780936deb27be5dceea20a5489014236796a74cc967a12e36cb56d9b8df9bc86

Analysis

max time kernel
4s
max time network
184s
platform
android_x86
resource
android-x86-arm-20240514-en
resource tags

androidarch:armarch:x86image:android-x86-arm-20240514-enlocale:en-usos:android-9-x86system
submitted
17/05/2024, 18:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

wallpaper.apk
Size

2.2MB
MD5

2bee1749491b18907d5c3f84d6c812c4
SHA1

fcc36dc84b55cdf29af5397afe371a8ad3106673
SHA256

77d3ba2483a0f0297e71ba0600174193370d2d5e251da62a8121bd3ce50bbc7c
SHA512

efe382ffe2c6ef590ab11a4cff98e75db069a3ebde0ee9e5df60c289ecd189e8a894ec056c258fc1ec3b9d1fda4bacb6187a2107b112dd9db8d636c74259b102
SSDEEP

49152:0CPjilIJjTMVZh2aIvg67gOiPFlmZPG1vuyraAp3obGx:0C7tp6qgbkA0yBzx

Score

7^/10

discovery evasion persistence

Malware Config

Signatures

Checks memory information 2 TTPs 1 IoCs

Checks memory information which indicate if the system is an emulator.

evasion discovery

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	com.panshi.hostpayment

Queries the mobile country code (MCC) 1 TTPs 1 IoCs

discovery

System Network Configuration Discovery

T1422

description	ioc	Process
Framework service call	com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone	com.panshi.hostpayment

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs

persistence

Broadcast Receivers

T1624.001

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	com.panshi.hostpayment

com.panshi.hostpayment
1⤵
- Checks memory information
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
PID:4333

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Discovery

System Information Discovery

T1426

System Network Configuration Discovery

T1422

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.panshi.hostpayment/databases/_nohttp_cookies_db.db

Filesize
24KB

MD5
692957a8f6be4a25986a068c449b83ab

SHA1
04223c8cbcf0032443488e3f5f9bee9f91eb5f7d

SHA256
4895bff14c71a617ca75f6ce7933b28332ee06a1b2aa431ee3e108db693cdf0a

SHA512
0617a88df6a60252050fc5403f6d01936bbcba961d707474d62bf97cf1e2034999befd13fac5e58d430ce43dd45dce8e2e6c8b6b125ea53dada382aebcfa3742

Download Submit
/data/data/com.panshi.hostpayment/databases/_nohttp_cookies_db.db-journal

Filesize
512B

MD5
d70aea052bdc6d570761fb8051e0da03

SHA1
65bed4f8ebe35cf21115c62da721feccb195038e

SHA256
1933b25d53103eef5906a338cc3d8da01b27e82b18bf86827ffb9d4b74f78b14

SHA512
ef1106fee8d0c9c6e18bb0c2ddbcefc77470a9a9d3c176bc0c4b3027875760f38a3183e54b08b56e685ea6f205eeae5779a0c19bc6bc7aba50729e32b80b3ba8

Download Submit
/data/data/com.panshi.hostpayment/databases/_nohttp_cookies_db.db-shm

Filesize
28KB

MD5
cf845a781c107ec1346e849c9dd1b7e8

SHA1
b44ccc7f7d519352422e59ee8b0bdbac881768a7

SHA256
18619b678a5c207a971a0aa931604f48162e307c57ecdec450d5f095fe9f32c7

SHA512
4802861ea06dc7fb85229a3c8f04e707a084f1ba516510c6f269821b33c8ee4ebf495258fe5bee4850668a5aac1a45f0edf51580da13b7ee160a29d067c67612

Download Submit
/data/data/com.panshi.hostpayment/databases/_nohttp_cookies_db.db-wal

Filesize
36KB

MD5
df0342329dc8618cb6b2cab6e2c53a87

SHA1
efa34d47f72656d7ddfbb8a5928633fa2ef38c0e

SHA256
6d03bd7bab49f7dcc15699f9fdfc15838a9247c707004883a83715cf4c07dc92

SHA512
2724af26b85fe6948a6b9e395fedcb1a45d99189b4f5e1664dc9794ae8575d912b0fccaedf2b361039be5d3725e24e40e420e443925f09936d6501388738e1e8

Download Submit