Overview

overview

8

Static

static

6

yssaas-rel...04.apk

android-9-x86

8

yssaas-rel...04.apk

android-13-x64

8

Analysis

  • max time kernel
    8s
  • max time network
    132s
  • platform
    android_x86
  • resource
    android-x86-arm-20240514-en
  • resource tags

    androidarch:armarch:x86image:android-x86-arm-20240514-enlocale:en-usos:android-9-x86system
  • submitted
    23-05-2024 12:18

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    yssaas-release_104.apk

  • Size

    10.0MB

  • MD5

    0345baf80b07c40cfc31b9071dea18fc

  • SHA1

    91bf2dbeb8398a77e8b2ade63f5d8cd7ab84270b

  • SHA256

    86f93ef3367f00d04baf81b225793af79c2e68cc3ced0235330f37d6bc836395

  • SHA512

    33b795a12a1ddd585f0dc59185519f0c473ae30ed7de919cea48aec98ca85803990d20524c1cff33c6fa0a11a883452d6a9efa911526a4146d81f28c80399b6f

  • SSDEEP

    196608:tAjwNCz+VZUI+dvEABMNI6m/wXCaRFdLJdk1Elm4RkhYveR4kVJQ9WTyS7Vyt+nf:tAjwJUIlNN+4XCa/d2Elm4RkhYE4kVJj

Score
8/10
collectiondiscoveryevasionimpact

Malware Config

Signatures

  • Requests cell location 2 TTPs 1 IoCs

    Uses Android APIs to to get current cell location.

    collectiondiscoveryevasion
  • Queries information about running processes on the device 1 TTPs 1 IoCs

    Application may abuse the framework's APIs to collect information about running processes on the device.

    discovery
  • Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs

    Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.

    discovery
  • Queries information about the current nearby Wi-Fi networks 1 TTPs 1 IoCs

    Application may abuse the framework's APIs to collect information about the current nearby Wi-Fi networks.

    discovery
  • Checks if the internet connection is available 1 TTPs 1 IoCs
    discovery
  • Reads information about phone network operator. 1 TTPs
    discovery
  • Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
    impact

Processes

  • com.yisheng.saas
    1⤵
    • Requests cell location
    • Queries information about running processes on the device
    • Queries information about the current Wi-Fi connection
    • Queries information about the current nearby Wi-Fi networks
    • Checks if the internet connection is available
    • Uses Crypto APIs (Might try to encrypt user data)
    PID:4316

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/data/com.yisheng.saas/files/libcuid.so
    Filesize

    129B

    MD5

    c6de2bb5cce2e6a82fa25e26843ef4bc

    SHA1

    50f7788d829a58c81ed5ea6d8957dac872ab151f

    SHA256

    14e207ce459d9c438a7d37137f69ac4a5af1c461b70126659316c25fc26d6bb1

    SHA512

    6024da8350b242f5f5e58b3b4c2da85d56ce4831b64116bd8296c5f4a051eccc4123c4cf64a1b8236db1cbf3361d04d4a775472b800486e3fc84ace338e297a6

    Download Submit