eccc556f9112b4862fd656e51db1fc5e22692a4bad7444b7c078cf0e4d8da2a0

Analysis

max time kernel
177s
max time network
188s
platform
android_x86
resource
android-x86-arm-20240514-en
resource tags

androidarch:armarch:x86image:android-x86-arm-20240514-enlocale:en-usos:android-9-x86system
submitted
22-05-2024 01:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

eccc556f9112b4862fd656e51db1fc5e22692a4bad7444b7c078cf0e4d8da2a0.apk
Size

17.9MB
MD5

6578a366c4cfb1d2e9c49da95aebbe31
SHA1

8eb6aae6a336c1aec4ae8e60739648884ec3a571
SHA256

eccc556f9112b4862fd656e51db1fc5e22692a4bad7444b7c078cf0e4d8da2a0
SHA512

b4379cdc33ecf7c508c551cc96ed7b8bea53db4874e2a5d2066f1f4ec044bc1a84536f7ac35283dd591553967a14dbb10e17297a48e05c6dce9ee029d8b2a7d6
SSDEEP

393216:eu+tb9cgCkq05dzfxJVcetvhjh7rgnpVC4TZls+FJ+FQ:n+tb9cDC5dzfRhvhVUDRZl5B

Score

8^/10

banker discovery evasion impact persistence

Malware Config

Signatures

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
banker discovery

Security Software Discovery
T1418.001
Checks CPU information 2 TTPs 1 IoCs
Checks CPU information which indicate if the system is an emulator.
evasion discovery

System Checks
T1633.001

System Information Discovery
T1426

Processes:

uni.UNIBFC06D3

description ioc process

File opened for read /proc/cpuinfo uni.UNIBFC06D3
Checks memory information 2 TTPs 1 IoCs
Checks memory information which indicate if the system is an emulator.
evasion discovery

System Checks
T1633.001

System Information Discovery
T1426

Processes:

uni.UNIBFC06D3

description ioc process

File opened for read /proc/meminfo uni.UNIBFC06D3

description	ioc	process
File opened for read	/proc/cpuinfo	uni.UNIBFC06D3

description	ioc	process
File opened for read	/proc/meminfo	uni.UNIBFC06D3

Queries information about running processes on the device 1 TTPs 2 IoCs

Application may abuse the framework's APIs to collect information about running processes on the device.

discovery

Process Discovery

T1424

Processes:

uni.UNIBFC06D3:pushserviceuni.UNIBFC06D3

description	ioc	process
Framework service call	android.app.IActivityManager.getRunningAppProcesses	uni.UNIBFC06D3:pushservice
Framework service call	android.app.IActivityManager.getRunningAppProcesses	uni.UNIBFC06D3

Queries information about the current Wi-Fi connection 1 TTPs 2 IoCs

Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.

discovery

System Network Connections Discovery

T1421

Processes:

uni.UNIBFC06D3uni.UNIBFC06D3:pushservice

description	ioc	process
Framework service call	android.net.wifi.IWifiManager.getConnectionInfo	uni.UNIBFC06D3
Framework service call	android.net.wifi.IWifiManager.getConnectionInfo	uni.UNIBFC06D3:pushservice

Queries information about the current nearby Wi-Fi networks 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about the current nearby Wi-Fi networks.
discovery

System Network Connections Discovery
T1421

Processes:

uni.UNIBFC06D3:pushservice

description ioc process

Framework service call android.net.wifi.IWifiManager.getScanResults uni.UNIBFC06D3:pushservice
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
discovery

System Network Configuration Discovery
T1422

Processes:

uni.UNIBFC06D3

description ioc process

Framework service call com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone uni.UNIBFC06D3
Queries the phone number (MSISDN for GSM devices) 1 TTPs
discovery

System Network Configuration Discovery
T1422

description	ioc	process
Framework service call	android.net.wifi.IWifiManager.getScanResults	uni.UNIBFC06D3:pushservice

description	ioc	process
Framework service call	com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone	uni.UNIBFC06D3

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 2 IoCs

persistence

Broadcast Receivers

T1624.001

Processes:

uni.UNIBFC06D3uni.UNIBFC06D3:pushservice

description	ioc	process
Framework service call	android.app.IActivityManager.registerReceiver	uni.UNIBFC06D3
Framework service call	android.app.IActivityManager.registerReceiver	uni.UNIBFC06D3:pushservice

Checks if the internet connection is available 1 TTPs 2 IoCs

discovery

System Network Connections Discovery

T1421

Processes:

uni.UNIBFC06D3uni.UNIBFC06D3:pushservice

description	ioc	process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	uni.UNIBFC06D3
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	uni.UNIBFC06D3:pushservice

Queries the unique device ID (IMEI, MEID, IMSI) 1 TTPs
discovery

System Network Configuration Discovery
T1422
Reads information about phone network operator. 1 TTPs
discovery

System Network Configuration Discovery
T1422

Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 2 IoCs

impact

Data Encrypted for Impact

T1471

Processes:

uni.UNIBFC06D3uni.UNIBFC06D3:pushservice

description	ioc	process
Framework API call	javax.crypto.Cipher.doFinal	uni.UNIBFC06D3
Framework API call	javax.crypto.Cipher.doFinal	uni.UNIBFC06D3:pushservice

uni.UNIBFC06D3
1⤵
- Checks CPU information
- Checks memory information
- Queries information about running processes on the device
- Queries information about the current Wi-Fi connection
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Checks if the internet connection is available
- Uses Crypto APIs (Might try to encrypt user data)
PID:4308

/system/bin/ndk_translation_program_runner_binfmt_misc /data/app/uni.UNIBFC06D3--VuuSPQqacOU4dbQtlzv9Q==/lib/arm//libweexjsb.so /data/app/uni.UNIBFC06D3--VuuSPQqacOU4dbQtlzv9Q==/lib/arm//libweexjsb.so 63 64 1 /data/user/0/uni.UNIBFC06D3/app_crash/crash_dump.log
2⤵
PID:4371

uni.UNIBFC06D3:pushservice
1⤵
- Queries information about running processes on the device
- Queries information about the current Wi-Fi connection
- Queries information about the current nearby Wi-Fi networks
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Checks if the internet connection is available
- Uses Crypto APIs (Might try to encrypt user data)
PID:4501

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Discovery

Process Discovery

T1424

Software Discovery

T1418

Security Software Discovery

T1418.001

System Information Discovery

T1426

System Network Configuration Discovery

T1422

System Network Connections Discovery

T1421

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

T1471

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/uni.UNIBFC06D3/app_tbs/core_private/download_upload

Filesize
974B

MD5
9ac675f1b74147b220c2f766061d9ee5

SHA1
205f3dee09ca620ad68e59f12cd324c7ec026ad4

SHA256
92bba0770a502adb607c2f0f2feb2b129e7144271b9db6471e7cdbc7d118a974

SHA512
9ca5adbc8250e443db5b86fa3191c6a886bf3c4861e9cd719b42495b23a8bb522113c63a9038e619b0b5b452ec884048439437b9b27f415b36585f724f4dacc7

Download Submit
/data/data/uni.UNIBFC06D3/app_tbs/core_private/download_upload

Filesize
160B

MD5
1cdd16bb66476f9852555a3ec8532d32

SHA1
8cb35a917669adb4f5160a3e9e261c56fac3a188

SHA256
ec658cf98d1dd5b4f204a6f51cca93e1c3bb2a8d6cb2eec0ce1926d3b9a14ea7

SHA512
00a74b439ffee8d4404b7c590bd33e2666ef3c1537a8bd9d48cd2f72bcb0ab7b4c68632033af712e3ce0d9f07ea055b9cf7885fe21f79f2b44a39903a1838221

Download Submit
/data/data/uni.UNIBFC06D3/app_tbs/core_private/download_upload

Filesize
512B

MD5
27a499d1801879612e1df7dd7124cd48

SHA1
0f7244381407a55f1f93c9135a2af0891ec0e938

SHA256
37c9f1844b7af5daa4c396dc54716d8f35f3664089a8dd87945b3fd5232cf555

SHA512
103e97cefea52d8d8e4aa140482a08773e449fb83ea8262e9eb2ba63be8060fcadd4c04eafe6ff28a557bc8f875d8d8cfa1d0a0477a5ee5110014370a2cb9faa

Download Submit
/data/data/uni.UNIBFC06D3/app_tbs/core_private/download_upload

Filesize
4KB

MD5
f2b4b0190b9f384ca885f0c8c9b14700

SHA1
934ff2646757b5b6e7f20f6a0aa76c7f995d9361

SHA256
0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514

SHA512
ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1

Download Submit
/data/data/uni.UNIBFC06D3/app_tbs/core_private/download_upload

Filesize
52KB

MD5
3a80cecf63a5d7d05627fb440fe932b3

SHA1
ac767ecea4151b488b5455b51ad496bb192ddac7

SHA256
b179b52a7e8e284a9ca29395d520f005e79cc47568a9d886fbca0108c6d7d5d7

SHA512
c05af694bc96159d079236f12507ace3a877b29c985abfb1260daa64f1a47a03a80cc8db6d5df9cdb9b8e1c66aff6238553cc022277ee0fa4490d73abfc56fd3

Download Submit
/data/data/uni.UNIBFC06D3/cache/image_manager_disk_cache/6211e3fc809db2b31cab5de9ed2bb33ffb0b4f1a9275d3556a4c29d6b4980687.0.tmp

Filesize
806B

MD5
57d9a2d35a1a71bfb1cce2b72649eb46

SHA1
061955a570834a0419cb7eeab2bd39d50de568cb

SHA256
c8c9e41ed35217c5ef4865e92b9febea59e4bf4052947b08474678f4068119d3

SHA512
0b9ccfa553c9e574ba920e16ccb9d8468d9e7c5b2950775eef6e1956d44600a3a63b185f7a9dbd56896a34ea130c04c16a49c4e9b40ae0728c77197f40f1d8e7

Download Submit
/data/data/uni.UNIBFC06D3/cache/image_manager_disk_cache/de6f6f1a5ff251e9eece267770ebde10e6db4e0804a852e92bfd0e91d93369b0.0.tmp

Filesize
613B

MD5
567c1cd236155df63be84e01e38cf24c

SHA1
0915ae102d6ffe5e4950ab200c7eeac6d3e36f6a

SHA256
c68692aaa07480ff14b85f079e45f1e6ddf7caa2098ba15fede9f024224a8b1d

SHA512
88e756fccecc4ab936f62f325d8ddd3fcbc086ad98420e8ec4c3d55a0c9fd4be1f9550e0427231d7facef59f28b18c8f1ca75d68aa1e8efc4afc3c4cbc78abfa

Download Submit
/data/data/uni.UNIBFC06D3/cache/image_manager_disk_cache/e4b86449dec08bcd97632f67da646b7d8c29c5d93489c2cbcb464c3d94d27273.0.tmp

Filesize
416B

MD5
4c7f80d4f17d45cfe39332603a0938a4

SHA1
f5ad237716bbc97b39a0ee3a5c13a92ffcd377e9

SHA256
b9742c1bf8feb414b02e8f8feeb96c1975df0755320ec88f0a73815c19844ba5

SHA512
f4736c779ae3b6621f29afcff20ace7acaff93da34bba22c1587c910012e8ed87cb22d43aa14f65735b2cdced06d95e3b452f606758f0fe1c4942991020de36f

Download Submit
/data/data/uni.UNIBFC06D3/cache/image_manager_disk_cache/f380cc0de0e233463686c3048b5e65696184c76d4d14fd6e5f53d26e9964f762.0.tmp

Filesize
712B

MD5
ea253f5180129d5ed779266f83f3ed70

SHA1
7bc3d7fbd127234ffc5f041d61b35ddfc18bfb37

SHA256
d1b10125701101a06ea611836afb88018487fd2d759e7ffd5f59be7a72d7292f

SHA512
59b4dee5a1df9ea5dfe0f5e769974021c2cd50f0d0414f76c5b33632d0e64a2a5f3771f7e53e58863b5d724dcf0ade204efd9165257fe1b7fed834dc1679d7d2

Download Submit
/data/data/uni.UNIBFC06D3/cache/image_manager_disk_cache/journal

Filesize
615B

MD5
229058b719103f339a5c7aab62fcf39b

SHA1
f9bb917106244c08b61d6085c699ed7aef3dd238

SHA256
287e28a12fd3a98024db7c3d42c28a061e7ee650ccaabd0fd577a109b8208202

SHA512
4b64cb4ecf1dfe773f48f4c63c815b79919ca94e460121f0ef8043946ebdc0b35831f412ba669083589d1656537545bc4eda8d20ba725aeaa4a44f2cd1975b7c

Download Submit
/data/data/uni.UNIBFC06D3/cache/image_manager_disk_cache/journal.tmp

Filesize
31B

MD5
8c92de9ce46d41a22f3b20f77404cc1d

SHA1
8671a6dca00edb72be47363a7071be65cf270373

SHA256
68bb33ddeed9200be85a71f70b377985f9ee68e91578afbde8321463396f1274

SHA512
30f45fe9954215d6adafcc8f0a060a7ff41963a64f9b849a37f0d18fe045038d429ec13bf15226769c4ba78dad3c52f3d9e0dbbb4fcdea4828a1efe956e48f56

Download Submit
/data/data/uni.UNIBFC06D3/cache/weex/libs/weexjsb/armeabi-v7a/libweexjsb.so

Filesize
6KB

MD5
5ec4ade7f24b241c3576fd6e1d4f055e

SHA1
4ae74649639ef01b39acb095acd1a4d43eace185

SHA256
8c535785dbd262622806dd06a1d6c43685efc1fb7986095631ba10248fcb8540

SHA512
513ffcabcf03f84b614719c252a33204d45d93633c666e6d920edfa84d89276710cff4589d2e0c61fa57d74eca3673a6cae1fa2f8854c00fbf7935fe664816b7

Download Submit
/data/data/uni.UNIBFC06D3/databases/DCStorage-journal

Filesize
512B

MD5
73dcb35853cb170156fd1435981ae402

SHA1
9d37dd2215eea0d50a3826270087cc4ea8e3a79c

SHA256
50994fe34e3f576542582799832bd3a251c82e0df794ac4e4e39a439a5a99166

SHA512
992b41a6082bdae7a6b2a04c1c301a667d825075c8ddded9079ec56c5a0604bd8b0b3f42aa61d29e825c19553700e5c5280d5660a7508fae9b9b8ae53bc66dae

Download Submit
/data/data/uni.UNIBFC06D3/databases/DCStorage-wal

Filesize
108KB

MD5
b72b17530b6f99ec05e03fb0eddc2ec3

SHA1
42283f9cd0e4f849bc4edcf2ffc639b46557a5da

SHA256
a20c11fc074af8f03f543b34fef126a6a7fb974c228dc0e69543f6d929b78734

SHA512
31649f6886442210faf1f0b795746185bef208d78fca08f162b67ae0d7f5c117a9d2968d1107617274519d44cb4e9c9cd2e625afad347809182e000fc41752fa

Download Submit
/data/data/uni.UNIBFC06D3/databases/pushext.db-journal

Filesize
512B

MD5
fd5f9ffa89661ec7dbaf3da6ee24cd03

SHA1
7ee4d963a0aa3e33ee53e31ba9dc6010eb80ddb1

SHA256
2b6c2b6853c99a6ccfc68d739dfe704b5b22caac5ba33d00e096efa570b1db18

SHA512
5a250ce3c8b384b239c332d9fba78d9f8c7c2a33d4823adc842e2e46605dfb037be8262644a9f5f51558655b227180e93cdbbb0e8eb986b478d1f5ab90b6aa5a

Download Submit
/data/data/uni.UNIBFC06D3/databases/pushg.db-wal

Filesize
72KB

MD5
181fd240724f238a77ba1efb7e692527

SHA1
9ead785572fe593e05a94de6115a94016d1ff07b

SHA256
9ac291e643325cb1509e5ca9c6da261b8d0fdf9c9218356141c761f5861bca80

SHA512
6cfaaa01a3327cac8010cb161eb2d6502cf7373a077ae94884a40c54b1d66b3bc92cdf76cf3c5060af985117f668566cae082763249c448fb902d6c510482ed7

Download Submit
/data/data/uni.UNIBFC06D3/databases/pushsdk.db-shm

Filesize
32KB

MD5
bb7df04e1b0a2570657527a7e108ae23

SHA1
5188431849b4613152fd7bdba6a3ff0a4fd6424b

SHA256
c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479

SHA512
768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

Download Submit
/data/data/uni.UNIBFC06D3/files/.imei.txt

Filesize
32B

MD5
e4e8756289f28fe5ed00c5a3d7f7c84d

SHA1
f25c01710d5fe27951b06d446c8798576a074522

SHA256
9a90f0a077a8703eb188443036d2763f030475e1bf1a6a6fe589132b7b5fd0af

SHA512
7ec0731d18196d59d405f57433d88c9d6a4ccd4f7765846a07aaa5e963223ff5a6bb990724373dd42761919b61314eb7410a1abfacb0d5408e73f91f5e2f54d0

Download Submit
/data/data/uni.UNIBFC06D3/files/cnc3ejE6/eje3cnc

Filesize
35B

MD5
762298b93820a5cd8b6d8ec469078f7f

SHA1
d5b02a2ff3b235cd2b61ceff53a1d88b8984477d

SHA256
dc3f98a33c26c2796dc294b354831fd5ca9796295f4cb38479c80b145d4807db

SHA512
70f864211ce16679d0538abf9b7071d27c2d22ae458e32409d20065032c762dd186307ef33ede90abd9ac794a4ced8b163404e9799c05f0c515337249684311e

Download Submit
/data/data/uni.UNIBFC06D3/files/init_c1.pid

Filesize
14B

MD5
57d25d337dfc260cf31ee09f6135b212

SHA1
6047b83059ef00e8563244639b68ab8e7df73ec3

SHA256
e4b7fb65aa7110aad6489b847306effd2fd00924a77f7f54466d0bd952518595

SHA512
89d56981385fc82e4cce9757a249fb923e1d3b196ed6b4ff67f194808575c97c1b2f48653d8080be547a4385ef4bd7263856a4dc36109fe512d64a3642057916

Download Submit
/data/data/uni.UNIBFC06D3/lib-main/dso_deps

Filesize
32KB

MD5
bcabdde415fe345f9ca35e8bd3060b78

SHA1
0bc361e1009334445d2ae86ca1f0cdac584315c2

SHA256
2251933c5c12418ae8bca1f2dde2bfb9d9fbc35aefd5d51f54a10e577a3a28bf

SHA512
8c17897dbf8a51ded613d5a261465bf8dbd63d46988564c4aa2a5e7ec4fadaffa55ce2faa642d1068c98df8131fc654f76e8cfbd8e56709dd8b5882476f936d2

Download Submit
/data/data/uni.UNIBFC06D3/lib-main/dso_manifest

Filesize
5B

MD5
c06857e9ea338f3f3a24bb78f8fbdf6f

SHA1
c5a0a2529d2deb60fec041b4fbd722a2ebe31702

SHA256
957b88b12730e646e0f33d3618b77dfa579e8231e3c59c7104be7165611c8027

SHA512
29f61516876c25379a7bf4faa2b3ca6f6b53eac90e7de47671fec4a818d51441b4025cd7909f7c0a0d113ab6c5ff00cb3700c286bac7319185b77905feec4fb1

Download Submit
/data/data/uni.UNIBFC06D3/lib-main/dso_state

Filesize
512B

MD5
e0771cb87b2e88076eaec9dff9bfac4a

SHA1
4b1b44211db3bd9b97a8a60d55749bbaa43c31f1

SHA256
5cafd392e5cadb5b3f43a2e7fa0df2ef073c2053620db67413a5fbc11f1488e9

SHA512
4d087f9b0f0015769c4d5a0e6955f58a52bd1298f55d0148f4aca2e247febf31659583ad462e3621d1a0d2f2bb4256ced2966f023c38d06cb8f36788b0b03bcf

Download Submit
/data/data/uni.UNIBFC06D3/lib-main/dso_state

Filesize
1B

MD5
55a54008ad1ba589aa210d2629c1df41

SHA1
bf8b4530d8d246dd74ac53a13471bba17941dff7

SHA256
4bf5122f344554c53bde2ebb8cd2b7e3d1600ad631c385a5d7cce23c7785459a

SHA512
7b54b66836c1fbdd13d2441d9e1434dc62ca677fb68f5fe66a464baadecdbd00576f8d6b5ac3bcc80844b7d50b1cc6603444bbe7cfcf8fc0aa1ee3c636d9e339

Download Submit
/data/data/uni.UNIBFC06D3/shared_prefs_ext/test_app

Filesize
29B

MD5
f0fcb208fc1b5c500fcc7915a1642e6a

SHA1
24951bc89e7f451c0a87626f7f61e0555f555a0f

SHA256
19d8fa6c408a1d15b24d2447e6924abe2f9f41ac4f9e24745d6ecb6899616a26

SHA512
3a41f837459ea76e2480d156d3c728ab272055dfdc1a334601e4957881a96724d4aafb62e8930717d35e67a9eb3ccda6dbab463d426ace6330f84d066084b066

Download Submit
/storage/emulated/0/Android/data/uni.UNIBFC06D3/apps/__UNI__606A681/temp/1716340592954

Filesize
1.1MB

MD5
ff146195dd866695cdb4b68d8d7402b3

SHA1
622e257f00653c6a471e1af534c5acf9cd601f77

SHA256
554e21fb5785ed11d03ac5f0d328a20890cb9e27d64b95c12667f0150bbecb35

SHA512
486f3ef82a34a856a6bfac6b9707661f4ab460b996bbf9f334f59c5be9d65e45e5d118ede93f16d66e8ac2b06fd540026c03bec34056ebe0182267830601b690

Download Submit
/storage/emulated/0/Android/data/uni.UNIBFC06D3/files/tbslog/tbslog.txt

Filesize
189KB

MD5
31db5b5a7908d19545764199aa5da6b3

SHA1
c0a0fa2126af7aee80ae1c62fa8923dc595ddf7a

SHA256
4066c44caeb40d5d1ee93e23a8224c81afdd44ad9381aab75781bf72d280ab43

SHA512
6298246bd4faf9dfeceef7d3f4cb160be04e20d590c8f0a159259cc9618754870c77770a43af933cb7f16d20122e8c30f021a9ccec6e4ef8bf9e5169809622a2

Download Submit