Analysis
- max time kernel
143s - max time network
171s - platform
android_x64 - resource
android-x64-20240506-en - resource tags
- submitted
14/05/2024, 08:32
General
- Target bed7b8533e3e362abd7cc9ab81bda4e67102387008edc6f9027cac6a9f7d392a.apk
- Size 8.9MB
- Sample240514-kfk9vagg7w
- SHA256 bed7b8533e3e362abd7cc9ab81bda4e67102387008edc6f9027cac6a9f7d392a
Malware Config
Signatures
- Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
- Checks CPU information 2 TTPs 1 IoCs
Checks CPU information which indicate if the system is an emulator.
- Checks memory information 2 TTPs 1 IoCs
Checks memory information which indicate if the system is an emulator.
- Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs
Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
- Queries information about running processes on the device 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about running processes on the device.
- Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.
- Queries the mobile country code (MCC) 1 TTPs 1 IoCs
- Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 2 IoCs
- Checks if the internet connection is available 1 TTPs 2 IoCs
- Queries the unique device ID (IMEI, MEID, IMSI) 1 TTPs
- Reads information about phone network operator. 1 TTPs
- Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 2 IoCs
Processes
-
com.qingxi.yuefuxinyun1⤵
- Checks CPU information
- Checks memory information
- Obtains sensitive information copied to the device clipboard
- Queries information about running processes on the device
- Queries information about the current Wi-Fi connection
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Checks if the internet connection is available
- Uses Crypto APIs (Might try to encrypt user data)
-
com.qingxi.yuefuxinyun:pushservice1⤵
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Checks if the internet connection is available
- Uses Crypto APIs (Might try to encrypt user data)
Network
MITRE ATT&CK Mobile v15
Replay Monitor
Loading Replay Monitor...
Downloads
cc.db
cc.db
cc.db-journal
cc.db-journal
cc.db-journal
cc.db-journal
cc.db-journal
cc.db-journal
pushsdk.db
pushsdk.db-journal
.imei.txt
um_cache_1715675639354.env
exchangeIdentity.json
umeng_it.cache
test_app
ContextData.xml
Alvin2.xml
Alvin2.xml
Alvin2.xml
.imei.txt
common.less
iconfont.ttf
dele.png
logo.png
uploadimg.png
IndexedDb.js
audioplayer.js
basepage.js
data.js
http.js
LabelService.js
UserService.js
articleservice.js
authorsservice.js
collectionservice.js
fansservice.js
musicservice.js
praiseservice.js
worksservice.js
yunservice.js
updateVersion.js
util.js
webviewGroup.js
alloy-crop.js
alloy-finger.js
transform.js
jgestures.min.js
jquery-3.3.1.min.js
jquery.mousewheel.min.js
jsonsql-0.1.js
less.min-2.5.3.js
md5.min-2.10.0.js
mui.min.css
mui.picker.min.css
mui.ttf
mui.min.js
mui.picker.min.js
modernizr.2.5.3.min.js
hash.js
scissor.min.js
turn.html4.min.js
turn.min.js
zoom.min.js
vue.js
vue.min-2.5.16.js
zepto.min_1.2.0.js
manifest.json
about.html
about.js
about.less
appreciation.html
appreciation.js
appreciation.less
detail.html
detail.js
detail.less
list.html
list.js
list.less
new.html
new.js
search.html
search.js
subscribe.html
subscribe.js
attention.html
attention.js
attention.less
author.html
author.js
author.less
cicheck.html
cicheck.js
cicheck.less
cipu.html
cipu.js
cipu.less
data.js
collection.html
collection.js
collection.less
comment.html
comment.js
comment.less
copyright.html
copyright.js
copyright.less
diangu.html
diangu.js
diangu.less
diangudata.js
peopledata.js
editor.html
editor.js
editor.less
fans.html
fans.js
favorite.html
favorite.js
format.js
gelv.html
gelv.js
gelv.less
index.html
index.js
index.less
util.js
editor.html
editor.js
editor.less
book.Less
book.html
book.js
menu.html
menu.js
menu.less
main.html
sub.html
editor.html
editor.js
editor.less
author.html
author.js
collection.html
collection.js
list.html
list.js
list.less
search.html
search.js
login.html
login.js
login.less
message.html
message.js
message.less
search.html
search.js
search.less
my.html
my.js
my.less
password.html
password.js
password.less
detail.html
detail.js
detail.less
list.html
list.js
list.less
city.data.js
profile.html
profile.js
profile.less
register.html
register.js
register.less
shicheck.html
shicheck.js
shicheck.less
startup.html
startup.js
zone.html
zone.js
zone.less
works.html
works.js
works.less
data.js
yunbu.html
yunbu.js
yunbu.less
detail.html
detail.js
zuci.html
zuci.js
zuci.less
eje3cnc