dcc1c4078e111132c4c50f4ac260ac13d48dcbd48997426b0242626cc85a0957

Analysis

max time kernel
157s
max time network
158s
platform
android_x64
resource
android-x64-20240514-en
resource tags

androidarch:x64arch:x86image:android-x64-20240514-enlocale:en-usos:android-10-x64system
submitted
22-05-2024 12:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2a57ce9a-c7a4-4fb2-a5f3-c3df65c0c53c.apk
Size

2.5MB
MD5

9b2270e41068dbfa50ec39153716b5ce
SHA1

35be18b6e606fe79d1175f8766101938f14cdf39
SHA256

dcc1c4078e111132c4c50f4ac260ac13d48dcbd48997426b0242626cc85a0957
SHA512

6a4d0a5b7b88a4087ace924f41a7df18cc1d6158a709344896bfffe0ba44b4c6520ebe2cd19c5d6b8ccde4c2b7cb9a706b9fc1eca679eb9767cd0fa648fc4f5a
SSDEEP

49152:n8nRCBgwmi29FauHdJjHaqEUPQ44G2vTmdsy7hmyyq3LkHU0dgu9A/g9mgvR:yRhwmiYF1JjxEUUlvIjlgHUymgvR

Score

7^/10

collection credential_access discovery evasion impact persistence

Malware Config

Signatures

Checks CPU information 2 TTPs 1 IoCs
Checks CPU information which indicate if the system is an emulator.
evasion discovery

System Checks
T1633.001

System Information Discovery
T1426

Processes:

com.example.CangKuGuanLiXiTong12345

description ioc process

File opened for read /proc/cpuinfo com.example.CangKuGuanLiXiTong12345
Checks memory information 2 TTPs 1 IoCs
Checks memory information which indicate if the system is an emulator.
evasion discovery

System Checks
T1633.001

System Information Discovery
T1426

Processes:

com.example.CangKuGuanLiXiTong12345

description ioc process

File opened for read /proc/meminfo com.example.CangKuGuanLiXiTong12345
Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs
Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
collection credential_access impact

Clipboard Data
T1414

Transmitted Data Manipulation
T1641.001

Processes:

com.example.CangKuGuanLiXiTong12345

description ioc process

Framework service call android.content.IClipboard.addPrimaryClipChangedListener com.example.CangKuGuanLiXiTong12345
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
discovery

System Network Configuration Discovery
T1422

Processes:

com.example.CangKuGuanLiXiTong12345

description ioc process

Framework service call com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone com.example.CangKuGuanLiXiTong12345
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
persistence

Broadcast Receivers
T1624.001

Processes:

com.example.CangKuGuanLiXiTong12345

description ioc process

Framework service call android.app.IActivityManager.registerReceiver com.example.CangKuGuanLiXiTong12345

description	ioc	process
File opened for read	/proc/cpuinfo	com.example.CangKuGuanLiXiTong12345

description	ioc	process
File opened for read	/proc/meminfo	com.example.CangKuGuanLiXiTong12345

description	ioc	process
Framework service call	android.content.IClipboard.addPrimaryClipChangedListener	com.example.CangKuGuanLiXiTong12345

description	ioc	process
Framework service call	com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone	com.example.CangKuGuanLiXiTong12345

description	ioc	process
Framework service call	android.app.IActivityManager.registerReceiver	com.example.CangKuGuanLiXiTong12345

com.example.CangKuGuanLiXiTong12345
1⤵
- Checks CPU information
- Checks memory information
- Obtains sensitive information copied to the device clipboard
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
PID:5098

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Clipboard Data

T1414

Discovery

System Information Discovery

T1426

System Network Configuration Discovery

T1422

Lateral Movement

Collection

Clipboard Data

T1414

Command and Control

Exfiltration

Impact

Data Manipulation

T1641

Transmitted Data Manipulation

T1641.001

Replay Monitor

Loading Replay Monitor...

Downloads

/storage/emulated/0/CangKuGuanLiXiTong12345/cangkuguanlixitong12345.db
Filesize
11KB

MD5
6d6af3982ec9310e63d46c91aec44497

SHA1
c8800318df8841147f9752ea4ab5b89a3a50ac28

SHA256
6dcad7787178660dd88451b9346090ab006c187a83e140da0eed0a07d8b15bda

SHA512
7671ad4d47786e9f401897fa1295cf517e4b3b1a25aabd65f6a9c17361501ea07508f2f8f9e5d71177a412f209ded4575ebc08e9a6b7876061bfa3b23c30dd54

Download Submit
/storage/emulated/0/CangKuGuanLiXiTong12345/cangkuguanlixitong12345.db
Filesize
18KB

MD5
d368d80c9981dd86ba35a1617a1734fa

SHA1
a64df47f1272bcace2437126dfe919cab1f6297a

SHA256
a14c3fe643f09374d74293ceaff0897ed70ab1554368b735db06b76f745ae9f2

SHA512
dc3765fb8ff7c15d6f99c7e6aa48a40cc745ceccf780c8a3e408d168cba0caf05d15f066319a2af7412c8df39c12dcecd13e2862a61c8464fe7a6d04c08d7b58

Download Submit
/storage/emulated/0/CangKuGuanLiXiTong12345/cangkuguanlixitong12345.db-journal
Filesize
2KB

MD5
b47cab46ea4ff346baf8bf3c85f745ca

SHA1
7ee58dea1dec8e2811da13439d25f44fefc5b245

SHA256
298195d5ea56c9ae421f5a72898d0a8f9fe9d0de51f11e53f7efe8b8a658b4b9

SHA512
8d5339443ff46385b9874f916d607901c799a07146f6fee6daf4c5c635e4f7e14d85037cc41cc3828063895aefc10ed1ac23d1e9f99b99ce1f5c9024d1de94ad

Download Submit
/storage/emulated/0/CangKuGuanLiXiTong12345/cangkuguanlixitong12345.db-journal
Filesize
2KB

MD5
c6ba814aa4ce15da2e429b04314189fc

SHA1
65e6a21672052fa31ef6ebf6198f36d390a5171c

SHA256
b9b89d33d586b235796082968caa494041ad414b996e47a9ce22d2e4c109de29

SHA512
f22715846a0e195b571ad395fd18ddf06d0fba68c833879dabe9d629b43a8a3e6c7b62fab974fdea56b4d19e8db210b25507fc19d49b5c313983c49f99b8f541

Download Submit
/storage/emulated/0/CangKuGuanLiXiTong12345/cangkuguanlixitong12345.db-journal
Filesize
2KB

MD5
91cfc3a0d8e7c106f41f9ca433d9caaf

SHA1
2823761721059d80e3689e50d0a276809cdf8e06

SHA256
c45cf4b996b27e9b46e79e9c8d4a7a0dd4035a2fc156e415d429efaff24262af

SHA512
062cc89d531cfa5d162287e1ef68d739004ce3d531226cf61b53398e2442f225506731cab98a62460df33a2558361cfb41db9e41146343e9f987b2f1f1342273

Download Submit
/storage/emulated/0/CangKuGuanLiXiTong12345/cangkuguanlixitong12345.db-journal
Filesize
2KB

MD5
651b7cb08f222e1a726a4711d5ac9435

SHA1
0b3fc83437f5dd6e5db16ca72e3afec857c2e061

SHA256
c34a12001952345fba434d8aabcf340cef400fd6ecaa4922986f1cce34e919eb

SHA512
15b1186cc8a9d5b4108c1bfac718812d74d595a9e1741ea64c6a921d36e34982ed5aa413cf2cfeb7660747d25865f66005900e1b9ef607b5da30b6a8a819cf24

Download Submit
/storage/emulated/0/CangKuGuanLiXiTong12345/cangkuguanlixitong12345.db-journal
Filesize
2KB

MD5
b46619319074d72195830b68b59c294a

SHA1
fd098b289110a48a8510ce9b08d32259535fa916

SHA256
46d9d7340f6d3257dc97e72f8ec6bd3c4d0a8703be540bd9b4b27e51bc1c9f6e

SHA512
2e0eeed03cceba9ac00d85b29a8a589db475566c56efcbaaa9d8a91fac55816f298275c6f163a686e952c300e321f731a3c468589130d096302785e6c80acb13

Download Submit
/storage/emulated/0/CangKuGuanLiXiTong12345/cangkuguanlixitong12345.db-journal
Filesize
4KB

MD5
eb730ae55694c9f54078b00825f265a0

SHA1
34cb8c50c0afe1cb41a0863db6e29fd3f3d93d5c

SHA256
7d8652208e79dd8132fef6c2fcde7930b6558701d00f5a5e2de374ae22d515c5

SHA512
98a1e158991246190a91d229b996539d5268f42a444c08b4daa9b12794aa910c6a893d4f92f8335205a47f04ba1e1977259731dded9d72e6ee0e8b835c35ae50

Download Submit
/storage/emulated/0/db/gg.wav
Filesize
113KB

MD5
8028ea6ad5309e86f08a2ba6fc502735

SHA1
e69019188af6f0fc93e0b36d31489d077804861b

SHA256
e6a5d1891b91f439b85271b825808dc4c27c1a9947b943e291f60df7867087b9

SHA512
b8c65d357abc52cd91b331a2d28f02b842cf7ed50e266d987d19fecda2b89da0bdf78e61a14f60dad319eb75adcb49c48a6402053d66bb2311171b185fd37db6

Download Submit