71681246e76db8456246a2ed80fcc599e7c0dc416185c4d56d5e9bec41f18205

Analysis

max time kernel
125s
max time network
181s
platform
android_x86
resource
android-x86-arm-20240514-en
resource tags

androidarch:armarch:x86image:android-x86-arm-20240514-enlocale:en-usos:android-9-x86system
submitted
21/05/2024, 05:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

app-release-xjtwms_4.1.3.apk
Size

8.8MB
MD5

89edd8274e2bddb3bd619fffb6ac0011
SHA1

11a453db24ff9e919f7c8bccb4d4ee0ba6fd3b4f
SHA256

71681246e76db8456246a2ed80fcc599e7c0dc416185c4d56d5e9bec41f18205
SHA512

9fb3bf8837eb1939ae0c7d00f8fbb82a7f2d9e0f561d54c6da8049d1b79bfd0b2c4feb427f3bc3082f1a40d80b6117ba48a10ec2848ba96e0ea782bedede2e60
SSDEEP

196608:GJAUuyHoJEe++ko9tyL3YV7lLUm/t0AIXxNEwszmh+ZMO97rI6XyUHarGz:LRuoJM30yzWd7eLFh+ZMOJrI0Nz

Score

8^/10

discovery evasion persistence

Malware Config

Signatures

Checks if the Android device is rooted. 1 TTPs 1 IoCs

evasion

System Information Discovery

T1426

ioc	Process
/sbin/su	com.xjtwms.www.wms

Checks memory information 2 TTPs 1 IoCs

Checks memory information which indicate if the system is an emulator.

evasion discovery

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	com.xjtwms.www.wms

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs

persistence

Broadcast Receivers

T1624.001

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	com.xjtwms.www.wms

Checks if the internet connection is available 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.xjtwms.www.wms

com.xjtwms.www.wms
1⤵
- Checks if the Android device is rooted.
- Checks memory information
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Checks if the internet connection is available
PID:4315

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Discovery

System Information Discovery

T1426

System Network Connections Discovery

T1421

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.xjtwms.www.wms/app_crashrecord/1004

Filesize
229B

MD5
df412aaa98e7fa9940cfd7b396376f68

SHA1
8aa0e8805f06506576a8d821507d5bd6a21ad562

SHA256
6ffc3dc5b2d9d59521345193fe10a9f467f86851f370d84c4e6047b0d996de9d

SHA512
8965debfdffea3189d1dad1d54df5ed79c4f7c0d67b27e6b0266d0487d12d6982d6292b9df4f504c21cb20b1a578084839a720f9c5dda9b78accdb59f77de46c

Download Submit
/data/data/com.xjtwms.www.wms/app_crashrecord/1004

Filesize
58B

MD5
0d210bfb2a0e1f1b4c082a6a0f79de07

SHA1
bb8ed9e364db79d1d9f2fcde3f15091893222faa

SHA256
988722c23d78a46021d0e7ca9deee7aa8bb83288269174ffacb7316f381cca1d

SHA512
536e9867b0df29b15b789f8949be6ab37fcdeccb9d39ded981da7dc2052c9533d0ec0e6f9a5444132977605d372e1463d91bdde41b528ff2ca3f65ab152325c1

Download Submit
/data/data/com.xjtwms.www.wms/databases/bugly_db_

Filesize
4KB

MD5
f2b4b0190b9f384ca885f0c8c9b14700

SHA1
934ff2646757b5b6e7f20f6a0aa76c7f995d9361

SHA256
0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514

SHA512
ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1

Download Submit
/data/data/com.xjtwms.www.wms/databases/bugly_db_-journal

Filesize
512B

MD5
bd80f588e00ce92af2b6757993cd1247

SHA1
f4f45ccaccaad78742f57d805a86b5df9f977899

SHA256
0e8e04293fe556c0f948b2a01bd16cf8723b20ca3c8aefbb80e4b253158a82c4

SHA512
ecde9971cce390c88dd969a65efb5b826ce0561c3893ea47550421ab9bb613b3efb0772efe92f22e9ba02c9bd8bbc75d4747e927aa429f70c30833100996bfe6

Download Submit
/data/data/com.xjtwms.www.wms/databases/bugly_db_-shm

Filesize
32KB

MD5
bb7df04e1b0a2570657527a7e108ae23

SHA1
5188431849b4613152fd7bdba6a3ff0a4fd6424b

SHA256
c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479

SHA512
768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

Download Submit
/data/data/com.xjtwms.www.wms/databases/bugly_db_-wal

Filesize
84KB

MD5
82126c583e675de98d37c5cb66efc427

SHA1
ccdfde97a44a7160c6ad203db3d72ed7da2f5669

SHA256
4089b862758bab59c8f076436df6d1be42f109be9cd8d3102522490ab53c51fa

SHA512
dfae670e7a12e65fcb9101b7c7dd8c33bb906607db0a0e89be0aeccd1e1bef70c8fa00dd4b7aef5ec1eb6fcdb409c88df8430eb34e2aae9e59c0554427f1c5a9

Download Submit
/data/data/com.xjtwms.www.wms/files/bugly_last_us_up_tm

Filesize
13B

MD5
448e0e694d3466d1b3a51c7f8a4b3928

SHA1
91bb162d174532ae643456526741b0767ecd93aa

SHA256
c1bb1c204fc36f8718626aca252ab74c3bf247e00b63c34300b028721977652e

SHA512
d01cc371d991f1b2a20a3baad5f8525a9c3e1566136b2ea4aeadb5295f272f68235ddbcaba6255cca85cae79098d1aa3d2d3fd3b5190f420a22f55fdc7b9d304

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads