Analysis
-
max time kernel
179s -
max time network
188s -
platform
android_x64 -
resource
android-x64-20240514-en -
resource tags
androidarch:x64arch:x86image:android-x64-20240514-enlocale:en-usos:android-10-x64system -
submitted
19-05-2024 19:41
Behavioral task
behavioral1
Sample
e001c0dfe6363347f3fcec884bc561029b0913a236afbb885fb61c4ba8a8132d.apk
Resource
android-x86-arm-20240514-en
Behavioral task
behavioral2
Sample
e001c0dfe6363347f3fcec884bc561029b0913a236afbb885fb61c4ba8a8132d.apk
Resource
android-x64-20240514-en
Behavioral task
behavioral3
Sample
tcore.apk
Resource
android-x86-arm-20240514-en
Behavioral task
behavioral4
Sample
tcore.apk
Resource
android-x64-20240514-en
Behavioral task
behavioral5
Sample
tcore.apk
Resource
android-x64-arm64-20240514-en
General
-
Target
e001c0dfe6363347f3fcec884bc561029b0913a236afbb885fb61c4ba8a8132d.apk
-
Size
5.7MB
-
MD5
5b1146f96fd42b235d2be644bcb4f77d
-
SHA1
4e14ad04f12d0d3dc67b3e00e33cc9e0326a4f9f
-
SHA256
e001c0dfe6363347f3fcec884bc561029b0913a236afbb885fb61c4ba8a8132d
-
SHA512
2b23f8a36b07ae05bb74025eb01a3519b38062e91212eec32deee0f548fec5677fc5f7c59ea7d132343e1eaca850c90a0c9dc070a8870fd3f062c5ba84273a60
-
SSDEEP
98304:w0+I1S00AE5jKoxCwHLD723aByAMIUoe4SwrGcwZiTQ4U1MLRDRjBr93uL:7JBXEwo8e3723zJIUoxdqFq/N4
Malware Config
Signatures
-
Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
-
Checks CPU information 2 TTPs 1 IoCs
Checks CPU information which indicate if the system is an emulator.
description ioc Process File opened for read /proc/cpuinfo com.yangmaodi.app -
Checks memory information 2 TTPs 1 IoCs
Checks memory information which indicate if the system is an emulator.
description ioc Process File opened for read /proc/meminfo com.yangmaodi.app -
Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs
Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
description ioc Process Framework service call android.content.IClipboard.addPrimaryClipChangedListener com.yangmaodi.app -
Queries information about running processes on the device 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about running processes on the device.
description ioc Process Framework service call android.app.IActivityManager.getRunningAppProcesses com.yangmaodi.app -
Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.
description ioc Process Framework service call android.net.wifi.IWifiManager.getConnectionInfo com.yangmaodi.app -
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
description ioc Process Framework service call com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone com.yangmaodi.app -
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 2 IoCs
description ioc Process Framework service call android.app.IActivityManager.registerReceiver com.yangmaodi.app Framework service call android.app.IActivityManager.registerReceiver com.yangmaodi.app:pushservice -
Checks if the internet connection is available 1 TTPs 2 IoCs
description ioc Process Framework service call android.net.IConnectivityManager.getActiveNetworkInfo com.yangmaodi.app Framework service call android.net.IConnectivityManager.getActiveNetworkInfo com.yangmaodi.app:pushservice -
Queries the unique device ID (IMEI, MEID, IMSI) 1 TTPs
-
Reads information about phone network operator. 1 TTPs
-
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 2 IoCs
description ioc Process Framework API call javax.crypto.Cipher.doFinal com.yangmaodi.app Framework API call javax.crypto.Cipher.doFinal com.yangmaodi.app:pushservice
Processes
-
com.yangmaodi.app1⤵
- Checks CPU information
- Checks memory information
- Obtains sensitive information copied to the device clipboard
- Queries information about running processes on the device
- Queries information about the current Wi-Fi connection
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Checks if the internet connection is available
- Uses Crypto APIs (Might try to encrypt user data)
PID:5115
-
com.yangmaodi.app:pushservice1⤵
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Checks if the internet connection is available
- Uses Crypto APIs (Might try to encrypt user data)
PID:5353
Network
MITRE ATT&CK Mobile v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
36KB
MD50908e924aa236931dc7166fef6e00862
SHA17782648d6d8f6e835bd47058d4852932c096a467
SHA25638f8548795ca7470b449dd1de9598c07a247ba59883c0764c9c96ff0b7d31d7f
SHA5123c16fbc5172aed04cd206e776c46d26e911732c6e3631536410a71f1d217449475727ac9b3175e827c5ce645a1da9e05900258ee6ca27c936a9060f241361dee
-
Filesize
36KB
MD567c12933d1e0e63d9801a6aa43092ce7
SHA1b6936908554e4a1986b8eb08289e2d3545e8ff74
SHA256abda5dd4cc2e7dbb951637c4b49d6990f9f34411fab4dee1a387dbcc8e7eed40
SHA512db8b818daa3ff4ec7678645f84bf8b45c809bcbb758ea78b28982d071572655bba2d20e6f1ca4f0d057ab34fa655c5bc40457dc65050180351a2fc04a47175dd
-
Filesize
8KB
MD5b9cb1755903349cbd2646202eb2ae7a8
SHA1f48555ce18585d5bf7a65a3356fe84bd7b7aead1
SHA25695e0c9539b49948d48533de9f0c0003a2242bfa5c83aa2d4d523cb2f0fa5731e
SHA5122ddffc02ed4a93682af899a0b4a4cc72f2cdcf63539428eb01d5f398f14a1aae6059977f22a438981e9c9813ebcbece13307ca085c23587bca16995f5e36419e
-
Filesize
8KB
MD5e707401126481d6ac6a637fdd5b60d9e
SHA1f3612e15bec0c914a4eefdafc82d214f6e563dd5
SHA256280225a9d9a74b4434978dd7b48f95f27faa636eeb44e9112522d12976ddd118
SHA512ed901d4479de0d6441b35a602e11dd3a382f4eae70b8122c2d0e16f5fbae211fbf0b3c363f245e12a4faa3b0069743501f33caf4d762f28548ade69034512bad
-
Filesize
8KB
MD5399f635e942569d06f30568221b61989
SHA11e9c29649d943ecd6fe42d704c43f03decfc326c
SHA2561cbab39c6035e464527874d0089116d707f8fd5f150812c97260b014e96af826
SHA512dd52306d6a1785e4f23cf4a948bcb824a7b27bd8ad9e1f2ceca2947dd0d5a798910bf708058dcc7e5e65003cf9049a611d24b3a3bc8884e165a8d401a46be769
-
Filesize
8KB
MD596c99fcfb681b39df9a626b55c8c3b7c
SHA102c95a5ba31acbce1f6c1e57928bbb13baff71a5
SHA256bfe816d5215be24b286c6a9dabfd0d941b44dbd31627204d73c5c616012ea31f
SHA51252fde598cca59b6af3a11219b5d61f82979365d732481cbdee14263112b53e32a23936b05f5100fd3f8b72ba9bb546f02fe49ca9caaf7f8cd0b39d791bed5a65
-
Filesize
8KB
MD5510b46657c0557e7552de91d681435f2
SHA135493db6619b0c9f8aa66f3d41dafeb68eb9e6e6
SHA256b61c9e38d42f337740775308570692832725a4125d40107667d37b09df104d1f
SHA512158cc133127297548b0dbe5136fc93600042957d15a61ed87757ccc9be66bd403b77853042a98283bbd50e77bd5ed7f64d148cd781e60efcd3475fa91330f9e3
-
Filesize
12KB
MD5ff48c35e0969ccc65b91a830e7d4cfea
SHA1267bd754d2260056889a286a05300fcdbe505289
SHA25658efd0077daf6b88e09335e45b44c062d65c8d877cfc104885421925b47db347
SHA51219638ac9b3c812c37e8de9b02b5af53c7e714c76cd7464062821ff21abad18ea810e318c7615bb4f9643c50b41b66c70e80c0267b25f91b31ae1874b839c0e55
-
Filesize
512B
MD51a59bb6629f87dbd151c58cf6736d12c
SHA1e2eb8e6c651e256a1afa3060abc976ef66dc6f7e
SHA256a2eb125703f04e31f0d9c07b53f9d424fce2a5ecfbe040db56ae7f1ecdec7d0f
SHA51218d12098f84150a34abe1fe831e93f16c25db2a4e1628598e424e799aa455c7d29cd1c48bd85599af1515cf6b80cc5f11b0e2a07f2fdf5c0f2eb92a670741101
-
Filesize
48KB
MD54395c476b2a1b7c4008bcf246362d6fe
SHA164100254727a65ec0cab9f22b5b19e748d42fdb0
SHA256a6561caf8f426b50cccb316976d5c5d763e06007e9cde16c5071462c4c1e0a15
SHA5129b0363e006f11f3d9acb972fd181f0725458043c2bf55baa2f7d26a611195ae5ceeafe0e00ee8bbbb48d56938c337d19794095daf79772b1342c3a2baa86e7a7
-
Filesize
512B
MD533110b4ff02053c0e1f522b9c3beb741
SHA13345a12a95a4f061629ce4b73b007a1bcbcce93d
SHA2560b781a57483a03261c8efdb588b0d18281f671fe02221c0c4d7602dcd4582689
SHA512233f1706b92d49abbfdf9f4bc7eed35941e1ef348543c85f58bf1328cd8e3a8ca3f18e1288f4a9a43a756c9d9365c6e8327ae019e7499e11c8b831837d50b568
-
Filesize
1KB
MD5af5d0991a427976adc5a929f24734c9c
SHA18cea911367b58c4c5bc71274ca50fdc7311aaed9
SHA2563cafbc35dbf567890a1579dbc708057fa6710ce414c56ace4c9d7f6da337a490
SHA512a11b51a7a49c1177b7b8fee9a5c2caef8f1a9ae2e1a4f321c379e5033979e835ac2e726696a4cfd6e958b825ee1859db2dddd50bbd46cb474aa83ad2a81394ce
-
Filesize
162B
MD5ef6569475e29045af61d9f5d8bf2e260
SHA14c5205aedcb7e9704f7696f1cd565e560891a97d
SHA25657616ff7fd56d3f0e7728dd13e72679f2dab9973e1f0dd7942ac7ba778b4be70
SHA5121cb1be588b9b3c6491207b5f24286526d7041e1c12ded3f12f9bdc8a2afaf53f6283532edbf954aa08ddebd394da66e996eed0b29cc14cd4ad2c8824f02abe87
-
Filesize
37KB
MD5f4696bee990296485b62131772fe9e63
SHA13209bc6e788d22463771fac71ed74d36f473dad8
SHA256cf24bd27c4cd5353780e77ff76f5c0a6ca03c7f6051a58f4760deb2e72c0e1ee
SHA5123b40e361e6cfa8b8afb3e241374c0385449c02aedd1a39d6b8813ee71816282514e43efa5fb80bb666031666f2503ce46e49b611ca541fe9e33a5279071e3a5e
-
Filesize
8KB
MD51558200748d73561acdddfa80c4b387f
SHA1ceac3e61a4bd09a66d4b7c968c9384ec3da6b628
SHA2569e07b8e4c1acc89b8dd4557426eb6c0aed48dc6dad1bc6bf0ca7bbedf8931eba
SHA51237b5628c3652f61da6e0cecaafc170a950af752691fe39c174ebd85d31806852e776ef9f2326b183c491aeb8864deae3b58e766f35a2806d4dca3c9cb01cbb95
-
Filesize
210KB
MD509444a9ae0e13044c6e042b6fc516c42
SHA18d5c97a957391eb6a66b5dbe9eab6494742740a3
SHA2569391ed4263fd943492211c629c04d4acd8f98a2bedf91510c8b09f7968c91b64
SHA51233c7ce2ab7a9bfa3828d1dfe8ec65a1a1af61cfcce31dfb66e58c613019f02443466cc19c2cdd9ea722e185fdef16cd5311a9109cc4514860d629780988ddb9d
-
Filesize
8KB
MD5fa7d68334ea96aa16cd7bcaf4c8bfa51
SHA16143ce5fc43c0e4566670da43476ef170cbcb8d3
SHA256798e93cd6b54f95840b417bcbead3f8f4d2949a59879908bf49763b2014e9114
SHA512365c531120448405b31403597984c558c27ade93da7eb6504b7dbf5a0535d795705e0b1152cf26d201f616c112a658fd6b7ff70db5d03bf2d6f2111c2c5aacf9
-
Filesize
9KB
MD50e815ec22e6050d78c9da38c52dc91d4
SHA12e7cb97187a856443f105e7e2f3d2721c3048e43
SHA256537b2fc24e4d482ec4f4061859df0c829857055c485b17bc83ce6f5d9aa26ba6
SHA512d545eec01d7b6b8ca70cb0768e488d290398622c87fb21097c0528571e36b8d9307df913e68f14e525bd1785c46072430812820471563ba36b6aeca90204a01d
-
Filesize
32KB
MD5e5dc72d44255857c9e3d61c317b0cc0c
SHA155b0de83f5b9cfbc0f6d31582e05413c15930f26
SHA256c3042dae9123c19a6a41c41bf93cbaa21cf5b995e9520c237ed5a0104a66b9d6
SHA512f53f3bbfaf985f15e8ae94b94ea4dc177371696f4b07d1ef125552fe2d9b3bb8d5494150660fccfad8cb08696fb5bfdb1c5b9489e59d1a415f983fb2db8f0237
-
Filesize
1KB
MD5fdab221cc9baefdc45ed5ffad0171c18
SHA15108c239c1314727be27b48ae06f6e45a460ee57
SHA256fec93398039e3463d86553956516bbf4f8b58d7c7d24640fc35becece5821cce
SHA5126a871dd73d090c887fac9e0f783707656f4a8de4ac356c09505d58ea6f5bc8c6b14d0d5f38cc51205a1d54867a20500763974c7b2c26328d4f5d982c660d24e1
-
Filesize
26KB
MD5fe317959c1340ccc7f75c268c24eac9f
SHA13b0dc3a886538b365148c650608b6fe7418ee052
SHA256d14098f732f55773f6920f4d50956fdd5a6525de8caeeb6301f8a531f4d60c29
SHA512087c7297b3a4f60c2900b35a6242e9f311168d77041f5c3160e72dd88c98164dcc83f59f4637034320cceb4edf53039fa833d25ce728426e8e1aed3e434f9c26
-
Filesize
10KB
MD5683c649396e3cfb03e3a034240d25796
SHA1db4bf8db3cef2ece367843a420e8ffd0dfddc969
SHA256580b6920731941c52ecd9485b1f235989bba5ab28164d07753e3bfba020a286e
SHA512d30e6cb73e3f9ba3c214602d2ec01d02bf2c7e8adb2b0d279372c2d847a8483df699ccf033375bf7740d8442111b933d03abe0623bf7b2b72c6ea746cd1ac9f5
-
Filesize
46KB
MD54895a0bf49107c8045ab57ac8b275ec1
SHA1f6546e7e711db2261b36ff4dc7684cadc58689d8
SHA256dbe3381332834ea5ae93d4b5b552737337a2983754c697afc23d6254e5fac9b4
SHA512f98f057ac77496a7e2922ee41a81ffb24c1749d3a2a9b9c956116b559bfc45ed8af93287769c556eef271d1681efc356a58f08b5d36d9a72c97683417e0390ca
-
Filesize
1KB
MD552dbbeb73ea1eb43eae20cce83abf9c9
SHA1945c26255dda4d4f1dc53e080bbed91484d87a9b
SHA256e613d71151b2c01b697f662e3f194bcd60265c767bef9bd49766bbd54f24b019
SHA5127cbd9a4f3cb3a70d0b487aad9043b357dfddfdc975d830d8e2bee8363a96263c885671a72adc98bf64e2627108bb47bfdb03b27003ba2b24233b41c49017c30a
-
Filesize
36KB
MD5bd2476faa6c07eaad94b7566b90d6211
SHA1795514853b7f9191922fb624b78deb5f99b7f9b5
SHA25642b45b29d15e00c21bc1b1e026797d3477f0fd6a766d633daf8b879ca3dbdf5f
SHA512c375da6bbe09a6fc2f05f9a582bb266c30fcf0dfb6ebc36d6cb59d33a76e2e559c2e19c8b1c070042ee1d92f5b8f433b90cd212b30160c14aed8dcefcfda7653
-
Filesize
335B
MD5585839d66722cfd02e40cb740cccb633
SHA1374c19200fee201b26d0153487a281a934615884
SHA25686a9bb4985cca6c9636c4fd071bef4b70ba7b3a5eb51af869a1299dc2b1574a8
SHA51209bbe1bf1455861fd4732f2d1945c84bac34090906ac2fab75d144c22ffcf6bc585c8209e94a2b1919c8402df53966081a1af2993e12261ae4c4ac5568667d88
-
Filesize
435B
MD5853731c25884e3270188548b37897a25
SHA1fcd397abea846d0679fbe4c746e144b0673077e4
SHA2566b97787d9d65fefbc9222f77437cc5dfd6b474c5908a1768f3bd6a70a95c6250
SHA51262055791b55e6b3e0084c18a5beed7a7f42f098e6d8b45d0f79c615165d690111a66d20b6f07ae1dbc051f70dcdb1176424bb66170184e44fb75d5b8e6eaa7bf
-
Filesize
8KB
MD556ae45d5239fae36d34e89a4ff50af21
SHA1a0ef92b8b38a0a9a6cb4386becacd1e037e55918
SHA25647e3ee780b153d4f1738d468d56b8c2434bd74dd32083bf8851aed521574a71b
SHA51294d42d7253941623e7c0ee3f33d21af326b0570eca65012db652b0ead8c262b4afd975b3d4431ae5f87bcb225132c1214d8c2bb073e5d65ce669ad0c2e2a0b75
-
Filesize
12KB
MD5e219ccdc71431d4b4937a8f9c7d3edcf
SHA16ad12f5ca92bf8db0b27363f41cc11164654aae5
SHA256f5cc6b12eca4eb6d2cd8f9d010463499e017dd7bcd5867d2e3754d8c7c2d899c
SHA512512a7d9bd8ae6dfe788e7a6135ad9b8e84a7d913f25f963ce5c84646276442c039496f07e327bbf78cb35c037debaf8a4415804ac7a4f9ef354cfd02592e826d
-
Filesize
79B
MD558996652c7b9136a7da87fa1b9ef4739
SHA14b0af3ff61fd9054d741e0dd6419bd5a5a7bcd0c
SHA2563af8c0ec57c263a4c70db877a13b49b01456ba29db7fb4271e5b497de96ada46
SHA512061c8c4ac7b07d7fd6a07d11c4005f9b92f6a8aa7484c191424d6c8da5328a19524c5cc5f258902830269d1aac1abf1d306b169b45449236ae6e522012a2d7dc
-
Filesize
8KB
MD549d1b288194c220eed7fbce2885c9cb4
SHA108e6b9f62c8133b49ca5010ca4a130e6e1dc0173
SHA25667aec1e3b3514f53dcbc9fa440d365ac3b7245b35249276768298a4707d3e4bc
SHA512f3bf261663fad7f24329f7d624afaa21172a7da3757868ede96be757e4e86f3a84cebd1ef86a5a3fb15a41848a6f6560c5ed2192b73a39749f48e3884c0f278d
-
Filesize
8KB
MD52637f03bc3de24eb85d04f857a3ab725
SHA14dd44a549c1848f2b72bf478363383c75601740d
SHA256b849bfb77c26fc2726caff9186828d1e9063de1eccdf766397f6a66ecbed5b04
SHA5125d764196cb9827076b31d20d13c9e248c87d11c6594823c39b1b37a3cf6c7f7358a96b3a1651bc028c74618a00de89916d815be076699a747cca6b1272a867a9
-
Filesize
32B
MD5ac0b112bedd68d297de2f614cc254287
SHA16f511783e02e5be40cf67367a6493d771c40e08b
SHA2564b244116b94aabe1e9a1877dbab26a7d693dbc825587c6f2433af3c116999751
SHA5124a6d0165a91100d6833c89b25dc97e1ff44527161c60d71d3f9a0e8f556096b86d799cd47d34220e5b9023019768594871becab2bdbc1e47d4355fbc6c29c99b