d21a93219504597eedc31ca9bea9772459db2655455ba6b0cefce8fc2de5a3d2

Analysis

max time kernel
8s
max time network
130s
platform
android_x86
resource
android-x86-arm-20240514-en
resource tags

androidarch:armarch:x86image:android-x86-arm-20240514-enlocale:en-usos:android-9-x86system
submitted
20/05/2024, 06:59

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

plug.apk
Size

11.6MB
MD5

c74c7d855d550aef8302960b3579b5d0
SHA1

67a2e2a4fc587d39924d358abf7c5a520614179a
SHA256

f5b159d22cf14c18f881958441a7c78677fc49742a525a04305cb33858f32682
SHA512

9076dc99ffa6f3c876fea329f190a35f483ab5b8ffd00695d843cbf7584a4d796e489eedc0c335fb1a3f542938d067cdf313686bafb831e6e17636d0f7189bfa
SSDEEP

196608:0zBnw+M4mMH7fkS0KWxIfluCpGZ9bng4UZdM/CRVFglZ8e0dCXCAJ+qvfkTgNXqF:+Z1lguWxkuCps9zgTZi/5ZoCXxJVkE5O

Score

7^/10

discovery impact

Malware Config

Signatures

Queries information about running processes on the device 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about running processes on the device.

discovery

Process Discovery

T1424

description	ioc	Process
Framework service call	android.app.IActivityManager.getRunningAppProcesses	com.zhangyue.read.iReader.plugin

Checks if the internet connection is available 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.zhangyue.read.iReader.plugin

Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

impact

Data Encrypted for Impact

T1471

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	com.zhangyue.read.iReader.plugin

com.zhangyue.read.iReader.plugin
1⤵
- Queries information about running processes on the device
- Checks if the internet connection is available
- Uses Crypto APIs (Might try to encrypt user data)
PID:4314

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Process Discovery

T1424

System Network Connections Discovery

T1421

Lateral Movement

Collection

Command and Control

Exfiltration

Impact