Overview

overview

8

Static

static

6

yssaas-rel...02.apk

android-9-x86

8

yssaas-rel...02.apk

android-10-x64

8

Analysis

  • max time kernel
    7s
  • max time network
    130s
  • platform
    android_x86
  • resource
    android-x86-arm-20240514-en
  • resource tags

    androidarch:armarch:x86image:android-x86-arm-20240514-enlocale:en-usos:android-9-x86system
  • submitted
    23-05-2024 11:44

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    yssaas-release_102.apk

  • Size

    10.0MB

  • MD5

    820a951972ad336749cb5f77589e0a3d

  • SHA1

    1a69f791b55fd08d0f80e8c7e09a4b313c3b24c9

  • SHA256

    f19d1f97998e855b533cc70f7eccae4b74a540e52d121e77d78851e8398a427b

  • SHA512

    5c054f8a39b141df472a8e5916af2e62fd0234399550ef60d6c1260cb69c60f2a4c0488bf2d12f3a67c75976b49ad89159fcd179430e865d3b90b1bbde3723ea

  • SSDEEP

    196608:EXVW07xHHtTQZ5DqLRlvPABMNI6m/wXCOVFdLtdgpElScRkhsfWR40VJQ9WvWS79:EXVWmJQZ52LPNNe4XCOLdeElScRkhsMt

Score
8/10
collectiondiscoveryevasionimpact

Malware Config

Signatures

  • Requests cell location 2 TTPs 1 IoCs

    Uses Android APIs to to get current cell location.

    collectiondiscoveryevasion
  • Queries information about running processes on the device 1 TTPs 1 IoCs

    Application may abuse the framework's APIs to collect information about running processes on the device.

    discovery
  • Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs

    Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.

    discovery
  • Queries information about the current nearby Wi-Fi networks 1 TTPs 1 IoCs

    Application may abuse the framework's APIs to collect information about the current nearby Wi-Fi networks.

    discovery
  • Checks if the internet connection is available 1 TTPs 1 IoCs
    discovery
  • Reads information about phone network operator. 1 TTPs
    discovery
  • Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
    impact

Processes

  • com.yisheng.saas
    1⤵
    • Requests cell location
    • Queries information about running processes on the device
    • Queries information about the current Wi-Fi connection
    • Queries information about the current nearby Wi-Fi networks
    • Checks if the internet connection is available
    • Uses Crypto APIs (Might try to encrypt user data)
    PID:4213

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/data/com.yisheng.saas/files/libcuid.so
    Filesize

    129B

    MD5

    c6de2bb5cce2e6a82fa25e26843ef4bc

    SHA1

    50f7788d829a58c81ed5ea6d8957dac872ab151f

    SHA256

    14e207ce459d9c438a7d37137f69ac4a5af1c461b70126659316c25fc26d6bb1

    SHA512

    6024da8350b242f5f5e58b3b4c2da85d56ce4831b64116bd8296c5f4a051eccc4123c4cf64a1b8236db1cbf3361d04d4a775472b800486e3fc84ace338e297a6

    Download Submit