General

  • Target

    civio_shippark1.3.1内测.apk

  • Size

    5.7MB

  • Sample

    240523-prtgtahh4x

  • MD5

    2223a5d90ab31d0fb70697681f7c249a

  • SHA1

    193604f1c495c172e52e993d28b5081e3927b9c0

  • SHA256

    fd04c0f2ee81e834e6da4be44b6592e55b6b06de43c7f8dd391c6a2ef8339141

  • SHA512

    57f241deefada894df6528e4b84423d89d5f6e32a028d710178fefc3cfc1e0b40d140b88094788f410b4f88be6cef76c34537197501e1a66fc6ca37c11a520ab

  • SSDEEP

    98304:uL3SSxOr4BuzoXTUTCu7shaITmx99Jg8MEYA1pQhHKsxlVXG0SJV8BEAM:uLBOr4gUTNUsEJFavVW0QAM

Malware Config

Targets

    • Target

      civio_shippark1.3.1内测.apk

    • Size

      5.7MB

    • MD5

      2223a5d90ab31d0fb70697681f7c249a

    • SHA1

      193604f1c495c172e52e993d28b5081e3927b9c0

    • SHA256

      fd04c0f2ee81e834e6da4be44b6592e55b6b06de43c7f8dd391c6a2ef8339141

    • SHA512

      57f241deefada894df6528e4b84423d89d5f6e32a028d710178fefc3cfc1e0b40d140b88094788f410b4f88be6cef76c34537197501e1a66fc6ca37c11a520ab

    • SSDEEP

      98304:uL3SSxOr4BuzoXTUTCu7shaITmx99Jg8MEYA1pQhHKsxlVXG0SJV8BEAM:uLBOr4gUTNUsEJFavVW0QAM

    • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)

    • Checks CPU information

      Checks CPU information which indicate if the system is an emulator.

    • Checks memory information

      Checks memory information which indicate if the system is an emulator.

    • Loads dropped Dex/Jar

      Runs executable file dropped to the device during analysis.

    • Obtains sensitive information copied to the device clipboard

      Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.

    • Queries information about running processes on the device

      Application may abuse the framework's APIs to collect information about running processes on the device.

    • Queries information about the current Wi-Fi connection

      Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.

    • Queries the mobile country code (MCC)

    • Registers a broadcast receiver at runtime (usually for listening for system events)

    • Checks if the internet connection is available

    • Queries the unique device ID (IMEI, MEID, IMSI)

    • Reads information about phone network operator.

MITRE ATT&CK Mobile v15

Tasks