e8605854c8730d2e80d8a5edd8bc83eb7c397a700255754ec9140b9717f7d467

Analysis

max time kernel
176s
max time network
161s
platform
android_x64
resource
android-x64-20240514-en
resource tags

androidarch:x64arch:x86image:android-x64-20240514-enlocale:en-usos:android-10-x64system
submitted
17/05/2024, 18:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
705313f75d9048531c21b3d7d123007c.apk
Size 1.4MB
Sample240517-w2xesacf97
SHA256 e8605854c8730d2e80d8a5edd8bc83eb7c397a700255754ec9140b9717f7d467
MD5 705313f75d9048531c21b3d7d123007c
SHA1 73aea9a5a11623ee6709beb435f4c289355b1b3b
SHA512 f88c90d9681beddaea45d2ad78af47cee0d6f47222e89a9d486d75fb3365c7d1e1f7cc3a7bb74e6877000427e72eacf553c771fef2279a857617fc5480459f24
SSDEEP 24576:ej8HElKXD2sP2fldmkDLKBgLFF0e76xxIDIDyJYgx8F5UP3QXbpLPYc:ej8HElKX6sPuldhbLBmxIDIDgYk8g3uT
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

banker collection discovery evasion

Malware Config

Signatures

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
banker discovery

Security Software Discovery
T1418.001

Requests cell location 2 TTPs 1 IoCs

Uses Android APIs to to get current cell location.

collection discovery evasion

Location Tracking

T1430

Geofencing

T1627.001

description	ioc	Process
Framework service call	com.android.internal.telephony.ITelephony.getCellLocation	com.tencent.mobileqq

Queries account information for other applications stored on the device 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect account information stored on the device.

collection

Stored Application Data

T1409

description	ioc	Process
Framework service call	android.accounts.IAccountManager.getAccounts	com.tencent.mobileqq

Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.wifi.IWifiManager.getConnectionInfo	com.tencent.mobileqq

Reads the contacts stored on the device. 1 TTPs 1 IoCs

collection

Contact List

T1636.003

description	ioc	Process
URI accessed for read	content://com.android.contacts/data/phones	com.tencent.mobileqq

Reads the content of the calendar entry data. 1 TTPs 1 IoCs

collection

Calendar Entries

T1636.001

description	ioc	Process
URI accessed for read	content://com.android.calendar/events	com.tencent.mobileqq

Reads the content of the call log. 1 TTPs 1 IoCs

collection

Call Log

T1636.002

description	ioc	Process
URI accessed for read	content://call_log/calls	com.tencent.mobileqq

Acquires the wake lock 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.tencent.mobileqq

Checks if the internet connection is available 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.tencent.mobileqq

Reads information about phone network operator. 1 TTPs
discovery

System Network Configuration Discovery
T1422

com.tencent.mobileqq
1⤵
- Requests cell location
- Queries account information for other applications stored on the device
- Queries information about the current Wi-Fi connection
- Reads the contacts stored on the device.
- Reads the content of the calendar entry data.
- Reads the content of the call log.
- Acquires the wake lock
- Checks if the internet connection is available
PID:5113

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Execution Guardrails

T1627

Geofencing

T1627.001

Credential Access

Discovery

Location Tracking

T1430

Software Discovery

T1418

Security Software Discovery

T1418.001

System Network Configuration Discovery

T1422

System Network Connections Discovery

T1421

Lateral Movement

Collection

Location Tracking

T1430

Protected User Data

T1636

Calendar Entries

T1636.001

Call Log

T1636.002

Contact List

T1636.003

Stored Application Data

T1409

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Dname

Path /data/data/com.tencent.mobileqq/databases/Dname
Size 32KB
SHA256 5bb1fd7e82a28019975971aae5f49b0eb2ddef4a943663b654ede402d2f7f616
MD5 0ec8d5e24581e56eb01c45155efe2049
SHA1 4de2aebc5e22d0420e54cb553c2739e50481e50a
SHA512 23f87b81f1b49b80a88b1eab7d5e08e7001486b135bedc434601eed4ab74b72804ae4f907ede18213454dfa9da7058692b012861170306adbe6b12650dd51fd4
SSDEEP 12:TLWUeFXHF/ZIEpQCTE8cZawHoOMcFHfdZERFiAHRmBEyPbV/OwIe:TLUF3oCDVcZntMcF/dZ4FiAsGSZIe
MD5 SHA1 SHA512 SSDEEP

Submit Download

Dname-journal

Path /data/data/com.tencent.mobileqq/databases/Dname-journal
Size 512B
SHA256 8778d13390adc27285b971b9c059655c5f5491d564fb99c6375bcc27cad4ee5b
MD5 d8def991c27d941f4743c2cd24a36196
SHA1 7b37240db2761a1238190a26e6836928393b3a61
SHA512 75c1a6bb28890381d724cdacf1cb5b6e8224d862707f9b4411e897e2dbfa0244bc971bba0cbb342ee0cf70ff3397ee2b8ae2d293cf82b2f8cc8e7c349050c66b
MD5 SHA1 SHA512

Submit Download

Dname-journal

Path /data/data/com.tencent.mobileqq/databases/Dname-journal
Size 8KB
SHA256 a13f1b5d5d809f0383907ae2b7c94c438531c73134548ac1571b648664f38f38
MD5 09af92d6701927635350ad9c7f833fbc
SHA1 491536406470ce9b57dd61e7c5cb3646b3b8f8d2
SHA512 b841972b3c97423979f60556f975a8ab18ea53c1fc36966423bd81f86072bc83216dfba4bee3c624ea94d2d8606ead0826a2db877493ec3e121490568df6ef3d
SSDEEP 6:7+/l95zn1a5Rg9bNFlEuWdOlOERX4PBX4ogLugMBX4suuKiIn:7+tI5RqLiuWdwRmBEyPbTIn
MD5 SHA1 SHA512 SSDEEP

Submit Download

Dname-journal

Path /data/data/com.tencent.mobileqq/databases/Dname-journal
Size 8KB
SHA256 0b70e0b533664bc16b60cf3d5ec60252c3239d04b86f434af102a3d077f99e19
MD5 c03f90443369729b9a73fc1252424dab
SHA1 5d8ce055d714dac370f3eb90b9c64e298a935fb3
SHA512 db52ea6635d39e5080afbbd7e7506bb0a283ca0cfcf403ea61e9698ca9698de610bbe7d5e69758adf0151a2a18da4d16e2ed452d391289caecf9ce50943bcc94
SSDEEP 6:7+/l93gPg9bNFlLdrlOERX4PBX4ogLugMBX4suuKclM/t:7+tJ4qLJdTRmBEyPb7lst
MD5 SHA1 SHA512 SSDEEP

Submit Download

Dname-journal

Path /data/data/com.tencent.mobileqq/databases/Dname-journal
Size 8KB
SHA256 885ec7f5229d272aaa97a4f12856d97d8d568fc1b8c2082a1c93deac77ac378d
MD5 127e5f513cd7c05a9ec7cca3851789e5
SHA1 d8f3b209245118d0bb154259178bb4fa3446ef37
SHA512 52384188f7a8df7a58ed22357f0a59f1bd205f194192bf6839d096e19d69feaa5fb4bc18cebfba1e92ba2a0d58f5a1c45c11102aa7dc8cce16b17371ebff92e3
SSDEEP 12:7+tynqLZElmmFHfdZERFiAHRmBEyPbcAv:7+tWqL2YmF/dZ4FiAsGSc8
MD5 SHA1 SHA512 SSDEEP

Submit Download

Dname-journal

Path /data/data/com.tencent.mobileqq/databases/Dname-journal
Size 8KB
SHA256 e78d0b163756e83938908f75cdf233a0314c0d4d5e49bf4f8fc667eea5f8d710
MD5 aae12bcff76a50cfc937cc6dbc6879e0
SHA1 c32461dd06b108ad1b70a8981911be6c86bb0750
SHA512 3eb4fe7884404ffabb68a828abe60e6f488dcfb7008d0ea376021bb84c45563cb18fca25b2b8e599bec3defb9681648f9ec0e08dd5850878601ea77cccc29b62
SSDEEP 12:7+txPqLEy0nDcZawHoOMcFHfdZERFiAHRmBEyPbRo8:7+txPqLEVnDcZntMcF/dZ4FiAsGSd
MD5 SHA1 SHA512 SSDEEP

Submit Download

evernote_jobs.db

Path /data/data/com.tencent.mobileqq/databases/evernote_jobs.db
Size 16KB
SHA256 0bcea1faa853382ddd100d83c7d2ad2a6ebc0f73a5d812ced2595d0296c0e455
MD5 4a3c926b8e0fb89ce9fc35bfe658d811
SHA1 4a188b6885a44aa09872ddd5dc6f2be1c5b68d3c
SHA512 062d9f6c544c481a5df243d165670289330cb0d345a4a2fb4739fc17b92a0ab56e4ffc8183cf4b7d08eff748071bec43090e523ab3122426bbe9eb7aeea918cf
SSDEEP 12:TLKWpN0KkYrZASBMAB1G0d/P6dMbWAz9m9W3dOsuA3MTzeRmBEyPbBvOwJk02PWH:TLZpOKRvTZYAZ3mGSNReWOs
MD5 SHA1 SHA512 SSDEEP

Submit Download

evernote_jobs.db-journal

Path /data/data/com.tencent.mobileqq/databases/evernote_jobs.db-journal
Size 8KB
SHA256 bf0a4b35217ae28d4eae97d4fdb315aad62cf551394b4e14e1d3047714ddebfc
MD5 b9e130103899c652f1144d805fca08d5
SHA1 81eaf72f5e3aa2c1700db6b122f4046cb065894f
SHA512 38cd57491b3c524f35ef1900557e464eb1dea902433bca35599f7c5cbef909e465c788765c4870c2979791c75fd038708c227930e7449128bdd5b123d8190bcb
SSDEEP 12:7+tJ6PWOxqL8SzpN0KkYrZASBMAB1G0d/P6dMbWAz9m9W3dOsuA3MTzeRmBEyPbW:7+tJiWOxqLZzpOKRvTZYAZ3mGSW
MD5 SHA1 SHA512 SSDEEP

Submit Download

evernote_jobs.db-journal

Path /data/data/com.tencent.mobileqq/databases/evernote_jobs.db-journal
Size 8KB
SHA256 22850ae25a9167a651d2f7e3571599a23172c9a14abf8abc1760f7979159ce12
MD5 e25a48dbbbf2167a67c52592c3b70a53
SHA1 da05633376e0837cbf88c9d8e888ae854a15d7e0
SHA512 252271dc1c6aae5e9d1a56a2c7407d6469f7b769557904715aefa15f5bd8a33075edb1660ea927fa5b8d24203a68118fb17486e3dddc0d690931cd21fc445486
SSDEEP 24:7+tI8JWOSkeWO8qLUspOKRvTZYAZ3mGS3:7Mb0OTtO8qgsYAZ3pS3
MD5 SHA1 SHA512 SSDEEP

Submit Download

evernote_jobs.db-journal

Path /data/data/com.tencent.mobileqq/databases/evernote_jobs.db-journal
Size 512B
SHA256 63e7b254bed2e4eba50ce107b6e88487f8add4b3b6957fb0c803ab5bf00bf8f3
MD5 9ffa72672177725db04f79abb9944d52
SHA1 4901ef7c1ad770a5f38c43684b617b02388f6677
SHA512 c693792049fa9c9ab4956afa62679883eee0306f9ca987c2a8265f8eb3149952392bfb4f364e1c941e95586ddbe142a0694283a3f2527ff83858fc591257526d
MD5 SHA1 SHA512

Submit Download

evernote_jobs.db-journal

Path /data/data/com.tencent.mobileqq/databases/evernote_jobs.db-journal
Size 8KB
SHA256 f30d329dc1bfed66748de87cb07a71fff81ccb71a54690469323a3466aa04cc5
MD5 7cea7fb117f64b0165d95dd992a5861e
SHA1 6e8091f75950ab5be5404e54e64fccbe075cb17e
SHA512 679d1509864a2e2872367739561c4543c58593f6497dfd9bbb0cdb3166ddbe5cd3dddd66bc8ea880463e67d05be9a3c1552fdf61cce5f21da359217cafbbb1d5
SSDEEP 6:7+/l9u46n1ftg9bNFlEuWdOlOERX4PBX4ogLugMBX4suuKq:7+tgrtqLiuWdwRmBEyPbx
MD5 SHA1 SHA512 SSDEEP

Submit Download

evernote_jobs.db-journal

Path /data/data/com.tencent.mobileqq/databases/evernote_jobs.db-journal
Size 8KB
SHA256 35cc51df7c7adf8183301047baec10fe53598a8b16e3c07a38a11b9b11928460
MD5 6881a05d6bdb8875336bdfa300c78ec7
SHA1 b975b4ff2c54b38369024eeed9a8ee72b4e87d7c
SHA512 41b4129f3d292ec0d6ff72d3f04e4d2471fe5885e83179483c7973c6b76f4243b66bd28e67e4aa781785335ffd053d55f227b2e8c14f3ed8e5223be9fcd313b6
SSDEEP 6:7+/l9lG9Pg9bNFlLdrlOERX4PBX4ogLugMBX4suuK+o/T:7+tmZqLJdTRmBEyPbPoT
MD5 SHA1 SHA512 SSDEEP

Submit Download

evernote_jobs.db-journal

Path /data/data/com.tencent.mobileqq/databases/evernote_jobs.db-journal
Size 8KB
SHA256 f711aa535390bf3c0c8727b5cfa5e3137500631d540645998ed9c1e530e8fe60
MD5 14900b5034a55c8f120accb53de9fe72
SHA1 68f2723abdf72e795475a20c1426be46e7fbcbbb
SHA512 8b2ff63a72360ff8c6e90d7fdddc79355c15f8faef2fe325dd044dd7f875719f16315d4bc583da54b236b2280874138baa3dc79139760db729ebf857f85fc583
SSDEEP 12:7+t4qLpHpN0KkYrZASBMAB1G0d/P6dMbWAz9m9W3dOsuA3MTzeRmBEyPbw:7+t4qLppOKRvTZYAZ3mGSw
MD5 SHA1 SHA512 SSDEEP

Submit Download

google_app_measurement_local.db

Path /data/data/com.tencent.mobileqq/databases/google_app_measurement_local.db
Size 16KB
SHA256 334647613f2ca6d9ac0fcc5faa1fabfe7b28b2df377bbef9aaa988dad2b4713e
MD5 b7602f458617049b0a61b479a501afa3
SHA1 85ac94c5f8f5d7c20f07443314d1fb589aaee311
SHA512 078c306bca16529951ebbc4bc2e86e3b24bc915d5cab63733c08459f11024799d9787bee173e83bb3372a609221a469b82ce557087da753f589f2bc7cc2b8ef8
SSDEEP 6:l9bNFlsls1ylO0yAgLusi2JLnrcERX4PBX4ogLugMBX4suuK+/Wb:TLiEy9zmzrfRmBEyPbP/W
MD5 SHA1 SHA512 SSDEEP

Submit Download

google_app_measurement_local.db

Path /data/data/com.tencent.mobileqq/databases/google_app_measurement_local.db
Size 16KB
SHA256 6ec658a70dd31f8d1da84010802ce0da649147e22e10b79176afcaefd06429ea
MD5 5dc8e5aad4c41707ac386ad8bf61b99e
SHA1 107e5d213f4dc13e4ca3deebbe1d7a88a6987cc0
SHA512 9669ba21d2a4f24091e2bcf21844a75b7cd119dc0b43fcdbc6a1a818ee86469da3e0767730b10461047d287abf1657a3fbcb57a084966ecbf161fd55fdbaa8b3
SSDEEP 6:l9bNFleLOls1vlO0yAgLusi2JLnrcERX4PBX4ogLugMBX4suuK+/jqLym4+/lulP:TL1Ev9zmzrfRmBEyPbP/MyJ+/0Fl63MB
MD5 SHA1 SHA512 SSDEEP

Submit Download

google_app_measurement_local.db

Path /data/data/com.tencent.mobileqq/databases/google_app_measurement_local.db
Size 16KB
SHA256 a956ac88337bd241df9dd817c870d90e394cadb62f5dba12513bad043a22a406
MD5 4d9a3aa7efcd0dacaef680e1308e49d0
SHA1 c3d1f27d8b1dee71e7e0454ab507ce19a8e6fa9a
SHA512 c6a6fd458a6d09867b6a6fab1004099c0d0e0c77775f40b34c5a4cc579291d8a11f5282348c2607cb93120b31b8467687864f05e79964b9fbfc4e34ac6980c1b
SSDEEP 12:TLIEQv9zmzrfRmBEyPbP/u+oY/4bCAUXA6/PWlXQKd+/0Fl63MB:TLEvpmzr0GSP/mY/4bCW8OzlFn
MD5 SHA1 SHA512 SSDEEP

Submit Download

google_app_measurement_local.db

Path /data/data/com.tencent.mobileqq/databases/google_app_measurement_local.db
Size 16KB
SHA256 3ff05dde2188817d34052d25df4b6dc51eb564dfb9b1285c0519a90549f47278
MD5 a84e530ac745f0c3d4b31b884bbc32e3
SHA1 a6d3a39e02426328d256bfb959111ecb89cee9ab
SHA512 d916d0d093b580e98355f0c45f054e3f787f5092f3172a8057cf43e8fd2bf45594a6c9c3990eb28a273d469793c2e84a3b0003660ea81c66a0feeb4a03eabf41
SSDEEP 6:l9bNFlsals1dvlO0yAgLusi2JLnrcERX4PBX4ogLugMBX4suuK+/WCM:TL6uEp9zmzrfRmBEyPbP/W
MD5 SHA1 SHA512 SSDEEP

Submit Download

google_app_measurement_local.db

Path /data/data/com.tencent.mobileqq/databases/google_app_measurement_local.db
Size 16KB
SHA256 7c94c7795453838a74f140f61e94bf67516f68a114b8803e1e86464b382c4c85
MD5 12662d49a48d59e3e01284b7e8af26f8
SHA1 dc363a03d6381f9f2810c0dbc504bc2a69868311
SHA512 6e0bb591489a0f5f4dd93d83d1b5bdbac5af4356a976b2bf15089b262055d81751bb317c61723ed7bcb40e006c32bf980b6ba180703c938875744fb1aa7934fc
SSDEEP 12:TLWuEOe9zmzrfRmBEyPbBvOwO4VOLabCAUXA6/PWlXQH:TL5epmzr0GSNOuKabCW8O2
MD5 SHA1 SHA512 SSDEEP

Submit Download