9544d149ed965ae3351f7be1032f295e40527c57921e23b3a0f12035169a015c

Analysis

max time kernel
10s
max time network
144s
platform
android_x86
resource
android-x86-arm-20240514-en
resource tags

androidarch:armarch:x86image:android-x86-arm-20240514-enlocale:en-usos:android-9-x86system
submitted
22/05/2024, 04:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
muzhiwanapp.apk
Size 6.7MB
Sample240522-e43k5sca89
SHA256 efa8e431c5d5b3bda3cfc0da4392d14ef447643412bbea22536a155c7aae82b4
MD5 f166fff17a539f053550965c87c42054
SHA1 8be071793576b6e324db218f02a017439fe826a3
SHA512 26869689b5a58e52e63d95b07cf04f560c4580e9bd408a432a61acace492201ffe93cb7e4166a360530eff8fa3827ae0df83ee43e30daa7f670010d59a8bab8a
SSDEEP 98304:thCSkJBDmTuhW+7eF0JUQ4KMB6NQP4WfxRENHpxPOJHMMC1dh4Zadvtvc8Y6dtR3:nru6wUQMBj4WfOHp+HPC1z4mkKdYIx
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

discovery evasion

Malware Config

Signatures

Checks if the Android device is rooted. 1 TTPs 1 IoCs

evasion

System Information Discovery

T1426

ioc	Process
/sbin/su	sh

Queries information about running processes on the device 1 TTPs 3 IoCs

Application may abuse the framework's APIs to collect information about running processes on the device.

discovery

Process Discovery

T1424

description	ioc	Process
Framework service call	android.app.IActivityManager.getRunningAppProcesses	com.muzhiwan.market
Framework service call	android.app.IActivityManager.getRunningAppProcesses	com.muzhiwan.market:mult
Framework service call	android.app.IActivityManager.getRunningAppProcesses	com.muzhiwan.market:mzwlogservice

Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.wifi.IWifiManager.getConnectionInfo	com.muzhiwan.market

Checks if the internet connection is available 1 TTPs 2 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.muzhiwan.market
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.muzhiwan.market:mult

com.muzhiwan.market
1⤵
- Queries information about running processes on the device
- Queries information about the current Wi-Fi connection
- Checks if the internet connection is available
PID:4312

com.muzhiwan.market:mult
1⤵
- Queries information about running processes on the device
- Checks if the internet connection is available
PID:4347

com.muzhiwan.market:mzwlogservice
1⤵
- Queries information about running processes on the device
PID:4397
- sh
  2⤵
  - Checks if the Android device is rooted.
  PID:4637
- su
  2⤵
  PID:4664

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Process Discovery

T1424

System Information Discovery

T1426

System Network Connections Discovery

T1421

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

notes-db

Path /data/data/com.muzhiwan.market/databases/notes-db
Size 4KB
SHA256 0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514
MD5 f2b4b0190b9f384ca885f0c8c9b14700
SHA1 934ff2646757b5b6e7f20f6a0aa76c7f995d9361
SHA512 ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1
MD5 SHA1 SHA512

Submit Download

notes-db-journal

Path /data/data/com.muzhiwan.market/databases/notes-db-journal
Size 512B
SHA256 001912a97726c3115ce558e108dd258b6fc36785490dc256c4a13b1671f42438
MD5 7dfd10445baae5efde04cf71c7e6cf5f
SHA1 b4f94925efea0171b800e4e2b5410c6a1a20d96a
SHA512 07cf60007e4b99d29963237278338db9d815344ef7b5b5b41e94ab2e715bf55f87bf0bfb1f4fe2b30d6e3b33bdd3d7674cf597fffa4245c6bd9593cfa01a8489
MD5 SHA1 SHA512

Submit Download

notes-db-shm

Path /data/data/com.muzhiwan.market/databases/notes-db-shm
Size 59KB
SHA256 fea09ae5bbfb387d5ce84e49acf6ddd7ebc25cf643359f897844c7e9abfa2648
MD5 1f78dbf021cc63edaf467200d58d07d0
SHA1 83311b2365856ded1844d9cef2b9b1c4addc58ed
SHA512 2a59cb4fed707d6b5d78c789216bde76ab86cb76d7abfa6c7a4a4fdb7272d099eb3137a98b42a6c55bee4dc85ba664ccffe6ae05218b72eed39fa08739c57d54
SSDEEP 1536:mYeEpcH/obgLKxe7wust6XTyLaFcBowg/pL2Nka2MXX3C:QEKH/BKxXMXTym/pyKiXnC
MD5 SHA1 SHA512 SSDEEP

Submit Download

notes-db-wal

Path /data/data/com.muzhiwan.market/databases/notes-db-wal
Size 28KB
SHA256 70b72e687c2fe215e356e0c08cbdabafe9309eb26d6fa8f34c8021d4f646c9b4
MD5 f4fa023ab9a76c8e11f7e03246cceb47
SHA1 9e632a81d38fa98085d5a49d61a6a4eb81519bfc
SHA512 489887a5bf960c0fe0e07605e963d50d8bd4aaa468870702c0c0677fe59986475d7a25f6ae7db0df968c95913e32708b10e3ea6a1ae9b31ce2e4f30d115999bf
SSDEEP 24:KuFzyGSP/rTFsf8WGGMLi5LYcD66GNGSP/BG:NFzNSP/rdcMLi5RDHSP/B
MD5 SHA1 SHA512 SSDEEP

Submit Download

install_file_dir

Path /data/data/com.muzhiwan.market/files/install_file_dir
Size 4KB
SHA256 ce1883fc828f3fc4319b13b7848b02b75ae725e492edae50dfc1d7cf9da014fa
MD5 9050147e2e5780e59113f1d37b4ae86a
SHA1 d5a1dbf86b82ee7d6dc9b0726fdacfae08f6cf09
SHA512 6b59425362646f0ae0e94675ff68fbf8a3ed3f7fee4086e002d9f687d1d83eed46b0261d64ea1a3956172b6ea8ce604808034370c248b8e6f9937ee941540621
MD5 SHA1 SHA512

Submit Download

install_file_dir-journal

Path /data/data/com.muzhiwan.market/files/install_file_dir-journal
Size 1KB
SHA256 9cf1b4e64ed925f35d74c30d4e54169ffcc856029b6a9e6683185ab80e04e88b
MD5 e4fca178be11b3b9c1fdf1db2a1a043b
SHA1 f8548d0b4326c44168bbadca4bcb76d08e15264f
SHA512 84230cf2f21cc0d01ba149e7a3560fe56717ce6ecabc907b78537f325af3fad09bce5c8ae90686d22c95cb064b710a99cbc9765b950f23ca4c527ea5a16b0139
MD5 SHA1 SHA512

Submit Download

install_file_dir-journal

Path /data/data/com.muzhiwan.market/files/install_file_dir-journal
Size 1KB
SHA256 aa23ab5ea8587eceee7bdec26257f45f1bcd6c5f67b45a1d7d4c3473c7d347a2
MD5 fea88cfdb8519052ae8b6f87b82fe372
SHA1 f8019506d30c1f342bade769d818f7e12a761560
SHA512 f3c738e0d7014fb0df740e9e2811a3491829b2c6d4f5bd88bf19f41f7b29327b256a99b188040680c93f62614fa772b537bcc9192f4e564359baae1c66313307
MD5 SHA1 SHA512

Submit Download

install_file_dir-shm

Path /data/data/com.muzhiwan.market/files/install_file_dir-shm
Size 32KB
SHA256 c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
MD5 bb7df04e1b0a2570657527a7e108ae23
SHA1 5188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA512 768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012
SSDEEP 3::
MD5 SHA1 SHA512 SSDEEP

Submit Download

install_file_dir-wal

Path /data/data/com.muzhiwan.market/files/install_file_dir-wal
Size 3KB
SHA256 573bc83f099dbbd5c616f68979a9c809a873f6091d75485faea12073801890dc
MD5 bcaf9dcad387ac8a8683610b412484df
SHA1 e091149292c729688b9b76180aff210640000b42
SHA512 cc769fff6a309b81b52b81a5f9047c68b3633264b9db69609caa2d45cde54abcfc88a6b7774ee8ca44b2aa83e262abab2614b29c99670396d7437cd02864495a
MD5 SHA1 SHA512

Submit Download

install_file_dir-wal

Path /data/data/com.muzhiwan.market/files/install_file_dir-wal
Size 3KB
SHA256 fcac9bf6bced15f4dc2d85654e0ea5bcbd45a0fa0a3a2ce18ed8b5d8953d21b3
MD5 07b5ab2fea6577753b9afaf3c8fd9938
SHA1 fe8bf21a550bd93dda2e93d86b649dae0a3dd59f
SHA512 93f001f41bec0430fd91c170e24c3e649b762d302bde1bee24da1489804c28d93b0e3e0b858ee099c1b3be9bacd1723319d7bc5d145eada6cb3e61bc066a641b
MD5 SHA1 SHA512

Submit Download

.systemid

Path /storage/emulated/0/data/.systemid
Size 42KB
SHA256 dbc8dd59723655ac518d8c73b65a9323fb0b1c2de9f3999fef25c8cce9bace7c
MD5 b626e94f40929769b55ff7899ba12cf8
SHA1 8c0dbc8c95493590c81ced5e5e8d8391bfd652ba
SHA512 161e7bbc4702a11bdf87b11605f12522394d8d80c7fe33304744d654cf43eaf955f82e763f51b9b6722b1863eab29dfebac04c67dc926188e8d1515de80fd422
SSDEEP 768:ccPev5+EU7aX9WkB/gUrXFWLKxe7X+Fu9hRv6Xf3QpD+X7aFkuzkjEm:ccPehi4WkZbgLKxe7wuzt6XCyLaFmV
MD5 SHA1 SHA512 SSDEEP

Submit Download

.systemmac

Path /storage/emulated/0/data/.systemmac
Size 42KB
SHA256 14b68457395896d3ffe12b777f52fe2cc4182a6c9ba383555b12522c93657b00
MD5 7bc525aa5cfd71cd4d2ad570fd72a906
SHA1 b411e1b345b5e9e4a0e4f603b46277278981e921
SHA512 5f1973360665bdeb536d8dc2a9c5d2077990fbc6fd3653747de9d54c7032a776151f39986792ab57773623a143b2d65cfbb585aa53c823197485eba9e75c8e2f
SSDEEP 768:ccPev5+EU7aX9WkB/gUrXFWLKxe7X+Fu9hRv6Xf3QpD+X7aFkuzkjEC:ccPehi4WkZbgLKxe7wuzt6XCyLaFm3
MD5 SHA1 SHA512 SSDEEP

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads