:7+/l9kPg9bNFlLde/kPlOERX4PBX4ogLugMBX4suuK1/w2:7+tuqLJdeWRmBEyPbWw2
MD5 SHA1 SHA512 SSDEEP

Submit Download

notes-db

Path /data/user/0/com.muzhiwan.market/databases/notes-db
Size 16KB
SHA256 ddbbdfe580ccd820fefefb814ecb050efe134731aa6560eb803171ff497c73d7
MD5 b7ae69e37a108d17e0ddffe65f93c366
SHA1 918abcf997e5bcf2630767d213d75c4d6857ff9b
SHA512 19a5f278ea743bb61b402abfd5b806656be873de3caabcc3519eea6d2481abc2a6f205c102fedacadea615755e107a623313aa9b896234d4ddb06a9d6c16ba56
SSDEEP 12:TLpEhG2mD8dpw11iGxwNLclTID6rmG98RmBEyPbBvOw:TL4GGMLi5LYcD66GNGSN
MD5 SHA1 SHA512 SSDEEP

Submit Download

notes-db-journal

Path /data/user/0/com.muzhiwan.market/databases/notes-db-journal
Size 512B
SHA256 bb8573465a6513208fc7016efd0c233bb94b85c565d2a34a3897171b0c867b55
MD5 667e026edbf055cf1684626cc6d32862
SHA1 d741109e148d0b619489483862841442b33242de
SHA512 fc79ae753988f12cc45feedbc2bf386ce609d6f62e9a478a44e45b8fe7f7f0f16c7f8d420c25b3ddffaeb296315c9d7d2c07234b969d3b61488148d98590c038
MD5 SHA1 SHA512

Submit Download

notes-db-journal

Path /data/user/0/com.muzhiwan.market/databases/notes-db-journal
Size 42KB
SHA256 14b68457395896d3ffe12b777f52fe2cc4182a6c9ba383555b12522c93657b00
MD5 7bc525aa5cfd71cd4d2ad570fd72a906
SHA1 b411e1b345b5e9e4a0e4f603b46277278981e921
SHA512 5f1973360665bdeb536d8dc2a9c5d2077990fbc6fd3653747de9d54c7032a776151f39986792ab57773623a143b2d65cfbb585aa53c823197485eba9e75c8e2f
SSDEEP 768:ccPev5+EU7aX9WkB/gUrXFWLKxe7X+Fu9hRv6Xf3QpD+X7aFkuzkjEC:ccPehi4WkZbgLKxe7wuzt6XCyLaFm3
MD5 SHA1 SHA512 SSDEEP

Submit Download

notes-db-journal

Path /data/user/0/com.muzhiwan.market/databases/notes-db-journal
Size 8KB
SHA256 9e163e84120c10cbe577495d2b4ce89f09108f4e16382a2a53320184563331ee
MD5 0ed964bbe74fecf2074d2fa038e9585c
SHA1 1c9d2aa1fe53993750055266fbb3ab57db264c6e
SHA512 26f85759f4ec6ae469d45846ddad6fce5abfa4559051d24511928547ff2553e3b99802b9208c0e69d26b875119a72633d72ce30e7c6d992288f0e8d9aeb3c10c
SSDEEP 96:1qYevvTq6MLG6nH8oUvTq6MLG6nH8oO13fY:oYevGXJH4GXJHKe
MD5 SHA1 SHA512 SSDEEP

Submit Download

um_cache_1715524505070.env

Path /data/user/0/com.muzhiwan.market/files/.um/um_cache_1715524505070.env
Size 604B
SHA256 e65ff2776d3d22da128660adc4d99e16ecf1fd654debf6a9f49475b5ee712159
MD5 82bb93c5808de0d92462ec1eba3f2adb
SHA1 4a41b0e5c5240aa111d842fd3ba282308b595d14
SHA512 374429e55c3fed817ccb7853c35962708fa14dd61d00c3a3220f775f25a2d0581378ebbd89ab849e2f1ce8ed598a82de1f1dfae9d0fd2ecef8f7543164ff12eb
MD5 SHA1 SHA512

Submit Download

exchangeIdentity.json

Path /data/user/0/com.muzhiwan.market/files/.umeng/exchangeIdentity.json
Size 162B
SHA256 60e3c5e1cc2eabcb45025269ae3ee2f6a514f0e08e8bf23810b61f882374677b
MD5 c007a0aa50fa44b2771a204d0d97030a
SHA1 fa47b262490f1658d2d2754ea63822dd4d904364
SHA512 aa78dede5bddeb74ea44d22b1d1c53244923565446fd3c8932365989f8e35e0f11a242fddd74a2ece26595592cc6cbe6d26cd835e6ba230e782d086ab698e656
MD5 SHA1 SHA512

Submit Download

install_file_dir

Path /data/user/0/com.muzhiwan.market/files/install_file_dir
Size 5KB
SHA256 2da45ce16e8ba4b4326f0b34c1de5a9f1b10c91c2a42b212688cb7d6784d2e5f
MD5 a09ec250f84f4417b6ed98615552c669
SHA1 18f292042e86b464d33dd72d99f34547a8bfd6a9
SHA512 238ce921635d02d7af87bede401cc261499542b8aea7c885e90f2cd4f5790710944c78f4e988d3cb20d024b3e5eb783f1b41821ada51c7d7167aad44b283d8c0
SSDEEP 96:1qYevvTq6MLG6nH8oUvTq6MLG6nH8oO13fH:oYevGXJH4GXJHK1
MD5 SHA1 SHA512 SSDEEP

Submit Download

install_file_dir-journal

Path /data/user/0/com.muzhiwan.market/files/install_file_dir-journal
Size 1KB
SHA256 f80c80a841ec964acdd2944883662095552e8a11e725d35a4c1881099d99eca4
MD5 7e2ba7a51c98a9e6ee450ece0f7f9045
SHA1 cb2244f596f5cc2b333f4ad721929e973664eef4
SHA512 36ed18a553113e04d3a900ba6a6988bdbae5402ef35c0a1e1bdf05723060a34252aa752d26aac10e2db52cf261f4ac45c5e9d5d31ee47d7e66ff771c807caaa4
MD5 SHA1 SHA512

Submit Download

install_file_dir-journal

Path /data/user/0/com.muzhiwan.market/files/install_file_dir-journal
Size 2KB
SHA256 342c39dff32c97c1e0ccdf16b42f725edef3ab03a23ff2577a6838d7511bb1eb
MD5 93c6b6e954fe4c4b3f71e98f250dc6f0
SHA1 dc1a8439fc61b939f859f2a15b90885dd968228e
SHA512 5e70c5af07cb8bf63410b2668a249179186a3f245b23539e8ea99df849466e6f7f683f92f457c3ff8dabdde6cbfa239dea01076b2d9c4fad8f6ea6c1dfb54c0b
MD5 SHA1 SHA512

Submit Download

jpush_stat_cache.json

Path /data/user/0/com.muzhiwan.market/files/jpush_stat_cache.json
Size 139B
SHA256 86d1b76984c9fc9f3f99c02060bc4f79e2f25b32a9e9438c73299da115b3ed19
MD5 e74d15f4f326e0950072bfded297794f
SHA1 3a3130acdbf3adbe1dd174047c09b30fc547aa45
SHA512 fd927b5f4e5b9717115afd3f28e21cec22dd1308f8c060da6b872054c0e60fc4ecbe884b9c296355c1c7b872569358cc20c18372843465e917483ac4a1869a90
MD5 SHA1 SHA512

Submit Download

umeng_it.cache

Path /data/user/0/com.muzhiwan.market/files/umeng_it.cache
Size 245B
SHA256 d78fe3af114a86ebbfaf874f29ee64e82dd2b48b51ab06b64f485db82be4af56
MD5 ad54898fec593eb13b3aaf48a6c19d3c
SHA1 05d2376e8697067dd06bdb0fc523d897ecf71132
SHA512 0248aa0cbafa3493609baee11acbde0cd42425871f338010ee9cf8070e1fdf7f88c59ea770351e25ddecaa6dfdb449c85306c6fc1a2ed26eb2f869e3cbd24551
MD5 SHA1 SHA512

Submit Download

.push_deviceid

Path /storage/emulated/0/data/.push_deviceid
Size 32B
SHA256 036126081c275bd04c94f393617507073cb02ab193dba7ac19a4abec3faf70e0
MD5 402bbcf7be2867037cd246d8544a1ed0
SHA1 dbb021accc463b90bffa6b1064bd6a4d4f566d55
SHA512 19d1fa39ef4aed37ab76cfae6571544fde31bc1cee5696d6f9c90f46f07babf27d0f811ecbe5d1bfe09f1da78b5c2e3481fac46900312299c017b7e6a11511c1
MD5 SHA1 SHA512

Submit Download

.systemid

Path /storage/emulated/0/data/.systemid
Size 42KB
SHA256 02e8ca53d9f08959a4180c69c497b00f7328c107c143e7360fd3e328c637acf5
MD5 0d70b94720e6c2cce48dd2447733b4bd
SHA1 407cfbaf54dac811325180a2c5861009d981a918
SHA512 6350f4884f8b8cf3f1b454c3a3944648b9df70952e953af4056a7727b4320c7ab003424b9bf85d84677e7dab1497068ce8c9ad1415871e7d4f28b4562590fa6f
SSDEEP 768:nYF5+EU7aX9WkB/gUrXFWLKxe7X+Fu9hRv6Xf3QpD+X7aFkuzkjEC:nYfi4WkZbgLKxe7wuzt6XCyLaFm3
MD5 SHA1 SHA512 SSDEEP

Submit Download

.systemmac

Path /storage/emulated/0/data/.systemmac
Size 2KB
SHA256 55e1fc8e1525ba6f8a4c38402dde63ed7252124feb4e0ffa9230dbc108b9a9d2
MD5 807f2f657ddb85221af9d667ce2c28eb
SHA1 3925a24543dbd9f5062e3d998051bed2dfbdf1b5
SHA512 2315ebc7ec67464b1e2bd7b36f6727ced1bf580b2624fed3d88ecbae3ccdb9be89271fad00d939770c2f8a6f19e0767151b347011a591dfbe1f11f61776b454f
MD5 SHA1 SHA512

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads