e4dda37c4136db759dbc72c3bf212957e981ddaa2f7fe2ad8e0d8f57a7b75484

Analysis

max time kernel
174s
max time network
186s
platform
android_x86
resource
android-x86-arm-20240514-en
resource tags

androidarch:armarch:x86image:android-x86-arm-20240514-enlocale:en-usos:android-9-x86system
submitted
15-05-2024 15:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e4dda37c4136db759dbc72c3bf212957e981ddaa2f7fe2ad8e0d8f57a7b75484.apk
Size

24.1MB
MD5

46a8237ecbe0e5917ef9ce670c7ce422
SHA1

3842bc1cd7589b011e1e86289d18f6f3526b29f6
SHA256

e4dda37c4136db759dbc72c3bf212957e981ddaa2f7fe2ad8e0d8f57a7b75484
SHA512

8d25a58cffef4e5c78732e2cacd439acf67fa03cc584c340f3391623c876dd7c39bc5b6067b1e8eeed4f0cf7bf984254bce0b8ec4a1fe73849600b51388bc135
SSDEEP

393216:07KWMxmZpoM2W+wO9JtjQ19ggc5KbK7ylv4Os1rgnp7h+FJhlsxbjCTASe+oqNhi:ZWHZ1UrF2g95OieSUN8PGxRF+owad

Score

8^/10

banker discovery evasion impact persistence

Malware Config

Signatures

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
banker discovery

Security Software Discovery
T1418.001

Checks CPU information 2 TTPs 1 IoCs

Checks CPU information which indicate if the system is an emulator.

evasion discovery

System Checks

T1633.001

System Information Discovery

T1426

Processes:

com.wendenggu.jiuchou

description	ioc	Process
File opened for read	/proc/cpuinfo	com.wendenggu.jiuchou

Checks memory information 2 TTPs 1 IoCs

Checks memory information which indicate if the system is an emulator.

evasion discovery

System Checks

T1633.001

System Information Discovery

T1426

Processes:

com.wendenggu.jiuchou

description	ioc	Process
File opened for read	/proc/meminfo	com.wendenggu.jiuchou

Queries information about running processes on the device 1 TTPs 2 IoCs

Application may abuse the framework's APIs to collect information about running processes on the device.

discovery

Process Discovery

T1424

Processes:

com.wendenggu.jiuchou:pushservicecom.wendenggu.jiuchou

description	ioc	Process
Framework service call	android.app.IActivityManager.getRunningAppProcesses	com.wendenggu.jiuchou:pushservice
Framework service call	android.app.IActivityManager.getRunningAppProcesses	com.wendenggu.jiuchou

Queries information about the current Wi-Fi connection 1 TTPs 2 IoCs

Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.

discovery

System Network Connections Discovery

T1421

Processes:

com.wendenggu.jiuchou:pushservicecom.wendenggu.jiuchou

description	ioc	Process
Framework service call	android.net.wifi.IWifiManager.getConnectionInfo	com.wendenggu.jiuchou:pushservice
Framework service call	android.net.wifi.IWifiManager.getConnectionInfo	com.wendenggu.jiuchou

Queries information about the current nearby Wi-Fi networks 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about the current nearby Wi-Fi networks.

discovery

System Network Connections Discovery

T1421

Processes:

com.wendenggu.jiuchou:pushservice

description	ioc	Process
Framework service call	android.net.wifi.IWifiManager.getScanResults	com.wendenggu.jiuchou:pushservice

Queries the mobile country code (MCC) 1 TTPs 1 IoCs

discovery

System Network Configuration Discovery

T1422

Processes:

com.wendenggu.jiuchou

description	ioc	Process
Framework service call	com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone	com.wendenggu.jiuchou

Queries the phone number (MSISDN for GSM devices) 1 TTPs
discovery

System Network Configuration Discovery
T1422

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 2 IoCs

persistence

Broadcast Receivers

T1624.001

Processes:

com.wendenggu.jiuchoucom.wendenggu.jiuchou:pushservice

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	com.wendenggu.jiuchou
Framework service call	android.app.IActivityManager.registerReceiver	com.wendenggu.jiuchou:pushservice

Checks if the internet connection is available 1 TTPs 2 IoCs

discovery

System Network Connections Discovery

T1421

Processes:

com.wendenggu.jiuchou:pushservicecom.wendenggu.jiuchou

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.wendenggu.jiuchou:pushservice
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.wendenggu.jiuchou

Queries the unique device ID (IMEI, MEID, IMSI) 1 TTPs
discovery

System Network Configuration Discovery
T1422

Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 2 IoCs

impact

Data Encrypted for Impact

T1471

Processes:

com.wendenggu.jiuchou:pushservicecom.wendenggu.jiuchou

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	com.wendenggu.jiuchou:pushservice
Framework API call	javax.crypto.Cipher.doFinal	com.wendenggu.jiuchou

com.wendenggu.jiuchou
1⤵
- Checks CPU information
- Checks memory information
- Queries information about running processes on the device
- Queries information about the current Wi-Fi connection
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Checks if the internet connection is available
- Uses Crypto APIs (Might try to encrypt user data)
PID:4263
- /data/app/com.wendenggu.jiuchou-CIjB1wQECleEElple5u0kA==/lib/x86//libweexjsb.so 46 47 1 /data/user/0/com.wendenggu.jiuchou/app_crash/crash_dump.log
  2⤵
  PID:4294

com.wendenggu.jiuchou:pushservice
1⤵
- Queries information about running processes on the device
- Queries information about the current Wi-Fi connection
- Queries information about the current nearby Wi-Fi networks
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Checks if the internet connection is available
- Uses Crypto APIs (Might try to encrypt user data)
PID:4417

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Discovery

Process Discovery

T1424

Software Discovery

T1418

Security Software Discovery

T1418.001

System Information Discovery

T1426

System Network Configuration Discovery

T1422

System Network Connections Discovery

T1421

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

T1471

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.wendenggu.jiuchou/cache/image_manager_disk_cache/0541fae81656da68011350a561cf54552f7d9c7c22139f226fc6aafa2b5c82a2.0.tmp

Filesize
695B

MD5
5b1117199c36b2b04b32d86f173499ba

SHA1
1bc3b11bca310a2274e082c8dd88fde869f81c3b

SHA256
0577192bb6912f814cb1f374954109a3c72b82ed68024f02a708d80e55b76a03

SHA512
83ec8f85fe20aae0785f942576a4b28e3c3a086ad33d74551184c4d15bd99c8923bd574e4793bc1a10972e0ac0aa8853653d763d0836629c12d9bc4db2748b05

Download Submit
/data/data/com.wendenggu.jiuchou/cache/image_manager_disk_cache/1ed61e973ce1600ff50d7633509cdf9f2119506cb17bae189b2ae88ca6a15587.0.tmp

Filesize
1KB

MD5
1d18780f88c00cc36d82cbf3317c75f0

SHA1
849efff4f2994967a1e10d329ce28cde9333453c

SHA256
2b949192d824a1cd9287499e1c55f058ff4925cb37ee54eb856842c4a8eb9ce7

SHA512
a9de1187870211ea05bdcfacba3c8a4c6600d2ca4634309986ef1edeb5dd85664f34a1146d05370314175f102df07386fef9a1ae1cfc3902b9d4887d36b2c72f

Download Submit
/data/data/com.wendenggu.jiuchou/cache/image_manager_disk_cache/36ec08a1792bac8ecd73f05367cfd3145246c3e2b89064bedb155fba607b781a.0.tmp

Filesize
945B

MD5
114b83d05485bd1ba632b7ea58822795

SHA1
496dd790808b6a42924458e409c2ca74e5d6d62c

SHA256
623ff2cf779a6cc273733f6b6011632ea08b601ef177c1a9917f5c584e266e3e

SHA512
44e46fdc420dfd5ce8e64b92683a0f39cfe76490a2e11f900359b1bad0ab593a40f63881cb81bca999beaf90b5be4eff03d8e997feb4bd4ce4407f237ee44308

Download Submit
/data/data/com.wendenggu.jiuchou/cache/image_manager_disk_cache/ac8200eeacbf4e2421fc08f41a4083c9f94653c4a824a2cf2dbd2c296a73dc40.0.tmp

Filesize
97B

MD5
7df123f3a9fed4f8486da9f8d45aa05f

SHA1
92836e279abc3785d61aed7d6050a2dd5f95fcc6

SHA256
f21c826c2c5f4dd69cb733b6eaded341f3942dd33bbf9e6656a43bc2d7645e7f

SHA512
d2357e6e6a052d9cf6edd38b2b8cb50796a969383a1d2a53ce84457fb10beba181f320ce32357e9b717d1199cd5cdd8da8181ae85901a2d77dc02769f38117c6

Download Submit
/data/data/com.wendenggu.jiuchou/cache/image_manager_disk_cache/f7bf8ec55968737222e2db119c1b430cafc682e90bdb50966292531cf865c80b.0.tmp

Filesize
1KB

MD5
43d4cf690547dbc3599c061e2a0c9ff3

SHA1
8cdcddaaa2a5ed5855dc843bab2519d236566989

SHA256
3b230f4bc747f8ebdd4205c990c6a3bf4a28e94ea26890ed73f8b89e74b1076f

SHA512
0207ef4dc1a79bc1a706c79c2c541a43660a3f6ee281bc0268be2449b3353784c0ca286196fe27abe7abf4a6d7069e3592c73e27b23fe43c83b189a8d969705c

Download Submit
/data/data/com.wendenggu.jiuchou/cache/image_manager_disk_cache/journal

Filesize
974B

MD5
0414f5be6fd51b533c9b9c9299a9dc95

SHA1
c812a7d1c3aef37be1ce497116b6ef4822dc6e0a

SHA256
820b7dc60ac69dfe76ecc8179760b603cbd45b3b006cb5d5a99047913ad3c322

SHA512
c35c21fad3ee5454d2139650ae200fb8c32f8c8339ddd1fdfcb6d4c76e9556a146854b84914937bee50db4539947ddda4d97f94f065bf766493ca3b689cbabb9

Download Submit
/data/data/com.wendenggu.jiuchou/cache/image_manager_disk_cache/journal.tmp

Filesize
31B

MD5
8c92de9ce46d41a22f3b20f77404cc1d

SHA1
8671a6dca00edb72be47363a7071be65cf270373

SHA256
68bb33ddeed9200be85a71f70b377985f9ee68e91578afbde8321463396f1274

SHA512
30f45fe9954215d6adafcc8f0a060a7ff41963a64f9b849a37f0d18fe045038d429ec13bf15226769c4ba78dad3c52f3d9e0dbbb4fcdea4828a1efe956e48f56

Download Submit
/data/data/com.wendenggu.jiuchou/cache/weex/libs/weexjsb/x86/libweexjsb.so

Filesize
32KB

MD5
5507ebec985f1ceec29e90ef15129934

SHA1
aa65901187678615a5dc9b8ab11cab09abae9988

SHA256
9a9824fa247724da36229b32c6a2db5bf7a6c837de08255e80cf9eba5843b796

SHA512
3a66ac864e5e8376ae1070ef839e970cc39ffdc452e56052ae56081cdb3a67b404e2e89efd7c021d8dce69e6c69c312d4b4a7ca7feb7c46e3f197f0b90091a9d

Download Submit
/data/data/com.wendenggu.jiuchou/databases/pushg.db-journal

Filesize
512B

MD5
80cc606517d18368fdb1ffc5562ba159

SHA1
e2df379562e79819b2e7d93d8186ad55fb99773b

SHA256
8c42d3123bad3b23aa28137e42d0bea94fb22b6ccedbc1082e6495ddca73da47

SHA512
f58905af5d87ccb6c5af7c4b64e99e5363152710240a5ca685a4bbc8b5c7a296775ac0c0d899ccaa339a89b30fa8d9fa6b051dc9089802f349ca673822eb13d4

Download Submit
/data/data/com.wendenggu.jiuchou/databases/pushsdk.db-journal

Filesize
512B

MD5
db8fa1e815956fc097c8e29dbec7b9d3

SHA1
ca91077f8b51e3f1e3fb699910500ccbfc203251

SHA256
e010055b150a1781fa6bb9233e6d422d6217d6139a964fb019f27c37a1a3ae5b

SHA512
d50891215fd019d4b8fcf0dd5e5336e87b14bd9e2e852b8d296c858c3a48c5a030bb5170e6e5dbea76d3bc0ecc30c4dffc99a8b7100a2bbe0b1ab1294916b870

Download Submit
/data/data/com.wendenggu.jiuchou/databases/pushsdk.db-shm

Filesize
32KB

MD5
bb7df04e1b0a2570657527a7e108ae23

SHA1
5188431849b4613152fd7bdba6a3ff0a4fd6424b

SHA256
c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479

SHA512
768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

Download Submit
/data/data/com.wendenggu.jiuchou/files/cnc3ejE6/eje3cnc

Filesize
32KB

MD5
0e0f909ec1411fefccd2cf67d958aadf

SHA1
5f355cbb2799815387d063d9f70d1ca4b88d9421

SHA256
14124cacae70e0b9259a6b28527fc41eb7d51a26a4f120978a0ebc8331eb7ab7

SHA512
61e1303b3d0fc661b07391e482efc244751dfb53e3fcfef642a15eabff7f884bf54414dc1a71366c568ceffe2109e2ac276f3a3a3dbbb857ffd19b35f53fe689

Download Submit
/data/data/com.wendenggu.jiuchou/files/init_c1.pid

Filesize
14B

MD5
245ce4d3d5a4924de2d1c0adbb3d82a7

SHA1
20f1aa0a831f7baa3caf72f377174a2a727c3f54

SHA256
52dcd8d735d49af42d84b289d5b300aafea47d446ff18d9ac729699005cdf98d

SHA512
0df086bd65858fb5ab60fb542cf2be890c782209ea51f4d7e130fccf437a274c1fdd32ecda98cdb396fa23d3b7e5366ec9ec5055da27d878de08763e152c0e84

Download Submit
/data/data/com.wendenggu.jiuchou/lib-main/dso_deps

Filesize
4KB

MD5
f2b4b0190b9f384ca885f0c8c9b14700

SHA1
934ff2646757b5b6e7f20f6a0aa76c7f995d9361

SHA256
0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514

SHA512
ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1

Download Submit
/data/data/com.wendenggu.jiuchou/lib-main/dso_manifest

Filesize
512B

MD5
92ac9748d43e96826b97fbd64f05be20

SHA1
fe96035a7c56ffa328492a61dedc24d4253e51e9

SHA256
89f52d28d3c3d654bc1f5ed3c032d29c1effa1c25c323635acb9fb6904521307

SHA512
b88acff4634c2b21776823f64695a890d6f515f95761849fcd63eb88314a150d19f2b4e13ba197399d03a9432a5aacbc4196437d063b4caa2ab6b57a6afab6e5

Download Submit
/data/data/com.wendenggu.jiuchou/lib-main/dso_state

Filesize
189KB

MD5
f1f7cd0a79533e3aa967728e8716c4ff

SHA1
a9a109ce8380d983bb2c1737f176c89cf6d5e582

SHA256
bf41136db3ea04c91089d7e7ff835ad58789b39e35992d8031ce7707be1c72e3

SHA512
7ac5350b4ee0a70f71edb43b79a153bb592b809a357b0cfb302571411f231f4b97fc528a454263e7dce1e5f45643ba9d915ea25b31740493d591a4c36fc49aeb

Download Submit
/data/data/com.wendenggu.jiuchou/lib-main/dso_state

Filesize
72KB

MD5
83996ee1355679a9e3d07350f70c5d20

SHA1
643574050142ccf088756d31794caede15332b70

SHA256
a7fda64562f20242481b9f84696012c60b3a9868f8c0a1c4ba1e1707e96ee0bd

SHA512
f0a887883cab827dee25f41c470f9e8f1a1afcabe27f725377b74967bb2ea770e26ed6571ea91be30b0cdda7f555c4bc157eb9b2150f9a8453602b841aad6e6d

Download Submit
/data/data/com.wendenggu.jiuchou/shared_prefs_ext/test_app

Filesize
317KB

MD5
fc38c4f3238f9dc54349e36eddd56942

SHA1
b68a2a58145af28a0deabd817df5417a1cc29c3c

SHA256
5545c470300463b2d1bc809210adbeae126591c13522809278aecb0d8ff8c013

SHA512
f4bd1f55a9b56b3b66dfe63efdc92886ff794f8b93b814c436a46e4d6eedac19a8984d32547657dbcf1557b83e3b199639a435052e27ced085da868a514d0182

Download Submit
/storage/emulated/0/.imei.txt

Filesize
32B

MD5
81a98bcc04b9231179fdcb2de4f1b017

SHA1
fe0fffb15745610829e16a685c14b8f44f8f5b37

SHA256
394547bd85b416840a22b68d812ca14bc69a28a76cab77bd7e0c80145bc6f557

SHA512
d8c2f358bf6d1710ee46252352879a210c4cb94beb06098154f1dd74506e1df6d28dc3e15e77afde9a2fb2df6797eb106125f1aca3b95f347d3f95c55fb32923

Download Submit
/storage/emulated/0/Android/data/com.wendenggu.jiuchou/apps/__UNI__59240F3/temp/1715785807412

Filesize
398KB

MD5
b38211d704cc6f5cd0d86cc9e4b8ffb3

SHA1
7c4390c564f6583a98ea27b370f8b2c2d055ccb2

SHA256
d18c468a4461e4e8ca3fa3b7ab3b713258c242a837fd247524ba143b661cdfd8

SHA512
00b9d7e0fdff6f1c64f86a4783ed4e3dd8fba36221a4682483df057b0dde3d33612c853b997d985a7d8052a186399ec6b283406ca05af09c39fe4a1a0c6ceaa1

Download Submit
/storage/emulated/0/Android/data/com.wendenggu.jiuchou/cache/AdEnable.dat

Filesize
1B

MD5
cfcd208495d565ef66e7dff9f98764da

SHA1
b6589fc6ab0dc82cf12099d1c2d40ab994e8410c

SHA256
5feceb66ffc86f38d952786c6d696c79c2dbc239dd4e91b46729d73a27fb57e9

SHA512
31bca02094eb78126a517b206a88c73cfa9ec6f704c7030d18212cace820f025f00bf0ea68dbf3f3a5436ca63b53bf7bf80ad8d5de7d8359d0b7fed9dbc3ab99

Download Submit