7ae904d41f4450bd3d2390f510086766a30b57c1aef5f8ba6cf5350741ee61fb

Analysis

max time kernel
9s
max time network
132s
platform
android_x64
resource
android-33-x64-arm64-20240514-en
resource tags

androidarch:arm64arch:x64image:android-33-x64-arm64-20240514-enlocale:en-usos:android-13-x64system
submitted
23-05-2024 12:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

yssaas-release_100.apk
Size

9.9MB
MD5

dfe6ee76910669fd7358df04cd58b870
SHA1

9a750a95c778ec086da4007f57e11ed576d4343a
SHA256

7ae904d41f4450bd3d2390f510086766a30b57c1aef5f8ba6cf5350741ee61fb
SHA512

73c28151458c41942be350548466db8ef3307b92b03068a5511c15748eac1b6126c1db61a8ead7945108b72de8c528144d6d505146c9864f71d845b9ff04caff
SSDEEP

196608:vd1NrmSsSRNiqvFDHGzomkABMNI6G/wXCtAFdLTdfmElJHRkhJpxR4wVJQ9Wc9SH:vd1Na5SRzH+MNNe4XCtEdgElJHRkhJxp

Score

8^/10

collection discovery evasion impact

Malware Config

Signatures

Requests cell location 2 TTPs 1 IoCs
Uses Android APIs to to get current cell location.
collection discovery evasion

Location Tracking
T1430

Geofencing
T1627.001

Processes:

com.yisheng.saas

description ioc process

Framework service call com.android.internal.telephony.ITelephony.getCellLocation com.yisheng.saas
Queries information about running processes on the device 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about running processes on the device.
discovery

Process Discovery
T1424

Processes:

com.yisheng.saas

description ioc process

Framework service call android.app.IActivityManager.getRunningAppProcesses com.yisheng.saas
Checks if the internet connection is available 1 TTPs 1 IoCs
discovery

System Network Connections Discovery
T1421

Processes:

com.yisheng.saas

description ioc process

Framework service call android.net.IConnectivityManager.getActiveNetworkInfo com.yisheng.saas
Reads information about phone network operator. 1 TTPs
discovery

System Network Configuration Discovery
T1422
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
impact

Data Encrypted for Impact
T1471

Processes:

com.yisheng.saas

description ioc process

Framework API call javax.crypto.Cipher.doFinal com.yisheng.saas

description	ioc	process
Framework service call	com.android.internal.telephony.ITelephony.getCellLocation	com.yisheng.saas

description	ioc	process
Framework service call	android.app.IActivityManager.getRunningAppProcesses	com.yisheng.saas

description	ioc	process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.yisheng.saas

description	ioc	process
Framework API call	javax.crypto.Cipher.doFinal	com.yisheng.saas

com.yisheng.saas
1⤵
- Requests cell location
- Queries information about running processes on the device
- Checks if the internet connection is available
- Uses Crypto APIs (Might try to encrypt user data)
PID:4302

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Execution Guardrails

T1627

Geofencing

T1627.001

Credential Access

Discovery

Location Tracking

T1430

Process Discovery

T1424

System Network Configuration Discovery

T1422

System Network Connections Discovery

T1421

Lateral Movement

Collection

Location Tracking

T1430

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

T1471

Replay Monitor

Loading Replay Monitor...

Downloads

/data/user/0/com.yisheng.saas/files/libcuid.so
Filesize
109B

MD5
477b6bef36b9f86f3485724c4cdee195

SHA1
80f1d16b172009c49dcdb6dc32426831bba2f79f

SHA256
1185d340e47e544def3045ff3e1146269d9576668507cea67b3e34c21953642b

SHA512
7441a7aee0a9fe1d2b7a3b55b191b06f0153d578ed7f18f7a574e45fc215e3ff33dcc71ad5eee5ea867040fa39ca3884e8d8ecf378de687c8f5efbfc4166cf57

Download Submit