9efa7d7db7ee4688f188708ae2d857667ffab59f1c866a55ac1cb312827799a0

Analysis

max time kernel
160s
max time network
131s
platform
android_x86
resource
android-x86-arm-20240514-en
resource tags

androidarch:armarch:x86image:android-x86-arm-20240514-enlocale:en-usos:android-9-x86system
submitted
23-05-2024 12:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

yishengdaojia_208.apk
Size

14.1MB
MD5

b6a23b529e9444e0430934b30ab1d518
SHA1

e5de0b81cb066ea21cb3fc343969048b3c4e7e93
SHA256

9efa7d7db7ee4688f188708ae2d857667ffab59f1c866a55ac1cb312827799a0
SHA512

1708897a1ef19a8019c49ac317ca98044d06b5b54576d5b47f5706a2e1877e9277c1bb1f0e71c74f906f857dcbb5edc2f2798ad092a0ef585630be2b04dff527
SSDEEP

393216:CjASvj91cQ/LTjwEVs7Hp82tFDyopHNfg:qjzr/LTj3gHz7Dy+to

Score

7^/10

discovery impact

Malware Config

Signatures

Queries information about running processes on the device 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about running processes on the device.
discovery

Process Discovery
T1424

Processes:

com.yisheng.yonghu

description ioc process

Framework service call android.app.IActivityManager.getRunningAppProcesses com.yisheng.yonghu
Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.
discovery

System Network Connections Discovery
T1421

Processes:

com.yisheng.yonghu

description ioc process

Framework service call android.net.wifi.IWifiManager.getConnectionInfo com.yisheng.yonghu
Checks if the internet connection is available 1 TTPs 1 IoCs
discovery

System Network Connections Discovery
T1421

Processes:

com.yisheng.yonghu

description ioc process

Framework service call android.net.IConnectivityManager.getActiveNetworkInfo com.yisheng.yonghu
Reads information about phone network operator. 1 TTPs
discovery

System Network Configuration Discovery
T1422
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
impact

Data Encrypted for Impact
T1471

Processes:

com.yisheng.yonghu

description ioc process

Framework API call javax.crypto.Cipher.doFinal com.yisheng.yonghu

description	ioc	process
Framework service call	android.app.IActivityManager.getRunningAppProcesses	com.yisheng.yonghu

description	ioc	process
Framework service call	android.net.wifi.IWifiManager.getConnectionInfo	com.yisheng.yonghu

description	ioc	process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.yisheng.yonghu

description	ioc	process
Framework API call	javax.crypto.Cipher.doFinal	com.yisheng.yonghu

com.yisheng.yonghu
1⤵
- Queries information about running processes on the device
- Queries information about the current Wi-Fi connection
- Checks if the internet connection is available
- Uses Crypto APIs (Might try to encrypt user data)
PID:4322

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Process Discovery

T1424

System Network Configuration Discovery

T1422

System Network Connections Discovery

T1421

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

T1471

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.yisheng.yonghu/databases/umeng_community.db
Filesize
4KB

MD5
f2b4b0190b9f384ca885f0c8c9b14700

SHA1
934ff2646757b5b6e7f20f6a0aa76c7f995d9361

SHA256
0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514

SHA512
ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1

Download Submit
/data/data/com.yisheng.yonghu/databases/umeng_community.db-journal
Filesize
512B

MD5
9bd14a9a25ed72ae58538f107f5e0def

SHA1
77f209e9271e1e180268728db022c8a66a34d215

SHA256
c0e53539be7221584a5097c7280f523c8577cd1d55f9863614ab0f1cd447c373

SHA512
e93818cf71b89ad8b29121f52e6f97e94e66e72e6d52d34c841cde547445497377ec2d6c2051a58d38dd368413102edf6fc704704126119b40be1a9f3649e4b9

Download Submit
/data/data/com.yisheng.yonghu/databases/umeng_community.db-shm
Filesize
32KB

MD5
bb7df04e1b0a2570657527a7e108ae23

SHA1
5188431849b4613152fd7bdba6a3ff0a4fd6424b

SHA256
c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479

SHA512
768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

Download Submit
/data/data/com.yisheng.yonghu/databases/umeng_community.db-wal
Filesize
181KB

MD5
adc4faae79507d0fbde5ea27e1fbf1f3

SHA1
148330a065184850a2cf372f20aad89713b92503

SHA256
29cb9d940013725807a2e3cc6af7f1b61e95e603b688ed9cdb1237721a5ddceb

SHA512
b6d64a6f57bfc94bae48254105f3aea8bbc3e8f6a0d69ad226935a1c4c4312d5ec417e33ef7dd429e631d68974ca56f743cbfb64b6c4b400aa7ed4474e2607d1

Download Submit
/storage/emulated/0/.DataStorage/ContextData.xml
Filesize
111B

MD5
792d96231de2489a9cd9bc1bfeabf0ce

SHA1
b0e2f7810acefec1bc823b7c7a53fc6234e4c45e

SHA256
7c5fb0cc2937015e93477bbc9556066eb2e2c90518294c8519df882b15636989

SHA512
fa907e06048585621d7a7d65dbc47ca951223966b55cefc80692ea2baca842b1f2d8c61fd28603de55f3403fd7037fe8fd3bae44856d5204f41b0dcae268144c

Download Submit
/storage/emulated/0/.UTSystemConfig/Global/Alvin2.xml
Filesize
381B

MD5
dcde824e1080b7a2d06f44a357a94f25

SHA1
b6c75694dbe36eceea0fe4c6f79e1d33edf6c318

SHA256
3b900a9f09ef69a226786330a96f0bc830b4e20fef10e09575c2052ee1ec621e

SHA512
b90b043197fcc8712f4cb56b772f5f46afb51179ba2095c37670e473d6ec6432a85d5e3e069758656190c7dc4e92673057e6b38c7c5aa18a54b048f057708a8b

Download Submit
/storage/emulated/0/.UTSystemConfig/Global/Alvin2.xml
Filesize
65B

MD5
9781ca003f10f8d0c9c1945b63fdca7f

SHA1
4156cf5dc8d71dbab734d25e5e1598b37a5456f4

SHA256
3325d2a819fdd8062c2cdc48a09b995c9b012915bcdf88b1cf9742a7f057c793

SHA512
25a9877e274e0e9df29811825bd4f680fa0bf0ae6219527e4f1dcd17d0995d28b2926192d961a06ee5bef2eed73b3f38ec4ffdd0a1cda7ff2a10dc5711ffdf03

Download Submit
/storage/emulated/0/.UTSystemConfig/Global/Alvin2.xml
Filesize
111B

MD5
c80253c89ca64e0db5e723a915c6ec01

SHA1
d2e817c1442525ab239e0ee04148e12410296d3c

SHA256
503528389ecb430f6acc581a97fdb6666bcc6c427fbd29b1f0de1da8ad79c967

SHA512
466731074d473b9ddfea50749c6fffb09356ac90666b48fb8d85a0112ea8621e6c53b4fb268b1da08d4a3b3fa099b734c777ebb54347044ce75556045260bac1

Download Submit
/storage/emulated/0/Android/data/com.yisheng.yonghu/cache/bitmap/journal.tmp
Filesize
33B

MD5
835b0bf5ee019b69abc2a4b04491ba71

SHA1
4287fd8afe805fbc52860ca36cc8b90e05ddfcfe

SHA256
164f8bdec0ec2f8e748f860d14b0d03885052fd801bbd6e6b532b008243e0a78

SHA512
7c72849c5aa1d01194fe21024752bfac326512348819dcf540696782ede7d8765b917496e09b383e2aed1128a5a6bd0d99932cc4a8bd491a659b5f89f7bfac55

Download Submit
/storage/emulated/0/Android/data/com.yisheng.yonghu/cache/xBitmapCache/journal.tmp
Filesize
31B

MD5
8c92de9ce46d41a22f3b20f77404cc1d

SHA1
8671a6dca00edb72be47363a7071be65cf270373

SHA256
68bb33ddeed9200be85a71f70b377985f9ee68e91578afbde8321463396f1274

SHA512
30f45fe9954215d6adafcc8f0a060a7ff41963a64f9b849a37f0d18fe045038d429ec13bf15226769c4ba78dad3c52f3d9e0dbbb4fcdea4828a1efe956e48f56

Download Submit
/storage/emulated/0/baidu/.cuid
Filesize
89B

MD5
1b4a6f12c24841d7c6b7c356fedfaf1f

SHA1
bd3a65a2aa304e3cbece7e87a34592611e6c13b6

SHA256
35425db34fba40309789d5d4f2eb68f7b9561adbb68cb6773d2da38bb11a0de4

SHA512
3dd0d56fefafa9157fe230f10cae9c3f4c7c4ffa5866ab4f63599a2abb651279084d170498ea53b54f7398d49ac9d6e5f584f3803ef6fad33f555e5a621a3aa3

Download Submit