Analysis
- max time kernel
157s - max time network
131s - platform
android_x64 - resource
android-x64-20240514-en - resource tags
androidarch:x64arch:x86image:android-x64-20240514-enlocale:en-usos:android-10-x64system - submitted
26/05/2024, 12:31
Static task
static1
Behavioral task
behavioral1
Sample
yunshi360_v1.1.apk
Resource
android-x86-arm-20240514-en
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
yunshi360_v1.1.apk
Resource
android-x64-20240514-en
6 signatures
150 seconds
Behavioral task
behavioral3
Sample
yunshi360_v1.1.apk
Resource
android-x64-arm64-20240514-en
4 signatures
150 seconds
General
- Target yunshi360_v1.1.apk
- Size 2.5MB
- Sample240526-pp216scg21
- SHA256 ebf971152a28b0be971cba0fc1dfb52ce111e30a062602dc7380886f881e747b
- MD5 31c435a3725f74a7d9796d23f8977de9
- SHA1 3455d6dd79727e08fe945ec38c4cf7be9825872f
- SHA512 68d752a5728805dc40d8914d777bfa06d212acd176ef22cbe25203a459167c7f44e13ef7374317fb8bbed23c03a358eeeaa98c43ce0cac8c402c7f0c7f1d15e3
- SSDEEP 49152:aPOzum2pJZlYtAAO+CAf47tuGZJMTwkad+arjNb4IquAU4P:46umalYtAAO+Cmkgwrnj14LUM
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Checks CPU information 2 TTPs 1 IoCs
Checks CPU information which indicate if the system is an emulator.
description ioc Process File opened for read /proc/cpuinfo net.yunshi360.www - Checks memory information 2 TTPs 1 IoCs
Checks memory information which indicate if the system is an emulator.
description ioc Process File opened for read /proc/meminfo net.yunshi360.www - Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs
Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
description ioc Process Framework service call android.content.IClipboard.addPrimaryClipChangedListener net.yunshi360.www - Queries the mobile country code (MCC) 1 TTPs 1 IoCs
description ioc Process Framework service call com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone net.yunshi360.www - Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
description ioc Process Framework service call android.app.IActivityManager.registerReceiver net.yunshi360.www - Checks the presence of a debugger