4ae6eaf06047e3a164c442112e10185222ece46e49e9e3a5b2b9e74dcdb49e13

Analysis

max time kernel
125s
max time network
181s
platform
android_x86
resource
android-x86-arm-20240514-en
resource tags

androidarch:armarch:x86image:android-x86-arm-20240514-enlocale:en-usos:android-9-x86system
submitted
21/05/2024, 05:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

app-release-xjtwms_4.2.0.apk
Size

8.8MB
MD5

8b7dc53f7b572c34b5fe4e38c2682648
SHA1

c323dd5fffc3399ef93e99510b4377b9edd32a43
SHA256

4ae6eaf06047e3a164c442112e10185222ece46e49e9e3a5b2b9e74dcdb49e13
SHA512

2a46fb4f7edf7635f0e4af8f12b089d1cb1f9fd488aadf5544daf1cefaa8e3b6171523e40c2992b0b028553cd1d25d12788c566485afbef0b644b8a28d8ecdcc
SSDEEP

196608:VpIuq0AUscfMttuUm/t0AIXxNEwszmh+Z3O93rPk1yUHarGA:Ve/2sckDu7eLFh+Z3OprPkNA

Score

8^/10

discovery evasion persistence

Malware Config

Signatures

Checks if the Android device is rooted. 1 TTPs 1 IoCs

evasion

System Information Discovery

T1426

ioc	Process
/sbin/su	com.xjtwms.www.wms

Checks memory information 2 TTPs 1 IoCs

Checks memory information which indicate if the system is an emulator.

evasion discovery

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	com.xjtwms.www.wms

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs

persistence

Broadcast Receivers

T1624.001

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	com.xjtwms.www.wms

Checks if the internet connection is available 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.xjtwms.www.wms

com.xjtwms.www.wms
1⤵
- Checks if the Android device is rooted.
- Checks memory information
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Checks if the internet connection is available
PID:4322

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Discovery

System Information Discovery

T1426

System Network Connections Discovery

T1421

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.xjtwms.www.wms/app_crashrecord/1004

Filesize
229B

MD5
db07e2b26fe0a80b00f5f0e66a69c627

SHA1
44bd1ba7fc55553e76ec5c0e8302a6fa343be9dc

SHA256
f250c84223953292d0efa418e89844169de6e2b80c2b6b7be1e222dd25f19a34

SHA512
7140ca40e6fdc0c385821e94ccba331c0ed94bb95ade756faf9d5f84eb3b11da4cbaafa3f4ffc45aedeabbba8ca3a16bd88197225afef6254165a446b4c10450

Download Submit
/data/data/com.xjtwms.www.wms/app_crashrecord/1004

Filesize
58B

MD5
0d210bfb2a0e1f1b4c082a6a0f79de07

SHA1
bb8ed9e364db79d1d9f2fcde3f15091893222faa

SHA256
988722c23d78a46021d0e7ca9deee7aa8bb83288269174ffacb7316f381cca1d

SHA512
536e9867b0df29b15b789f8949be6ab37fcdeccb9d39ded981da7dc2052c9533d0ec0e6f9a5444132977605d372e1463d91bdde41b528ff2ca3f65ab152325c1

Download Submit
/data/data/com.xjtwms.www.wms/databases/bugly_db_

Filesize
4KB

MD5
f2b4b0190b9f384ca885f0c8c9b14700

SHA1
934ff2646757b5b6e7f20f6a0aa76c7f995d9361

SHA256
0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514

SHA512
ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1

Download Submit
/data/data/com.xjtwms.www.wms/databases/bugly_db_-journal

Filesize
512B

MD5
990eb5e36fd1c3242e7f8ac2c23a6aa8

SHA1
b8f0b4cc00c20dc6219cd00c50e0cfb4115b717a

SHA256
526b675f046071d99e73431cb2bebd6440cb30ec5082f007ea6d333bcd1931dc

SHA512
bf1cfa62c4933d8bf3c3aa71b9cfb71e16ed79eec1fe5d6124f32b0f1ffa3febe05246aa86692c11cd91ed9697248a722325c78149ddfba8390fdc610009961e

Download Submit
/data/data/com.xjtwms.www.wms/databases/bugly_db_-shm

Filesize
32KB

MD5
bb7df04e1b0a2570657527a7e108ae23

SHA1
5188431849b4613152fd7bdba6a3ff0a4fd6424b

SHA256
c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479

SHA512
768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

Download Submit
/data/data/com.xjtwms.www.wms/databases/bugly_db_-wal

Filesize
84KB

MD5
66dcfa5b4687ce797b60d9eb47a0683a

SHA1
0e51aca41ffb21555486f131cef1c0520d439ed6

SHA256
f52b3ca02ee4f301c6327bc3c89488ef3419823dbdfd2a77bfcaa676243487f8

SHA512
a0c50ff9a4253ff059e2661b3411e1d4ba6df0533adf0fb0b30589c041cfb60ea6305574f14e9a6a06aec8373c54c834d6df4c60e32dd69cde42798669391de3

Download Submit
/data/data/com.xjtwms.www.wms/files/bugly_last_us_up_tm

Filesize
13B

MD5
1c18b5b2e1cb62a4bf93543169868d2c

SHA1
57fb94d056d7b0d5d562f57446037200bb488831

SHA256
a7513b148a93ce7b5a2168d8dd33b6bf6243a36d8e7b50a6c186341cadc0103c

SHA512
733d952da5451ac9112b702cb2d0b40d5c60453a44edc796645f181fb1c72f268a345a551ff88df0f40dbc9e27681f279777bc3e2c90a0268abb00c85980468f

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads