fd04c0f2ee81e834e6da4be44b6592e55b6b06de43c7f8dd391c6a2ef8339141

Analysis

max time kernel
126s
max time network
186s
platform
android_x64
resource
android-x64-20240514-en
resource tags

androidarch:x64arch:x86image:android-x64-20240514-enlocale:en-usos:android-10-x64system
submitted
23-05-2024 12:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

civio_shippark1.3.1内测.apk
Size

5.7MB
MD5

2223a5d90ab31d0fb70697681f7c249a
SHA1

193604f1c495c172e52e993d28b5081e3927b9c0
SHA256

fd04c0f2ee81e834e6da4be44b6592e55b6b06de43c7f8dd391c6a2ef8339141
SHA512

57f241deefada894df6528e4b84423d89d5f6e32a028d710178fefc3cfc1e0b40d140b88094788f410b4f88be6cef76c34537197501e1a66fc6ca37c11a520ab
SSDEEP

98304:uL3SSxOr4BuzoXTUTCu7shaITmx99Jg8MEYA1pQhHKsxlVXG0SJV8BEAM:uLBOr4gUTNUsEJFavVW0QAM

Score

8^/10

banker collection credential_access discovery evasion impact persistence

Malware Config

Signatures

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
banker discovery

Security Software Discovery
T1418.001
Checks CPU information 2 TTPs 1 IoCs
Checks CPU information which indicate if the system is an emulator.
evasion discovery

System Checks
T1633.001

System Information Discovery
T1426

Processes:

civio.shipparking

description ioc process

File opened for read /proc/cpuinfo civio.shipparking
Checks memory information 2 TTPs 1 IoCs
Checks memory information which indicate if the system is an emulator.
evasion discovery

System Checks
T1633.001

System Information Discovery
T1426

Processes:

civio.shipparking

description ioc process

File opened for read /proc/meminfo civio.shipparking
Loads dropped Dex/Jar 1 TTPs 1 IoCs
Runs executable file dropped to the device during analysis.
evasion

Download New Code at Runtime
T1407

Processes:

civio.shipparking

ioc pid process

/data/user/0/civio.shipparking/[email protected] 5182 civio.shipparking
Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs
Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
collection credential_access impact

Clipboard Data
T1414

Transmitted Data Manipulation
T1641.001

Processes:

civio.shipparking

description ioc process

Framework service call android.content.IClipboard.addPrimaryClipChangedListener civio.shipparking
Queries information about running processes on the device 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about running processes on the device.
discovery

Process Discovery
T1424

Processes:

civio.shipparking

description ioc process

Framework service call android.app.IActivityManager.getRunningAppProcesses civio.shipparking
Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.
discovery

System Network Connections Discovery
T1421

Processes:

civio.shipparking

description ioc process

Framework service call android.net.wifi.IWifiManager.getConnectionInfo civio.shipparking
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
discovery

System Network Configuration Discovery
T1422

Processes:

civio.shipparking

description ioc process

Framework service call com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone civio.shipparking
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
persistence

Broadcast Receivers
T1624.001

Processes:

civio.shipparking

description ioc process

Framework service call android.app.IActivityManager.registerReceiver civio.shipparking
Checks if the internet connection is available 1 TTPs 1 IoCs
discovery

System Network Connections Discovery
T1421

Processes:

civio.shipparking

description ioc process

Framework service call android.net.IConnectivityManager.getActiveNetworkInfo civio.shipparking
Queries the unique device ID (IMEI, MEID, IMSI) 1 TTPs
discovery

System Network Configuration Discovery
T1422
Reads information about phone network operator. 1 TTPs
discovery

System Network Configuration Discovery
T1422
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
impact

Data Encrypted for Impact
T1471

Processes:

civio.shipparking

description ioc process

Framework API call javax.crypto.Cipher.doFinal civio.shipparking

description	ioc	process
File opened for read	/proc/cpuinfo	civio.shipparking

description	ioc	process
File opened for read	/proc/meminfo	civio.shipparking

ioc	pid	process
/data/user/0/civio.shipparking/[email protected]	5182	civio.shipparking

description	ioc	process
Framework service call	android.content.IClipboard.addPrimaryClipChangedListener	civio.shipparking

description	ioc	process
Framework service call	android.app.IActivityManager.getRunningAppProcesses	civio.shipparking

description	ioc	process
Framework service call	android.net.wifi.IWifiManager.getConnectionInfo	civio.shipparking

description	ioc	process
Framework service call	com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone	civio.shipparking

description	ioc	process
Framework service call	android.app.IActivityManager.registerReceiver	civio.shipparking

description	ioc	process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	civio.shipparking

description	ioc	process
Framework API call	javax.crypto.Cipher.doFinal	civio.shipparking

civio.shipparking
1⤵
- Checks CPU information
- Checks memory information
- Loads dropped Dex/Jar
- Obtains sensitive information copied to the device clipboard
- Queries information about running processes on the device
- Queries information about the current Wi-Fi connection
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Checks if the internet connection is available
- Uses Crypto APIs (Might try to encrypt user data)
PID:5182

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Clipboard Data

T1414

Discovery

Process Discovery

T1424

Software Discovery

T1418

Security Software Discovery

T1418.001

System Information Discovery

T1426

System Network Configuration Discovery

T1422

System Network Connections Discovery

T1421

Lateral Movement

Collection

Clipboard Data

T1414

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

T1471

Data Manipulation

T1641

Transmitted Data Manipulation

T1641.001

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/civio.shipparking/.00000000000/39285EFA.dex
Filesize
69KB

MD5
75a8168e7080b90fc2956592c268371f

SHA1
3702da56d31f381525473364f031dc884e37076d

SHA256
0b9c032080788add7f5989d0ce145e66a4686ff3a43b0e48dec60bf18bf75701

SHA512
33536573c834fffab7236dd96c22cbc3d075ab70b622ff7787381e5c7c262ab62e0252f0d07313c9227ccc8308cd93cd96373e57fa55a066691d5b5cfb55f5d3

Download Submit
/data/data/civio.shipparking/.00000000000/39285EFA.dex
Filesize
69KB

MD5
02f69eb4fe05ebc6c9f736d83e5f7e26

SHA1
777d75e14a73f5721fc4ae34f49a9a4b82311373

SHA256
13502356b7d3f910107aeff131e9c4a2b892744a125a2d1a2a206b219dc36042

SHA512
7c1f5d68d40bf37aef2e59aa9a4f96d1ef642a8db7e53295953b0b5fa3a63cd7546c5cf8ad3fc17f6b84a795a08e13024d8dcb3db828ca3fad634964cba69bcc

Download Submit
/data/data/civio.shipparking/files/.imei.txt
Filesize
32B

MD5
aa35b7f9124d84c5141e87222ebc0fe3

SHA1
19dfc101fa4e3368c06e41b8565a1afe5c870e59

SHA256
471174c4f91ab7e267ea3b5a7407b3138de8b24b479ca3e0412282e28a472467

SHA512
ef8cb898bee9aafc5d217d3de8633e039273a96b024b773afb37633808703555185b2d7d807a7a67dd32879ef7876ea9a32d4daed6c2fc058714b94527c0d942

Download Submit
/data/data/civio.shipparking/files/cnc3ejE6/eje3cnc
Filesize
35B

MD5
762298b93820a5cd8b6d8ec469078f7f

SHA1
d5b02a2ff3b235cd2b61ceff53a1d88b8984477d

SHA256
dc3f98a33c26c2796dc294b354831fd5ca9796295f4cb38479c80b145d4807db

SHA512
70f864211ce16679d0538abf9b7071d27c2d22ae458e32409d20065032c762dd186307ef33ede90abd9ac794a4ced8b163404e9799c05f0c515337249684311e

Download Submit
/data/data/civio.shipparking/shared_prefs_ext/test_app
Filesize
24B

MD5
db671f1b558d49a5aa4d540b0387fc92

SHA1
df500fcc48d8ac9b1919ae7ae39b65a5b53855c7

SHA256
843113383988b69457d0e6430536eeeff0e239e0606faed784e41197eba620f6

SHA512
d5fe793e76a33ad92adb657e0f0b10d11548a3efcf694221d4996dcdcaebd8ca519b669506a400bfa848262db698888d852d82653b4752c534ade71c87c824b1

Download Submit