dcc1c4078e111132c4c50f4ac260ac13d48dcbd48997426b0242626cc85a0957

Analysis

max time kernel
154s
max time network
131s
platform
android_x86
resource
android-x86-arm-20240514-en
resource tags

androidarch:armarch:x86image:android-x86-arm-20240514-enlocale:en-usos:android-9-x86system
submitted
22-05-2024 12:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2a57ce9a-c7a4-4fb2-a5f3-c3df65c0c53c.apk
Size

2.5MB
MD5

9b2270e41068dbfa50ec39153716b5ce
SHA1

35be18b6e606fe79d1175f8766101938f14cdf39
SHA256

dcc1c4078e111132c4c50f4ac260ac13d48dcbd48997426b0242626cc85a0957
SHA512

6a4d0a5b7b88a4087ace924f41a7df18cc1d6158a709344896bfffe0ba44b4c6520ebe2cd19c5d6b8ccde4c2b7cb9a706b9fc1eca679eb9767cd0fa648fc4f5a
SSDEEP

49152:n8nRCBgwmi29FauHdJjHaqEUPQ44G2vTmdsy7hmyyq3LkHU0dgu9A/g9mgvR:yRhwmiYF1JjxEUUlvIjlgHUymgvR

Score

7^/10

discovery evasion persistence

Malware Config

Signatures

Checks CPU information 2 TTPs 1 IoCs
Checks CPU information which indicate if the system is an emulator.
evasion discovery

System Checks
T1633.001

System Information Discovery
T1426

Processes:

com.example.CangKuGuanLiXiTong12345

description ioc process

File opened for read /proc/cpuinfo com.example.CangKuGuanLiXiTong12345
Checks memory information 2 TTPs 1 IoCs
Checks memory information which indicate if the system is an emulator.
evasion discovery

System Checks
T1633.001

System Information Discovery
T1426

Processes:

com.example.CangKuGuanLiXiTong12345

description ioc process

File opened for read /proc/meminfo com.example.CangKuGuanLiXiTong12345
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
discovery

System Network Configuration Discovery
T1422

Processes:

com.example.CangKuGuanLiXiTong12345

description ioc process

Framework service call com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone com.example.CangKuGuanLiXiTong12345
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
persistence

Broadcast Receivers
T1624.001

Processes:

com.example.CangKuGuanLiXiTong12345

description ioc process

Framework service call android.app.IActivityManager.registerReceiver com.example.CangKuGuanLiXiTong12345

description	ioc	process
File opened for read	/proc/cpuinfo	com.example.CangKuGuanLiXiTong12345

description	ioc	process
File opened for read	/proc/meminfo	com.example.CangKuGuanLiXiTong12345

description	ioc	process
Framework service call	com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone	com.example.CangKuGuanLiXiTong12345

description	ioc	process
Framework service call	android.app.IActivityManager.registerReceiver	com.example.CangKuGuanLiXiTong12345

com.example.CangKuGuanLiXiTong12345
1⤵
- Checks CPU information
- Checks memory information
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
PID:4305

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Discovery

System Information Discovery

T1426

System Network Configuration Discovery

T1422

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/storage/emulated/0/CangKuGuanLiXiTong12345/cangkuguanlixitong12345.db
Filesize
11KB

MD5
6d6af3982ec9310e63d46c91aec44497

SHA1
c8800318df8841147f9752ea4ab5b89a3a50ac28

SHA256
6dcad7787178660dd88451b9346090ab006c187a83e140da0eed0a07d8b15bda

SHA512
7671ad4d47786e9f401897fa1295cf517e4b3b1a25aabd65f6a9c17361501ea07508f2f8f9e5d71177a412f209ded4575ebc08e9a6b7876061bfa3b23c30dd54

Download Submit
/storage/emulated/0/CangKuGuanLiXiTong12345/cangkuguanlixitong12345.db
Filesize
18KB

MD5
63e2a141ccc8d2f3aff6591d7487e32a

SHA1
00add46d34d0a271fb6cd085220a051e591be72f

SHA256
f81376ea766f62f555957cd02695b5b4e02fbd19497384a77f104e43279bc026

SHA512
cfb19731c47a9924d3321bf13e00c221ed78b32ce897fc17257587375fab8908a1bed3ccab17efaafa431069ef9fc93b8193d6289b678d6b5d43b8129505c9d2

Download Submit
/storage/emulated/0/CangKuGuanLiXiTong12345/cangkuguanlixitong12345.db-journal
Filesize
1KB

MD5
8613336d2a63d9aeb4111fbe76e77360

SHA1
4766d270b2779269b945fb585282d5e2aa04b214

SHA256
4b0b597faf63533c3f1dc1d10775b120b31f1671c6159af49eb3d5d31d70470c

SHA512
d1db3fa9f3f8b55dfd8771d767177d908a7e47f1f27da360f0930a32a532c88d58f12cbde4135fec81fd8d728eeb45b3daa89dc9f9b60ec2a4c034afcf6fe43d

Download Submit
/storage/emulated/0/CangKuGuanLiXiTong12345/cangkuguanlixitong12345.db-shm
Filesize
32KB

MD5
bb7df04e1b0a2570657527a7e108ae23

SHA1
5188431849b4613152fd7bdba6a3ff0a4fd6424b

SHA256
c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479

SHA512
768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

Download Submit
/storage/emulated/0/CangKuGuanLiXiTong12345/cangkuguanlixitong12345.db-wal
Filesize
74KB

MD5
b34ae22c4b97506247e4a7e5c8354c58

SHA1
37b6e207403e129a40a1a528fbea3210e301874c

SHA256
b23952e5a641561b328b6c091856790a641be785c07234960961e5de3443a33b

SHA512
5e546393b9f0ae5f014f19879be75eebedcff780638704e5c51d12fab93c83e40f8dcd66093cad2042b9cc13048a244a58a2adc57d9befaa400830b0a94b1816

Download Submit
/storage/emulated/0/db/gg.wav
Filesize
113KB

MD5
8028ea6ad5309e86f08a2ba6fc502735

SHA1
e69019188af6f0fc93e0b36d31489d077804861b

SHA256
e6a5d1891b91f439b85271b825808dc4c27c1a9947b943e291f60df7867087b9

SHA512
b8c65d357abc52cd91b331a2d28f02b842cf7ed50e266d987d19fecda2b89da0bdf78e61a14f60dad319eb75adcb49c48a6402053d66bb2311171b185fd37db6

Download Submit