bef878efe20f933244b949e2e4aeb7194e9ffbb4457529121939b94e7642e013 | Triage™

Analysis

max time kernel
4s
max time network
138s
platform
android_x64
resource
android-x64-20240514-en
resource tags

androidarch:x64arch:x86image:android-x64-20240514-enlocale:en-usos:android-10-x64system
submitted
03/06/2024, 00:01

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
bef878efe20f933244b949e2e4aeb7194e9ffbb4457529121939b94e7642e013.apk
Size 3.6MB
Sample240603-aa131adb45
SHA256 bef878efe20f933244b949e2e4aeb7194e9ffbb4457529121939b94e7642e013
MD5 eac529caad0626c13ebec5d5bc546160
SHA1 c85b3548b7a0962257a60a3ff69b17d3d5b87ca5
SHA512 1274c7d6aaa7a43acc5261f94764f3cab031b8cc77c679df9a039ae9d74dd08b7207415e9dd776320d09368658829b1d5f05a9f9f98246f9c3bd84f56ea761cc
SSDEEP 98304:D4+J37xLu4/uLnLOLZLMyLHLYL1LcLQL4LVLUKnt:8+J1y4G7y9gyr0BoM0xn
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

discovery evasion persistence

Malware Config

Signatures

Checks memory information 2 TTPs 1 IoCs

Checks memory information which indicate if the system is an emulator.

evasion discovery

System Checks

System Information Discovery

description	ioc	Process
File opened for read	/proc/meminfo	com.cordova.shishi

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs

Broadcast Receivers

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	com.cordova.shishi

com.cordova.shishi
1⤵
- Checks memory information
- Registers a broadcast receiver at runtime (usually for listening for system events)
PID:5072

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Event Triggered Execution

Broadcast Receivers

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

System Checks

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads