10e76f9b66d07947eefe1e515379b278fe824c9b51a66b84bd5004f78e52702b

Analysis

max time kernel
5s
max time network
188s
platform
android_x64
resource
android-x64-arm64-20240514-en
resource tags

androidarch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20240514-enlocale:en-usos:android-11-x64system
submitted
18/05/2024, 16:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
lib360.apk
Size 416KB
Sample240518-va9qcsdc96
SHA256 3dd3f5fb3f3caf48f3dd99410102f804aedfdf42582f7a9f12c9d26a60649a04
MD5 2f78d0967ca568ce8ca499048621c4c2
SHA1 a8c72bad930b1aa6aa4eaa9de2ba5fcdda28f06d
SHA512 75c45a2781f73932cdbd9e2119cd927e38612d7ca48bf7293ab679ac386e8b75718a929d81b8c5a2e1db6cede036c207b4da13c3403b0ee4bad5858313a50b58
SSDEEP 12288:Rr/mv1+q62vD3+chmTzd4jRAt5ZITrS3Dy:RqXrL3+3TzyjRM5+j
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

discovery evasion impact

Malware Config

Signatures

Checks Android system properties for emulator presence. 1 TTPs 2 IoCs

evasion

System Checks

T1633.001

description	ioc	Process
Accessed system property	key: ro.product.model	com.androids.setting
Accessed system property	key: ro.product.name	com.androids.setting

Loads dropped Dex/Jar 1 TTPs 2 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/com.androids.setting/files/tqperf.apk	4599	com.androids.setting
/data/user/0/com.androids.setting/files/1716050927456.apk	4599	com.androids.setting

Queries information about running processes on the device 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about running processes on the device.

discovery

Process Discovery

T1424

description	ioc	Process
Framework service call	android.app.IActivityManager.getRunningAppProcesses	com.androids.setting

Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

impact

Data Encrypted for Impact

T1471

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	com.androids.setting

com.androids.setting
1⤵
- Checks Android system properties for emulator presence.
- Loads dropped Dex/Jar
- Queries information about running processes on the device
- Uses Crypto APIs (Might try to encrypt user data)
PID:4599

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Discovery

Process Discovery

T1424

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

T1471

Replay Monitor

Loading Replay Monitor...

Downloads

1716050927456.apk

Path /data/user/0/com.androids.setting/files/1716050927456.apk
Size 145KB
SHA256 4ae153b5628f411cb93526ca14153c65fc18577b4d1346fdb167f7d65de9e946
MD5 d5eadbed0fb12243d0e9699595e79375
SHA1 2a26c32c127ac8453b16a9f1334a52f417c2286d
SHA512 8704c8deba4b89a4b19b2c3a480901a7d1f611cc2914db7889a4bea5c453ca1d7a2e8ce3d91524a280e7b2779eb23b8305cc0df81ef5b94842568015cb75cc2c
SSDEEP 3072:GffebVcHJwAXsF+7s4J1I0osZMjMhqN8rpv3wwI1:UeGpxcYaJIqyrB3wF1
MD5 SHA1 SHA512 SSDEEP

Submit Download

1716050927456.apk

Path /data/user/0/com.androids.setting/files/1716050927456.apk
Size 337KB
SHA256 db04598f8e1504a048a8bc932cfa48175c3c69ac0fd563371ded17448b098167
MD5 fce41716a0de9c16648e13375fdd86f7
SHA1 eabffef974007d1b0fb40e5958af49a88ec55012
SHA512 121ce39c15fdfbc66df44270ac17c756010667c94f133eca2a55ff5229304bc4d37b699b36f59fbfb9a228227489a6ba0c7759349074a625ae68ac48665673c4
SSDEEP 3072:VK69pcx/XPw/sKscekZ6u8kMaPkAygcS9LsZwDv76mINjg+K/KnCVBMbDlNoxL5z:Vl9p9EK/bOAv+GVBGD9HOB
MD5 SHA1 SHA512 SSDEEP

Download

jhjioj.so

Path /data/user/0/com.androids.setting/files/jhjioj.so
Size 145KB
SHA256 7904011a7419cafb8d57780095d937897104dd3fd77e8eacc57972364ab745ef
MD5 6dbc1b78a8c62bdedbf2d5746258561c
SHA1 5a4bd3f1ce669f5afb316d74637e53097298704f
SHA512 4856aef8e11cb28faeff368dbc1a349e610662fff50d6eff7f4ebbd0b58ebff4846950e69ad697a9f2a5892f9553387bf08b734e3f7e9f51f39b098b8a1c721d
SSDEEP 3072:c/J2OyEtSCRyEMbXv2k+qwne8Hjv3Zj8Bfk2NVD3WU29cc/chmm:c/mEgXv3+qwe8HK62vD3lc/chmm
MD5 SHA1 SHA512 SSDEEP

Submit Download

tqperf.apk

Path /data/user/0/com.androids.setting/files/tqperf.apk
Size 19KB
SHA256 31388e1402fbf69d6fdf40c4182c43cfaf5c9770fa1006b67e5c25dbb39ee47f
MD5 28a6c7f14f97ba35010bba02405b8dba
SHA1 0f5b8eb5c3d5f48da6d747300f6fe4bd9144ca76
SHA512 a075b2e155ab41293b47d76ad11c2d1571426ce8e0f8c407489690995afed3d99e1eb2212946966c54bf891f22c50db4bab81b1cd6d5916f999c3a960251ee50
SSDEEP 384:PC9NPjg4wtiP7OEkNe1nZDr5nZFwDLKu4e7XzyFvmIAl9AAs:PC9RUl47ge1xrXFWLKxe7X+Fu9y
MD5 SHA1 SHA512 SSDEEP

Submit Download

tqperf.apk

Path /data/user/0/com.androids.setting/files/tqperf.apk
Size 13KB
SHA256 c8307965e4c0d8f0cbfb853e9511ceba326cc0b58a6449cee3e6024122bf1a9a
MD5 6d15fa35b0f6c73c95cd2fced082b679
SHA1 7fb166529820a0b553c78bd51d5f4c8c490501aa
SHA512 f96dc8faf94748e5646a1495edca3bb360af91ed6a741f3bb9cf94e28c6e1d99481b2a13bb4e6aea64e9cb559ef3bb023d4cf14d470783db8a9b7e8fa6510258
SSDEEP 192:oI2vQgBQ/1CpzBxtEh7PJNPeoTD9ZYy/um9D1iRwyi8ZILyvc24R2/:XKvnfO9R9TZaCum9D1oisuyvc244/
MD5 SHA1 SHA512 SSDEEP

Download

CrashLog_20240518164848_4599.log

Path /storage/emulated/0/PluginLog/CrashLog/CrashLog_20240518164848_4599.log
Size 4KB
SHA256 cfb2437c726be3393609a5f19342cc64cb7ff7c449a0e5e099217b7ddbf0cd99
MD5 a699f12a8b4cd2c10f38b699414026f7
SHA1 dd5dee3367096ad04d080d8a91a0ec9e31eff42b
SHA512 3e4bd84e51bb1a000184e12fe84893797fa3dc03579f2211bc1f13018625e48d132783e971f645a93de9f9e2cced8d3f8b254f8b902ab05f283547a74b4034e6
SSDEEP 96:4rjBUTCzyQYb1FhEaLJb1FhEaLIau7tuvrszLcvlFFb1FhEaLtM+tdH5wGWqZQ2f:4ny3E8EUBE9A
MD5 SHA1 SHA512 SSDEEP

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads