Overview

overview

8

Static

static

6

yssaas-rel...00.apk

android-9-x86

8

yssaas-rel...00.apk

android-13-x64

8

Analysis

  • max time kernel
    7s
  • max time network
    132s
  • platform
    android_x86
  • resource
    android-x86-arm-20240514-en
  • resource tags

    androidarch:armarch:x86image:android-x86-arm-20240514-enlocale:en-usos:android-9-x86system
  • submitted
    23-05-2024 12:42

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    yssaas-release_100.apk

  • Size

    9.9MB

  • MD5

    dfe6ee76910669fd7358df04cd58b870

  • SHA1

    9a750a95c778ec086da4007f57e11ed576d4343a

  • SHA256

    7ae904d41f4450bd3d2390f510086766a30b57c1aef5f8ba6cf5350741ee61fb

  • SHA512

    73c28151458c41942be350548466db8ef3307b92b03068a5511c15748eac1b6126c1db61a8ead7945108b72de8c528144d6d505146c9864f71d845b9ff04caff

  • SSDEEP

    196608:vd1NrmSsSRNiqvFDHGzomkABMNI6G/wXCtAFdLTdfmElJHRkhJpxR4wVJQ9Wc9SH:vd1Na5SRzH+MNNe4XCtEdgElJHRkhJxp

Score
8/10
collectiondiscoveryevasionimpact

Malware Config

Signatures

  • Requests cell location 2 TTPs 1 IoCs

    Uses Android APIs to to get current cell location.

    collectiondiscoveryevasion
  • Queries information about running processes on the device 1 TTPs 1 IoCs

    Application may abuse the framework's APIs to collect information about running processes on the device.

    discovery
  • Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs

    Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.

    discovery
  • Queries information about the current nearby Wi-Fi networks 1 TTPs 1 IoCs

    Application may abuse the framework's APIs to collect information about the current nearby Wi-Fi networks.

    discovery
  • Checks if the internet connection is available 1 TTPs 1 IoCs
    discovery
  • Reads information about phone network operator. 1 TTPs
    discovery
  • Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
    impact

Processes

  • com.yisheng.saas
    1⤵
    • Requests cell location
    • Queries information about running processes on the device
    • Queries information about the current Wi-Fi connection
    • Queries information about the current nearby Wi-Fi networks
    • Checks if the internet connection is available
    • Uses Crypto APIs (Might try to encrypt user data)
    PID:4315

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/data/com.yisheng.saas/files/libcuid.so
    Filesize

    129B

    MD5

    c6de2bb5cce2e6a82fa25e26843ef4bc

    SHA1

    50f7788d829a58c81ed5ea6d8957dac872ab151f

    SHA256

    14e207ce459d9c438a7d37137f69ac4a5af1c461b70126659316c25fc26d6bb1

    SHA512

    6024da8350b242f5f5e58b3b4c2da85d56ce4831b64116bd8296c5f4a051eccc4123c4cf64a1b8236db1cbf3361d04d4a775472b800486e3fc84ace338e297a6

    Download Submit