Analysis

  • max time kernel
    20s
  • max time network
    139s
  • platform
    android_x86
  • resource
    android-x86-arm-20240514-en
  • resource tags

    androidarch:armarch:x86image:android-x86-arm-20240514-enlocale:en-usos:android-9-x86system
  • submitted
    22-05-2024 12:08

General

  • Target

    main.apk

  • Size

    13.0MB

  • MD5

    fed68ea9226d13de808bfefa83200dd6

  • SHA1

    0d487b13a202de7cec3e2e08d8f56eac14d7cbb5

  • SHA256

    a308268d791570195a8b913d35488ff9cecf240944cd7b3f5515069ddd250a0d

  • SHA512

    33a05f2bb4e1d2bed06982a5e0060108eb427b6f7120d9d1f01a0056d8964021a3f6ed43367e1c9e88571400a4cabc6b7a980afbcb1121ef34c4de623f7b7f8d

  • SSDEEP

    196608:MdE2wljl6qF8I69jllOsb54J1JTZVu+6cNADaxGdX+arzQggVxAC7cZSRXYrl:d3qq8L9jKsVoFZ4pDaxGdXnrzY77zi

Malware Config

Signatures

  • Checks CPU information 2 TTPs 1 IoCs

    Checks CPU information which indicate if the system is an emulator.

  • Checks memory information 2 TTPs 1 IoCs

    Checks memory information which indicate if the system is an emulator.

  • Queries the mobile country code (MCC) 1 TTPs 1 IoCs
  • Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
  • Checks if the internet connection is available 1 TTPs 1 IoCs
  • Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

Processes

  • top.liaotian1001.main
    1⤵
    • Checks CPU information
    • Checks memory information
    • Queries the mobile country code (MCC)
    • Registers a broadcast receiver at runtime (usually for listening for system events)
    • Checks if the internet connection is available
    • Uses Crypto APIs (Might try to encrypt user data)
    PID:4310
    • /system/bin/ndk_translation_program_runner_binfmt_misc /data/app/top.liaotian1001.main-n-HprtMsHAS7uhXD-tNnnQ==/lib/arm//libweexjsb.so top.liaotian1001.main:jse 67 59 1 /data/user/0/top.liaotian1001.main/app_crash/crash_dump.log
      2⤵
        PID:4354
      • /system/bin/ndk_translation_program_runner_binfmt_misc /data/app/top.liaotian1001.main-n-HprtMsHAS7uhXD-tNnnQ==/lib/arm//libweexjsb.so top.liaotian1001.main:jse 59 67 1 /data/user/0/top.liaotian1001.main/app_crash/crash_dump.log
        2⤵
          PID:4472

      Network

      MITRE ATT&CK Matrix

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • /data/data/top.liaotian1001.main/app_A0C44AEE2F919E2F88ADB4D84309C7CB/48781BFA96C701DD12BC2B4C3ACB9415
        Filesize

        134B

        MD5

        82ef34c1496fb1a2944d4cc371707d87

        SHA1

        bbd20a9ebd0e5af1ea538e03653bd47bb8cba159

        SHA256

        4c1c56bbdf3d4e632c380316b57500a6b841995230aeb436e0ab4e3b69474014

        SHA512

        f66976ce773efc5cc21cf3cab7a94d7a0c0fd8a0d3300de0e82d781d292c5e20b33d7319737e7ea78f13d15deac9103a09a55853812353154b73d9b07a2e6062

      • /data/data/top.liaotian1001.main/app_A0C44AEE2F919E2F88ADB4D84309C7CB/97282B278E5D51866F8E57204E4820E5
        Filesize

        94B

        MD5

        85627a2341b641e18ca1719851b1d772

        SHA1

        7f9f816c3053e9d0fb99c4393ec74898f3c6ddda

        SHA256

        0fcc656256da1d4e8ba35df7eb3f3933608f787db2d3478c9540556714551166

        SHA512

        3244614a7a5f21ade2f15b854f1c39c949c062a4b665802e87be8de41b616906d9d51b00a5c719c3ef8b5e4042d124a5f263c79e7a296e1a292490bd19895a19

      • /data/data/top.liaotian1001.main/app_A0C44AEE2F919E2F88ADB4D84309C7CB/E0ABA531044C06F9BF70DF99519D9636
        Filesize

        134B

        MD5

        c32ab7d6b21a74e6eb6291b59d877dd8

        SHA1

        b4869ff0524bfb5afa70989c8eae508ee5a78b73

        SHA256

        7e145dbeecf5e4866d3e9eee89a9e573f5f42cb2b3a3b869ff80721adb6ea746

        SHA512

        e892f8adc0a37be23cf00b44bffce569ff74603c03684cd9034eded1bcb8b29965e7530fa7ded7149fdd6ea055d0f5574300b84774367f1e80dbaaa2cef130e1

      • /data/data/top.liaotian1001.main/cache/cache/weex/libs/weexjsb/armeabi-v7a/libweexjsb.so
        Filesize

        4KB

        MD5

        d4a7a7a35451293b8c59d84665f65ccc

        SHA1

        78ae6e89c00c5be31690a3cf51b354072824a546

        SHA256

        36b59c9cc8f662535c91f028e18b07c0f6f10fdbbb6dd53cb8d0300b484b4854

        SHA512

        b45e55117eb5e060b1e8dc737560db6565d9c96a93bfcd08db8be99a521face6aab9b156e554135ed96f110e8c11d6ab42257223466930a2da26255ac258859c

      • /data/data/top.liaotian1001.main/cache/jsserver_start.log
        Filesize

        46B

        MD5

        9d8907fc1ea8440dd2d2de22236cb07d

        SHA1

        2e81f3d80b5459baa9a8c5a50cc901e7716a726c

        SHA256

        48e0abdab7c305ba839a0e4a532ca580888e13fe8981411d2b487e9736d614cf

        SHA512

        5c86123fdfeea9b026db07b3c88c3d4ba5a76b7c23db2550fea096fedb5b2ff7ff0a2049280c7a4e36cf8405633dc64166dbb0364fedb8b17738fb8d258a4781

      • /data/data/top.liaotian1001.main/cache/jsserver_start.log
        Filesize

        124B

        MD5

        09b239ddaf00e6b622cca6a6679a058e

        SHA1

        ce138f998f059cdb4b8027f10d20b17b008e23b2

        SHA256

        c4ebde63b8a2b13b524cf04e44318f9c36cf6a8fa76e2d87fe142b5e95f620e3

        SHA512

        3f89f33df994249110f63a72fc98827378e99967e9c57be969a00cbd3767f1af99cf6d8adcb32a3fcfeede57b3086bdd1229953f356da468d5b2e4e81ec85206

      • /data/data/top.liaotian1001.main/cache/jsserver_start.log
        Filesize

        940B

        MD5

        8d0f0c17b84872d860869795394530f1

        SHA1

        71c67a4db19fc32e727c39fc4e749babed1e1a33

        SHA256

        cd1174cfe29a3b3283bdb9c5c0ac5c0529dd1a2224e07e7b564cafa266b8f077

        SHA512

        6611e28a21eb1f8907e6264384dd39bbea965951d07461417b242e341576433a48b89496373ecf774aa1269d217220e24cd7784963aabd3267ece1897a28ff14

      • /data/data/top.liaotian1001.main/cache/jsserver_start.log
        Filesize

        1018B

        MD5

        ea77083653b342a7d7e2250cdb6d9330

        SHA1

        e7935e94fb4f0458a66d25f8ba6e5a4fc8b21950

        SHA256

        ececac3799aabde0251b130a0bb6961ec5c2b952cdacee7af4c3c8b5a42ddc4b

        SHA512

        5f22dc38d77c0560f069d373da8a697507d166b0f61ebdc09d83c3b9363be0f96e1613b6d01d8cf3d441f7476cdd2e4fc4f0435d297374923a291759f0eaf13a

      • /data/data/top.liaotian1001.main/files/.DC4278477faeb9.txt
        Filesize

        32B

        MD5

        b486830ee77aac64a589ed067ba3d4fc

        SHA1

        a0e1671268c6359e073fef565683bff9a1b97c2f

        SHA256

        952191e186a031955e15c99d5f5f73da704fcdb1e776ad67c8e7e7a50e48a714

        SHA512

        3ebd174d90a8b8f6fb233b43e25081360ed180152a89f706ddff1c5810ca1ffc4d371bc470ba777cb7dd10fcdce8e7e63d55d10073ad1f9f2be76fadb217aadf

      • /data/data/top.liaotian1001.main/files/apps/__UNI__G2801427/www/__uniappautomator.js
        Filesize

        14KB

        MD5

        e3ddb50b65979238480a42a75a928a28

        SHA1

        048454ef58316ee8541e0fbe8edc6ce885135151

        SHA256

        2fefbea6e4b1d8480ca582555ddd8d46c8da9e30db6222c41113142c20304597

        SHA512

        f925879208bf13c7a1dffda4d52488d232152a115ec7a176dea4db943688f76ac0eba5068ad92317631ef1e44a9a9ec3694dbb27969ac43b01c4858e37929b55

      • /data/data/top.liaotian1001.main/files/apps/__UNI__G2801427/www/__uniappchooselocation.js
        Filesize

        27KB

        MD5

        b59eb004fdd419d9a7f633ea935481c0

        SHA1

        b6453006583f1fbca01a03837e124d49bcd397d0

        SHA256

        69ccb701aefc770b3f1eae286393210ce9d54c4599d8de1c646170376de6deb9

        SHA512

        0d9bb3abb8b8e4a69bd3223434f6a5b28bdd2bf020ffc1c75e1e69c91a3c1b64c20fca332065f829353b6de118e27ebe5d9dc459d801be909e23494f071d1e64

      • /data/data/top.liaotian1001.main/files/apps/__UNI__G2801427/www/__uniapperror.png
        Filesize

        5KB

        MD5

        4b85724c8336cf16e4259cd77839d078

        SHA1

        0077e1dfbd257fc6b953b46b6e0e2a9f67a0e167

        SHA256

        7f8be3263ad01b19844b6a5e6609ac81e2c3c1370c4abd6b7c6083645a038e19

        SHA512

        d766dcf9278a1f5fb02be2eb2f26cc0f08c772ad5bee4faf5ba17424eb0bfaed32b13e2688ae690d38216763698c0dfd91504c3ad2ff21b0810cafcda56c4560

      • /data/data/top.liaotian1001.main/files/apps/__UNI__G2801427/www/__uniappopenlocation.js
        Filesize

        16KB

        MD5

        1e11fc2b19770026f3efc669e5062970

        SHA1

        59a538f02862478834b5013d9086ef68b7772d6e

        SHA256

        8f6651e88ae2ab9e9917546eae5f518785562625360f636975efbc673c7e4da4

        SHA512

        2758765ffdc5c99317c94bba10a822fd68e21789321544ec904b92b97053560b4e5a0b48bcb29d3a2749548d9dbe81e1de8999da9dab50228481c60f7147599f

      • /data/data/top.liaotian1001.main/files/apps/__UNI__G2801427/www/__uniapppicker.js
        Filesize

        17KB

        MD5

        782a965f63fbbfdb30266160cfbca41b

        SHA1

        e6f19f85c681ef57a0f0294b96195e4d07704227

        SHA256

        633f6f49c4995e385d3c9004bbb6994e43c8f90d46666c7c6604a1700068afbe

        SHA512

        27fcd7aad60f09d7b175727f107512ef8e6ae7578f801b83e125da4bf31979783295640811d969f82b301ffb4c2a64adae1b3d36f333e2c43da69f5b9046aceb

      • /data/data/top.liaotian1001.main/files/apps/__UNI__G2801427/www/__uniappquill.js
        Filesize

        211KB

        MD5

        a3275dca78a9b98242fe92d75f8e7ab2

        SHA1

        8705e9a8309811f89eeedd9a1f9097f9921b2203

        SHA256

        0c6976bd90cc4b04819c802680f622e205177f493282eb0cb6420ea912d7f60f

        SHA512

        84c6a100e7a0018ee3ffe7ecce1f9337392c7d413f59f2e5bfc2725335d1e747a97694f19c2361d7ad8aaa28ecfe7713629fc1afbe6dda359bb3a6a28ddf84b7

      • /data/data/top.liaotian1001.main/files/apps/__UNI__G2801427/www/__uniappquillimageresize.js
        Filesize

        23KB

        MD5

        30679d99af502d16d317204b7a098ea5

        SHA1

        850a5e2b21ae48f6cb6a5f85e6e80b35d463e784

        SHA256

        80f7c5beebe4bc5e00a580c432621c2d580faf04f06a139c21df1cf044955dbf

        SHA512

        533901e55a9d71e77cabb65c8b3855437103822930c5d54cc099c8bca29f00b737bb8b56e7c2d486102a098126f25239a6f28ced78936c5b938ab092464e789f

      • /data/data/top.liaotian1001.main/files/apps/__UNI__G2801427/www/__uniappscan.js
        Filesize

        8KB

        MD5

        48ac8cd47d554c7fdad79a6b305a126f

        SHA1

        b7c8af0f721d8e82a08465953e25fefb9d21f39d

        SHA256

        a9a7516eb4f93cd685ef804be6d62179d7595c2c8da67f519a77e40134002be2

        SHA512

        d05b3420f47552a285b0c3eb2691a4d71ca9220389f06f04fce5fed0eb7ce4306936826fb965a4cdc65fc69e0365fad85973ad4bb340a6d0470c09b6575da464

      • /data/data/top.liaotian1001.main/files/apps/__UNI__G2801427/www/__uniappsuccess.png
        Filesize

        1KB

        MD5

        e1812c5e999af10160557521a4ffd557

        SHA1

        98345a98932f3fa62275d7f6c4422dafddd65b8b

        SHA256

        fbb49724e75bed2bf0ecbf45f01dbd093ee80bcff204826de3861fe52a727092

        SHA512

        d0b4432fa9409e3f8894079100a8b8491029edb474d285dcfb14b063b7776424b28f0d846c828fc50b0811dd99c02e9af500f3130010b356e3759c566894e9e3

      • /data/data/top.liaotian1001.main/files/apps/__UNI__G2801427/www/__uniappview.html
        Filesize

        768B

        MD5

        e621306b6b8a45bf9e42172a3d843692

        SHA1

        f120872416bc3bdf6b054ff18b8ab91b2aac8dee

        SHA256

        78259474b538cbec5da1a89a1edc881502b2a73355eeca0af1d703fbdbccab4a

        SHA512

        afaa046a497a99b3fab70ec37c14309bc6653361a96d68d5a4a3ecf2a49007af0980b64939b9d95b471b58ffb0fd020b62e90cb5d1cb1137158604fdf487981a

      • /data/data/top.liaotian1001.main/files/apps/__UNI__G2801427/www/app-config-service.js
        Filesize

        2KB

        MD5

        8eca4bddfce5ac41acb19011f4f98a7e

        SHA1

        f776f85e8e70acf3c1f2ba840b9d2e4008ce367a

        SHA256

        64cc03a2ea018c5845a46c500d381899184602884a7e85c0c5b4b01fd652a214

        SHA512

        baedcb1e1ea45ce3490d33d381692ee17ef72b827f73830f60de45b2c3553c76dd6a8b4e4dd25045071b7aae4dfef39adb778dca705d151a7906a8441756beb3

      • /data/data/top.liaotian1001.main/files/apps/__UNI__G2801427/www/app-config.js
        Filesize

        17B

        MD5

        a33a21825ee0bbfbd37c7f17465ee58b

        SHA1

        0a1cea8a83e1df552650c210cc03ec629839dc1a

        SHA256

        0df9a681956d3517ba546fb467fb16450db50fbe22a87f318e12789161f3b78f

        SHA512

        d19357efc3069b23ce4abdd6bead232f375efe640fcd5d100bc61d202de9ada0068603326008a77886442f4b6df14f86f69f3973b92241f1db5703a0323ac0b5

      • /data/data/top.liaotian1001.main/files/apps/__UNI__G2801427/www/app-service.js
        Filesize

        1KB

        MD5

        6c5ce7159ccd59ddc0f27de506425acb

        SHA1

        c8d25a482d5aef7021477b60b0d88d67628286b1

        SHA256

        346d8d34a14ea01382e6260c848e62a2206223d54097da103d42b9a45ca99a37

        SHA512

        31fc0ee1810062c492e26c7f2a5d1987d683a3cb4ce98f742be10ef6a2003c36132cfe38c53787976b3e89f10b7364be211fe853b3a6046bb19a5ab4f11d96e9

      • /data/data/top.liaotian1001.main/files/apps/__UNI__G2801427/www/app.css
        Filesize

        32KB

        MD5

        4799b1a63743a0ff01b352add941f536

        SHA1

        eb05fa42dbe50d0355c460a5e634b30d04ff84ce

        SHA256

        74fb7e253067a0618ae342c87ab8e859431dd7808a92cc7064936d9eb31fc58b

        SHA512

        612ff3f26431bf01f7cdac27ac6cc06faf43e625c27ab64ce1bb08928e23a0444f97d05c20506a0114a8e06c0f80ca0ada7b04fa86f79d832b62ef944634347e

      • /data/data/top.liaotian1001.main/files/apps/__UNI__G2801427/www/manifest.json
        Filesize

        967B

        MD5

        9c77dc7f540d79e3181da458db7f1def

        SHA1

        ecaa6e39291b09ff0b04133187af330be2811417

        SHA256

        a1f293d708f517805e50cdb5b7ff88e5da4a4a059a0b595bc9a5087de13bd59a

        SHA512

        19145dcb361882829fd9a1c6c60094b304b5afa4aa54969d71d77167ca757e498cd7550b3064e3ecef3b996d7ac397b958d1e2a78f46dbaa3765b042cc18f782

      • /data/data/top.liaotian1001.main/files/apps/__UNI__G2801427/www/pages/index/index.css
        Filesize

        77B

        MD5

        07c6ad12af1d4e612822f1799d26668a

        SHA1

        a7e49f505c72b772e2b6e9b994e4dd708453f8e5

        SHA256

        4270328b74f634a172d3feb4a73ed1281c6f1fa775bf42ac013f928d1f2245f8

        SHA512

        d34035cc797613558732313373c58760fbb03e2967197969e1e87d0d5042acbe9149dfb7e362a175b12420b063504d01552424160c1aa82e4453b8a380746f82

      • /data/data/top.liaotian1001.main/files/apps/__UNI__G2801427/www/static/logo.png
        Filesize

        3KB

        MD5

        457f704c8de0a8fa0064134423b9ed9c

        SHA1

        99b712a4df1a152b6d7ec6cbd0d7ddcd8d9c9248

        SHA256

        46719607502ebe256abff3ee000121c761708258187fb2bd6dac8443845ef32e

        SHA512

        067034064cc18049b6084642bef534ddb2206e2ff72ae692581eb1d7f365d6d44a6f1aa922a38f5228c8d15971786017699d8e9a51dcf5967e546c28f51dbb5f

      • /data/data/top.liaotian1001.main/files/apps/__UNI__G2801427/www/uni-app-view.umd.js
        Filesize

        307KB

        MD5

        ed79270fe7ef5d3c79620f68ad094f5e

        SHA1

        56ae81a78c2e89d3798005d347dbb34826662e67

        SHA256

        982309c9f4553b105ddb2d59819eac18102289c46770c00b11819edb84d8676e

        SHA512

        8633b88c2e1e577679dccfc4f77e80cc35a030af21437e8c6357029c031da8b2a3563a6a8d7faae63d490489a4e84cabd17aa6ebf3aabea1f328a31db58bf554

      • /data/data/top.liaotian1001.main/files/cnc3ejE6/eje3cnc
        Filesize

        35B

        MD5

        762298b93820a5cd8b6d8ec469078f7f

        SHA1

        d5b02a2ff3b235cd2b61ceff53a1d88b8984477d

        SHA256

        dc3f98a33c26c2796dc294b354831fd5ca9796295f4cb38479c80b145d4807db

        SHA512

        70f864211ce16679d0538abf9b7071d27c2d22ae458e32409d20065032c762dd186307ef33ede90abd9ac794a4ced8b163404e9799c05f0c515337249684311e

      • /data/data/top.liaotian1001.main/files/jseicublob-1__UNI__G2801427
        Filesize

        64B

        MD5

        3271c216f51062802221f9665e36587e

        SHA1

        381e090f39c4e072a3a3b0969087f979cdd08107

        SHA256

        4f683961159d46c227ae166bf77499d6908d7a0bd51b5b58d33fc9e6a6bf32a6

        SHA512

        f15721c05a6e424b7e48bd053e85af4a5f5c0bf8583ea265184d1c3c1fb478692f62ef5594e212ec53ae6cbe8928cf5ceeb4ab22f375bfb4333316fa0f84a2cd

      • /data/data/top.liaotian1001.main/lib-main/dso_deps
        Filesize

        300B

        MD5

        c95718aa3a7a3327e4dc8291ae44752d

        SHA1

        584ca455a7f8c63184594374496fdeb118cc5a56

        SHA256

        5005399f4f11a38c3da32889426e69f370d2458f0b142e2b254dd0f991ac8df2

        SHA512

        6865ff90aee36707690bf79d2c18ec66a811968d89ac02f3fac04cd5608f1f4a30f3dbe4406b9c902af3d746e530de3323483542d7d7e08ac4fcdd5fdba8dd28

      • /data/data/top.liaotian1001.main/lib-main/dso_manifest
        Filesize

        5B

        MD5

        c06857e9ea338f3f3a24bb78f8fbdf6f

        SHA1

        c5a0a2529d2deb60fec041b4fbd722a2ebe31702

        SHA256

        957b88b12730e646e0f33d3618b77dfa579e8231e3c59c7104be7165611c8027

        SHA512

        29f61516876c25379a7bf4faa2b3ca6f6b53eac90e7de47671fec4a818d51441b4025cd7909f7c0a0d113ab6c5ff00cb3700c286bac7319185b77905feec4fb1

      • /data/data/top.liaotian1001.main/lib-main/dso_state
        Filesize

        1B

        MD5

        93b885adfe0da089cdf634904fd59f71

        SHA1

        5ba93c9db0cff93f52b521d7420e43f6eda2784f

        SHA256

        6e340b9cffb37a989ca544e6bb780a2c78901d3fb33738768511a30617afa01d

        SHA512

        b8244d028981d693af7b456af8efa4cad63d282e19ff14942c246e50d9351d22704a802a71c3580b6370de4ceb293c324a8423342557d4e5c38438f0e36910ee

      • /data/data/top.liaotian1001.main/lib-main/dso_state
        Filesize

        1B

        MD5

        55a54008ad1ba589aa210d2629c1df41

        SHA1

        bf8b4530d8d246dd74ac53a13471bba17941dff7

        SHA256

        4bf5122f344554c53bde2ebb8cd2b7e3d1600ad631c385a5d7cce23c7785459a

        SHA512

        7b54b66836c1fbdd13d2441d9e1434dc62ca677fb68f5fe66a464baadecdbd00576f8d6b5ac3bcc80844b7d50b1cc6603444bbe7cfcf8fc0aa1ee3c636d9e339

      • /storage/emulated/0/Android/data/top.liaotian1001.main/cache/AdEnable.dat
        Filesize

        1B

        MD5

        cfcd208495d565ef66e7dff9f98764da

        SHA1

        b6589fc6ab0dc82cf12099d1c2d40ab994e8410c

        SHA256

        5feceb66ffc86f38d952786c6d696c79c2dbc239dd4e91b46729d73a27fb57e9

        SHA512

        31bca02094eb78126a517b206a88c73cfa9ec6f704c7030d18212cace820f025f00bf0ea68dbf3f3a5436ca63b53bf7bf80ad8d5de7d8359d0b7fed9dbc3ab99