28360a0ed26ff2e5a3684a8913a6cc7718d550ac25916360b4cf2dc8a5c72bb0

Analysis

max time kernel
70s
max time network
192s
platform
android_x64
resource
android-x64-20240514-en
resource tags

androidarch:x64arch:x86image:android-x64-20240514-enlocale:en-usos:android-10-x64system
submitted
02/06/2024, 01:55

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
887077eebe54d4ba77cf74c5aa507987.apk
Size 10.3MB
Sample240602-cb7chsfe59
SHA256 28360a0ed26ff2e5a3684a8913a6cc7718d550ac25916360b4cf2dc8a5c72bb0
MD5 887077eebe54d4ba77cf74c5aa507987
SHA1 d178f2d02f2e593211e561cd4ad90c913393d3ae
SHA512 7f9c7fe69e09aeea7e0781c497aab4a9ab2204b35fae549993d102f4a156b3bd5c85b6717fa2f904d4d920f591d777677c43ad2db2f39b8abc7ca444cb68031f
SSDEEP 196608:84fHOP3zBIyTsvMrgNUCF/2KiuT2ylDm9cZ+pv3+Da6Q0HYaCqHEhcN:ZPA3JCyu8+Kv3qSqYaCO6I
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

collection discovery evasion persistence

Malware Config

Signatures

Checks CPU information 2 TTPs 1 IoCs

Checks CPU information which indicate if the system is an emulator.

evasion discovery

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	com.huaying.seal

Queries account information for other applications stored on the device 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect account information stored on the device.

collection

Stored Application Data

T1409

description	ioc	Process
Framework service call	android.accounts.IAccountManager.getAccounts	com.huaying.seal

Queries information about running processes on the device 1 TTPs 2 IoCs

Application may abuse the framework's APIs to collect information about running processes on the device.

discovery

Process Discovery

T1424

description	ioc	Process
Framework service call	android.app.IActivityManager.getRunningAppProcesses	com.huaying.seal
Framework service call	android.app.IActivityManager.getRunningAppProcesses	com.huaying.seal:pushservice

Queries information about the current Wi-Fi connection 1 TTPs 2 IoCs

Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.wifi.IWifiManager.getConnectionInfo	com.huaying.seal
Framework service call	android.net.wifi.IWifiManager.getConnectionInfo	com.huaying.seal:pushservice

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 2 IoCs

persistence

Broadcast Receivers

T1624.001

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	com.huaying.seal:pushservice
Framework service call	android.app.IActivityManager.registerReceiver	com.huaying.seal

Checks if the internet connection is available 1 TTPs 2 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.huaying.seal
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.huaying.seal:pushservice

Domain associated with commercial stalkerware software, includes indicators from echap.eu.org 1 IoCs

flow	ioc
28	alog.umeng.com

Queries the unique device ID (IMEI, MEID, IMSI) 1 TTPs
discovery

System Network Configuration Discovery
T1422

Listens for changes in the sensor environment (might be used to detect emulation) 1 TTPs 1 IoCs

evasion

User Evasion

T1628.002

description	ioc	Process
Framework API call	android.hardware.SensorManager.registerListener	com.huaying.seal

com.huaying.seal
1⤵
- Checks CPU information
- Queries account information for other applications stored on the device
- Queries information about running processes on the device
- Queries information about the current Wi-Fi connection
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Checks if the internet connection is available
- Listens for changes in the sensor environment (might be used to detect emulation)
PID:5264

com.huaying.seal:pushservice
1⤵
- Queries information about running processes on the device
- Queries information about the current Wi-Fi connection
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Checks if the internet connection is available
PID:5330

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Privilege Escalation

Defense Evasion

Hide Artifacts

T1628

User Evasion

T1628.002

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Discovery

Process Discovery

T1424

System Information Discovery

T1426

System Network Configuration Discovery

T1422

System Network Connections Discovery

T1421

Lateral Movement

Collection

Stored Application Data

T1409

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

1002

Path /data/data/com.huaying.seal/app_crashrecord/1002
Size 226B
SHA256 2c6ba9aafbc747129ef196c11d47096dbe8f42fd4df5f9f3d95414ceca19d5e9
MD5 54293d07987b2907c85532683a050611
SHA1 7cc16d119508cbd53f58326241815bbe6eb60fab
SHA512 514e477d90149f7350f5b17a7af5ddb6215943e01e302d4d0e5d948b06f00fcf0f0d74fa64e9a6159f1b64b374c36a92c344b4ac1c80d77237bd43f24b3608d3
MD5 SHA1 SHA512

Submit Download

1004

Path /data/data/com.huaying.seal/app_crashrecord/1004
Size 226B
SHA256 1beb6c4d0957581e2e50e77d44a57ebc02df6bf63a73d1d057a9a09b5ccece4d
MD5 6e4058219d95c0ecbba1e4a50669219b
SHA1 30e43596abb6dcd6c0cfd4214355ec687b5f2985
SHA512 5f85efd457811ad3ee43678b86dace2125c23b124ccf0e88c08c6506022ac619bebd8e3f480a3e2bee0b406cbaea3bd3e4603954886e6555af68533e43bd1cbf
MD5 SHA1 SHA512

Submit Download

1004

Path /data/data/com.huaying.seal/app_crashrecord/1004
Size 58B
SHA256 988722c23d78a46021d0e7ca9deee7aa8bb83288269174ffacb7316f381cca1d
MD5 0d210bfb2a0e1f1b4c082a6a0f79de07
SHA1 bb8ed9e364db79d1d9f2fcde3f15091893222faa
SHA512 536e9867b0df29b15b789f8949be6ab37fcdeccb9d39ded981da7dc2052c9533d0ec0e6f9a5444132977605d372e1463d91bdde41b528ff2ca3f65ab152325c1
MD5 SHA1 SHA512

Submit Download

bugly_db_

Path /data/data/com.huaying.seal/databases/bugly_db_
Size 52KB
SHA256 4d14562860dbe608e0dc8cfc6f4f3b65592624af0898ffbdccb61e5384f47816
MD5 a79d45ad1dc1e7d5a619b8d41f3b2a4e
SHA1 2432beaa57e71e1fad2682fdbbbe918317ec722f
SHA512 2ee3ed7ad8d707a61e0731192764acb0f1de3df58dc92a70d73c3cf1a1b916e9dc9e24d3eb8870355009a09c1253dda27e033c1eab8bdcefdc284adac8554009
SSDEEP 48:T985WuAriStwwuMN5meposSZ6RM7CidKrcv:q53AzwoM73dKA
MD5 SHA1 SHA512 SSDEEP

Submit Download

bugly_db_-journal

Path /data/data/com.huaying.seal/databases/bugly_db_-journal
Size 512B
SHA256 8f12a63be7b8bdb0ac273e59827ea4331aaef3451893c493d179858ad15e52a9
MD5 58fd1758bc8731c75e48817ef1ac4049
SHA1 efc4ff0fad8a02f4f2b896bf7d4ad9303b86303f
SHA512 cc60d427e23e6df81efd93874377bdff3fdab3222be485edf83f471805397399d5bc283eea5e0c77850ab256414619958fc443d53c98c163626b9ab371d4b7d0
MD5 SHA1 SHA512

Submit Download

bugly_db_-journal

Path /data/data/com.huaying.seal/databases/bugly_db_-journal
Size 8KB
SHA256 c3f6f760898fa46e43ced47e1ab602e673560e46a84c5caf8995227f078988d8
MD5 937ff72fe019a31460a0235c9d7918bc
SHA1 c8e06da259de8924eb78ad3b062291aa033bfc44
SHA512 d0ac68d2cc77ab0037b1359c58aaee05ddac2fce55617f5dd57e9561d245ac5010b205940fa6e49b9d229436173695d009614700f99932d768c0c6ef325b9252
SSDEEP 6:7+/l9hgMn1u7fg9bNFlEuWdOlOERX4PBX4ogLugMBX4suuK6G:7+t8tfqLiuWdwRmBEyPbLG
MD5 SHA1 SHA512 SSDEEP

Submit Download

bugly_db_-journal

Path /data/data/com.huaying.seal/databases/bugly_db_-journal
Size 8KB
SHA256 23fe9defe1fff1c19a056ff42194795fd66521c6af3bda5f5a598775e8a2be6e
MD5 9559a1536aecb7f0aead3838bbdeaad5
SHA1 ba590b517ab8669ae345ff094be5fec2ef1fade4
SHA512 067629dc9d44a33e5d599a071191fbb56860542ad7ce76cb9df3412766c33259ed625a111dbc2cc3e401f830540fed323967f0f789e762ecb30fa7bbce6ae9d3
SSDEEP 6:7+/l9U0FPg9bNFlLdrlOERX4PBX4ogLugMBX4suuKyOGt/M:7+t1qLJdTRmBEyPbDOG1M
MD5 SHA1 SHA512 SSDEEP

Submit Download

bugly_db_-journal

Path /data/data/com.huaying.seal/databases/bugly_db_-journal
Size 12KB
SHA256 1cd83c1e486e68b78804752470072cee17c3f36b45ce027e80663b59c4ac6127
MD5 83e941bbd428f9e880cdd17a5d8efdac
SHA1 db9e9a7d6e7da8ff95c23d11ccd07cec3426f458
SHA512 f04a995dbaf6d73e0f2dfbd54c6de5cf397ac81f5eb75fae68b4db9899347d2aa48b43ae3b49035c2985fdcea6ba1a23896f8daffef22c94c11eb5541048ef31
SSDEEP 24:7+tBYqLLFBq5JQfs6y2nriS3dVi6fXX+McEnKwm/mpLwBpGSFhn:7MBYqd85WuAriStwwuMN5meposST
MD5 SHA1 SHA512 SSDEEP

Submit Download

bugly_db_-journal

Path /data/data/com.huaying.seal/databases/bugly_db_-journal
Size 8KB
SHA256 18442d460ac2596d236158e8c0f71638228a078f4c9708db0f6cf6c7cd505619
MD5 8dbaf8fe71880fd0c34f533626a17c6d
SHA1 faff900557dfefb0bfc8a74111d41924baff57ad
SHA512 56046f0a4c88be44f70a07687ca7a1be77d313ced06e10d3653c5de04dcfba445865fef0a7032ce038e325a30f675b6ddd3a6c720277f6156bc02fb0f3dd40d4
SSDEEP 24:7+tg2RqLKX6JBq5JQfs6y2nriS3dVi6fXX+McEnKwm/mpLwBpGSV:7MlRqTJ85WuAriStwwuMN5meposSV
MD5 SHA1 SHA512 SSDEEP

Submit Download

geofencing.db-journal

Path /data/data/com.huaying.seal/databases/geofencing.db-journal
Size 512B
SHA256 fd036caaa33e389244501a3dce335dc0bbca63168e3a28632810c08568b2cebc
MD5 f4822cd41871f18465f0f993d24ed93a
SHA1 e8b28d2ad0f16d280b65a7d24e2014a4a8cbe963
SHA512 7efbb276dcf7c074eb4fbbafa6893b0081e6f67a8d11fe124f68b82517a143705a3c312d2d507a39ba9e292f3dd2cead43815f377540eceba5ee1f8e909140e5
MD5 SHA1 SHA512

Submit Download

000001.dbtmp

Path /data/data/com.huaying.seal/files/SealVideo/leveldb/basic_db/000001.dbtmp
Size 8KB
SHA256 3e0ee009fa828890a3bdde5d01a6345b5f86ba24b72fcb9032dd8099c659c24d
MD5 9f2156f74a6bb04cd0d1046f82917577
SHA1 0ca138bf5aaf27a41f6cc3cc3753d3e0ccd5a6b0
SHA512 ef98c3e25ec45192d9e675aa7d2f95ee1157d16dd70e2854531a1003601d527ee8ed5caa35d329987fc4d13bdb70725b5ac948ca893fe589a9d08acf4f87d32a
SSDEEP 6:7+/l9Usl8HPg9bNFlLdrlOERX4PBX4ogLugMBX4suuKVYy//7:7+tPwqLJdTRmBEyPbFS7
MD5 SHA1 SHA512 SSDEEP

Submit Download

000002.dbtmp

Path /data/data/com.huaying.seal/files/SealVideo/leveldb/basic_db/000002.dbtmp
Size 16B
SHA256 1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
MD5 206702161f94c5cd39fadd03f4014d98
SHA1 bd8bfc144fb5326d21bd1531523d9fb50e1b600a
SHA512 0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145
MD5 SHA1 SHA512

Submit Download

LOG

Path /data/data/com.huaying.seal/files/SealVideo/leveldb/basic_db/LOG
Size 28KB
SHA256 bb849c39f9a2c72b4b34520ff09d1eef151a053e7c9b3874ca80e8d378a12b9c
MD5 cfab1313b6bc4be5c38f024fba1d7195
SHA1 bd3988e3c05d66889d311e06cd577c05a88a4cb6
SHA512 60394e4bb665c2c629bd5ba938858e896355de7850f958b9d9a1bb9beae3b17b281e937cf8868ae252f6dcc46d10985ffe00d2b7bd3adc8a3c30c2052db52099
SSDEEP 12:TLZJufRzHalD9n6+4DOwR5VwgQFODFORQuObrR+Ge+G7KrHPUJOmsRmBEyPbGtOJ:TLnuf5OmnQFOFG/+e57gH+GSiI
MD5 SHA1 SHA512 SSDEEP

Submit Download

MANIFEST-000001

Path /data/data/com.huaying.seal/files/SealVideo/leveldb/basic_db/MANIFEST-000001
Size 8KB
SHA256 044b45f70d94beda68e1661bdc64166ad6121734acd2969e6b9c656ed1f1b436
MD5 487b3236d45ba7fa448eaeff6a43ab16
SHA1 fae66aaf29a434514b6736ec43be0f2205a4c47d
SHA512 8e70edaf5b09ae9775f21d53c96645863915d180653ebe2e92b0f190289bfa499fe00488f017ea18e316a3a0300ca14eea1f957f08b87145840e7956ed44a7f4
SSDEEP 6:7+/l9dOn11Rg9bNFlEuWdOlOERX4PBX4ogLugMBX4suuKjg:7+tUqLiuWdwRmBEyPbP
MD5 SHA1 SHA512 SSDEEP

Submit Download

MANIFEST-000002

Path /data/data/com.huaying.seal/files/SealVideo/leveldb/basic_db/MANIFEST-000002
Size 50B
SHA256 e292f241daafc3df90f3e2d339c61c6e2787a0d0739aac764e1ea9bb8544ee97
MD5 22bf0e81636b1b45051b138f48b3d148
SHA1 56755d203579ab356e5620ce7e85519ad69d614a
SHA512 a4cf1f5c74e0df85dda8750be9070e24e19b8be15c6f22f0c234ef8423ef9ca3db22ba9ef777d64c33e8fd49fada6fcca26c1a14ba18e8472370533a1c65d8d0
MD5 SHA1 SHA512

Submit Download

log1.txt

Path /storage/emulated/0/Android/data/com.huaying.seal/files/MiPushLog/log1.txt
Size 899B
SHA256 3bf9e169b2463a7b67565209565db0ad29828878cd83d245a868e0eaaa2b965d
MD5 07219bbf954d0b9aa1009290461b0cfb
SHA1 671011d19f5e7ab099cf22b4db436ea856d48dcf
SHA512 d11b31df63d994091954c38d309646d47cbf8632c693cb1771daa05f005406ebbcbfe83d79a9d44b94283cbf19dedae8cd7b4892df6743a587c2129223b1d1fe
MD5 SHA1 SHA512

Submit Download

log1.txt

Path /storage/emulated/0/Android/data/com.huaying.seal/files/MiPushLog/log1.txt
Size 1KB
SHA256 259864ff1c0631cb6e37aaf962a3ada887416d4ac6651b82670854396b1abb3c
MD5 b53635270effdeb96923cd80e08ce282
SHA1 a638324427caff0e5ca7df2098337d331227262c
SHA512 90370f2a72f9f482ce065c7f99710f3d645108ec9ab959aa394806fdb521848cc6be5f83a93d8fabf2043e36beb4a08086a9d088c1996bad558ccaf6efd6ef0c
MD5 SHA1 SHA512

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads