21f9ac343434969f1972de72ec5a4d1ac661dd09f10b206d51787901e4c25f09

Analysis

max time kernel
7s
max time network
131s
platform
android_x64
resource
android-x64-20240514-en
resource tags

androidarch:x64arch:x86image:android-x64-20240514-enlocale:en-usos:android-10-x64system
submitted
30/05/2024, 15:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
androidyhds.apk
Size 1.7MB
Sample240530-s2de5adb81
SHA256 52a0e72ea8b6d44f674b50e9317adf7d80451c6392dc42737c3ad0d8ac052a3b
MD5 51b500a06fcaed08d4d1f1fa672de9a8
SHA1 011613906a01f4e2fdaefbf47ceda1a781b6288e
SHA512 db80784a27401752ef2cbd2943b2c8332e568b238e42102d96142bfa6bda150a96a076b299e250e17b94da26cc42e2d652d186e2a3ca7d57900d1831b0db7c16
SSDEEP 49152:boXOfXYYXxQIxrxb+Eq8Qcv08+vVHXAYnXRocjd1k+o6W54yosa6yEaGuFRefLp:bob3vZXC+a
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

collection credential_access discovery evasion impact persistence

Malware Config

Signatures

Checks if the Android device is rooted. 1 TTPs 2 IoCs

evasion

System Information Discovery

T1426

ioc	Process
/system/bin/su	cn.opda.a.phonoalbumshoushou
/system/xbin/su	cn.opda.a.phonoalbumshoushou

Checks CPU information 2 TTPs 1 IoCs

Checks CPU information which indicate if the system is an emulator.

evasion discovery

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	cn.opda.a.phonoalbumshoushou

Checks memory information 2 TTPs 1 IoCs

Checks memory information which indicate if the system is an emulator.

evasion discovery

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	cn.opda.a.phonoalbumshoushou

Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs

Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.

collection credential_access impact

Clipboard Data

T1414

Transmitted Data Manipulation

T1641.001

description	ioc	Process
Framework service call	android.content.IClipboard.addPrimaryClipChangedListener	cn.opda.a.phonoalbumshoushou

Queries account information for other applications stored on the device 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect account information stored on the device.

collection

Stored Application Data

T1409

description	ioc	Process
Framework service call	android.accounts.IAccountManager.getAccountsAsUser	cn.opda.a.phonoalbumshoushou

Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.wifi.IWifiManager.getConnectionInfo	cn.opda.a.phonoalbumshoushou

Queries the mobile country code (MCC) 1 TTPs 1 IoCs

discovery

System Network Configuration Discovery

T1422

description	ioc	Process
Framework service call	com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone	cn.opda.a.phonoalbumshoushou

Queries the phone number (MSISDN for GSM devices) 1 TTPs
discovery

System Network Configuration Discovery
T1422

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs

persistence

Broadcast Receivers

T1624.001

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	cn.opda.a.phonoalbumshoushou

Checks if the internet connection is available 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	cn.opda.a.phonoalbumshoushou

Queries the unique device ID (IMEI, MEID, IMSI) 1 TTPs
discovery

System Network Configuration Discovery
T1422
Reads information about phone network operator. 1 TTPs
discovery

System Network Configuration Discovery
T1422

cn.opda.a.phonoalbumshoushou
1⤵
- Checks if the Android device is rooted.
- Checks CPU information
- Checks memory information
- Obtains sensitive information copied to the device clipboard
- Queries account information for other applications stored on the device
- Queries information about the current Wi-Fi connection
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Checks if the internet connection is available
PID:5142

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Clipboard Data

T1414

Discovery

System Information Discovery

T1426

System Network Configuration Discovery

T1422

System Network Connections Discovery

T1421

Lateral Movement

Collection

Clipboard Data

T1414

Stored Application Data

T1409

Command and Control

Exfiltration

Impact

Data Manipulation

T1641

Transmitted Data Manipulation

T1641.001

Replay Monitor

Loading Replay Monitor...

Downloads

dashi_online.db

Path /data/data/cn.opda.a.phonoalbumshoushou/databases/dashi_online.db
Size 44KB
SHA256 490c31d138ebf02877ff707a229a71775d75df6f7f2f28c8eae44649e84f8fc7
MD5 b63c3a3e89f110d6e6f9d99630bc6ad6
SHA1 dc129bff1dd1d4426eba228d5b109b7333eef1c7
SHA512 4dba96609062e5f7d56bb80a155f35c3ac69f2bff61600fc9e6a9817ad9522501f9cf59dad6f344b516ee040de1e43acfac334af8b79911123b502426e5b3e05
SSDEEP 48:ThPHF6q3imNDH2JyShwOFcP8aOl2Sd69E:9/Fd3Nd2JyO0SgC
MD5 SHA1 SHA512 SSDEEP

Submit Download

dashi_online.db-journal

Path /data/data/cn.opda.a.phonoalbumshoushou/databases/dashi_online.db-journal
Size 512B
SHA256 5b1d5637814c7c15d5fae0d36d9d85895cfcf7e85128247add07605cca09ad9b
MD5 d9871137e77bdf61e717cf2ee4d8eaba
SHA1 5adb89979648e473883d8521ff22cc4441b5043b
SHA512 7ab5afc4ecbb988ed3bd8d2d589e80a18f3ecb031ceb30d2a89e03d68d502548073cd7dffe3e2f2abbe48b7976b6b456b89bb1dfafa66cb988428198e2147875
MD5 SHA1 SHA512

Submit Download

dashi_online.db-journal

Path /data/data/cn.opda.a.phonoalbumshoushou/databases/dashi_online.db-journal
Size 8KB
SHA256 5d41a2f9d0c8b5e8cb7196bcff35d199bf0f869d1dfe30fee8cb58686a9df99c
MD5 43c8e25835562150f4204708b50275a4
SHA1 d11b51205c65b2f24a9bfb3dcf997d7cffaa7127
SHA512 55a038af68c90c08538a384ac1df1f31fc87ed1202821dfcad5784fc44e0c2a45128e32d6f5787d7ad78400193635086490654825a9cc465fb4e219417995267
SSDEEP 6:7+/l9x1n1Yg9bNFlEuWdOlOERX4PBX4ogLugMBX4suuKqO:7+tgqLiuWdwRmBEyPbbO
MD5 SHA1 SHA512 SSDEEP

Submit Download

dashi_online.db-journal

Path /data/data/cn.opda.a.phonoalbumshoushou/databases/dashi_online.db-journal
Size 8KB
SHA256 80b1beef9b413b72ce2e126a1824dc22ad0abea7308fa785f2a7fb04d500b5de
MD5 94f3451d0d3f930bbe2cce2bf30e22f9
SHA1 99a42b4d2576466c3b5abc5b846b489b96bbccb7
SHA512 b0af04fd9e846f1e79257c898773d8ed9aeeef4834ee43f9c0b50ede76cb6ca60c486badacbf5199e109b848bf0e54900dc536b3747de8288f7ae5eedea4c0bd
SSDEEP 6:7+/l9fPg9bNFlLdrlOERX4PBX4ogLugMBX4suuKaNf/0:7+t5qLJdTRmBEyPbv30
MD5 SHA1 SHA512 SSDEEP

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads