f19d1f97998e855b533cc70f7eccae4b74a540e52d121e77d78851e8398a427b

Analysis

max time kernel
8s
max time network
131s
platform
android_x64
resource
android-x64-20240514-en
resource tags

androidarch:x64arch:x86image:android-x64-20240514-enlocale:en-usos:android-10-x64system
submitted
23-05-2024 11:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

yssaas-release_102.apk
Size

10.0MB
MD5

820a951972ad336749cb5f77589e0a3d
SHA1

1a69f791b55fd08d0f80e8c7e09a4b313c3b24c9
SHA256

f19d1f97998e855b533cc70f7eccae4b74a540e52d121e77d78851e8398a427b
SHA512

5c054f8a39b141df472a8e5916af2e62fd0234399550ef60d6c1260cb69c60f2a4c0488bf2d12f3a67c75976b49ad89159fcd179430e865d3b90b1bbde3723ea
SSDEEP

196608:EXVW07xHHtTQZ5DqLRlvPABMNI6m/wXCOVFdLtdgpElScRkhsfWR40VJQ9WvWS79:EXVWmJQZ52LPNNe4XCOLdeElScRkhsMt

Score

8^/10

collection discovery evasion impact

Malware Config

Signatures

Requests cell location 2 TTPs 1 IoCs
Uses Android APIs to to get current cell location.
collection discovery evasion

Location Tracking
T1430

Geofencing
T1627.001

Processes:

com.yisheng.saas

description ioc process

Framework service call com.android.internal.telephony.ITelephony.getCellLocation com.yisheng.saas
Queries information about running processes on the device 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about running processes on the device.
discovery

Process Discovery
T1424

Processes:

com.yisheng.saas

description ioc process

Framework service call android.app.IActivityManager.getRunningAppProcesses com.yisheng.saas
Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.
discovery

System Network Connections Discovery
T1421

Processes:

com.yisheng.saas

description ioc process

Framework service call android.net.wifi.IWifiManager.getConnectionInfo com.yisheng.saas
Queries information about the current nearby Wi-Fi networks 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about the current nearby Wi-Fi networks.
discovery

System Network Connections Discovery
T1421

Processes:

com.yisheng.saas

description ioc process

Framework service call android.net.wifi.IWifiManager.getScanResults com.yisheng.saas
Checks if the internet connection is available 1 TTPs 1 IoCs
discovery

System Network Connections Discovery
T1421

Processes:

com.yisheng.saas

description ioc process

Framework service call android.net.IConnectivityManager.getActiveNetworkInfo com.yisheng.saas
Queries the unique device ID (IMEI, MEID, IMSI) 1 TTPs
discovery

System Network Configuration Discovery
T1422
Reads information about phone network operator. 1 TTPs
discovery

System Network Configuration Discovery
T1422
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
impact

Data Encrypted for Impact
T1471

Processes:

com.yisheng.saas

description ioc process

Framework API call javax.crypto.Cipher.doFinal com.yisheng.saas

description	ioc	process
Framework service call	com.android.internal.telephony.ITelephony.getCellLocation	com.yisheng.saas

description	ioc	process
Framework service call	android.app.IActivityManager.getRunningAppProcesses	com.yisheng.saas

description	ioc	process
Framework service call	android.net.wifi.IWifiManager.getConnectionInfo	com.yisheng.saas

description	ioc	process
Framework service call	android.net.wifi.IWifiManager.getScanResults	com.yisheng.saas

description	ioc	process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.yisheng.saas

description	ioc	process
Framework API call	javax.crypto.Cipher.doFinal	com.yisheng.saas

com.yisheng.saas
1⤵
- Requests cell location
- Queries information about running processes on the device
- Queries information about the current Wi-Fi connection
- Queries information about the current nearby Wi-Fi networks
- Checks if the internet connection is available
- Uses Crypto APIs (Might try to encrypt user data)
PID:5170

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Execution Guardrails

T1627

Geofencing

T1627.001

Credential Access

Discovery

Location Tracking

T1430

Process Discovery

T1424

System Network Configuration Discovery

T1422

System Network Connections Discovery

T1421

Lateral Movement

Collection

Location Tracking

T1430

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

T1471

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.yisheng.saas/files/libcuid.so
Filesize
109B

MD5
ba7c279accfed2daf843e89242acbb54

SHA1
f59429c6a51b238572817ccb42b501c9bc068afc

SHA256
ec6d48646b899289ead0372b12a63fed0b603059fd4b2ad20865871a98eb14d3

SHA512
48dc92131420475b3f5312ff5a160e7cb40fcf116d30f6c1000700e3a9bccd5277b17778e7d7d218501472b5719af18a23c2c0e29fe08e1bae1f080aa822884b

Download Submit