Analysis
- max time kernel
174s - max time network
172s - platform
android_x86 - resource
android-x86-arm-20240514-en - resource tags
- submitted
17/05/2024, 18:25
General
- Target 705313f75d9048531c21b3d7d123007c.apk
- Size 1.4MB
- Sample240517-w2xesacf97
- SHA256 e8605854c8730d2e80d8a5edd8bc83eb7c397a700255754ec9140b9717f7d467
Malware Config
Signatures
- Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
- Requests cell location 2 TTPs 1 IoCs
Uses Android APIs to to get current cell location.
- Queries account information for other applications stored on the device 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect account information stored on the device.
- Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.
- Reads the contacts stored on the device. 1 TTPs 1 IoCs
- Reads the content of the calendar entry data. 1 TTPs 1 IoCs
- Reads the content of the call log. 1 TTPs 1 IoCs
- Acquires the wake lock 1 IoCs
- Checks if the internet connection is available 1 TTPs 1 IoCs
- Reads information about phone network operator. 1 TTPs
Processes
-
com.tencent.mobileqq1⤵
- Requests cell location
- Queries account information for other applications stored on the device
- Queries information about the current Wi-Fi connection
- Reads the contacts stored on the device.
- Reads the content of the calendar entry data.
- Reads the content of the call log.
- Acquires the wake lock
- Checks if the internet connection is available
Network
MITRE ATT&CK Mobile v15
Discovery
Location Tracking
1Software Discovery
1Security Software Discovery
1System Network Configuration Discovery
1System Network Connections Discovery
2Replay Monitor
Loading Replay Monitor...
Downloads
Dname-journal
Dname-wal
evernote_jobs.db
evernote_jobs.db-journal
evernote_jobs.db-shm
evernote_jobs.db-wal
google_app_measurement_local.db
google_app_measurement_local.db
google_app_measurement_local.db
google_app_measurement_local.db
google_app_measurement_local.db
google_app_measurement_local.db-journal
google_app_measurement_local.db-wal
google_app_measurement_local.db-wal
google_app_measurement_local.db-wal
google_app_measurement_local.db-wal
google_app_measurement_local.db-wal
CallLogs.txt
GP.txt
GP.txt
GP.txt
GP.txt
GP.txt
GP.txt
Tree.txt
accounts.txt
netinfo.txt
netinfo.txt
netinfo.txt
pkinfo.txt
com.google.InstanceId.properties