53c4db9f4e28b6b01465ec9ab52061c7c221ce77671daab5206ab90673763278

Analysis

max time kernel
173s
max time network
185s
platform
android_x64
resource
android-x64-arm64-20240514-en
resource tags

androidarch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20240514-enlocale:en-usos:android-11-x64system
submitted
03/06/2024, 01:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
8be15230c11d67b8d2cc82e6f7741d3f.apk
Size 4.3MB
Sample240603-bz7graef4t
SHA256 53c4db9f4e28b6b01465ec9ab52061c7c221ce77671daab5206ab90673763278
MD5 8be15230c11d67b8d2cc82e6f7741d3f
SHA1 824a27cf1f7105c17f57145275be5e3af6db3b88
SHA512 90af29c00a8378bf2d8995d6a6342100457962f57283b637e83c67dcd0b5eeeaec618832517aac8c20d5842d6cf1599de0d1c0f6e36a357f8e7dd81f218abec3
SSDEEP 98304:mQvsTDSI9S3a/tE/oo3yxyaf80zGijojJXwnqMV8L3/Bbc19/nMV8L3/Bbc19/tG:mXDSI9S3a1eR3yka00zGhFL3p29/BL3t
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

collection credential_access discovery evasion impact

Malware Config

Signatures

Checks CPU information 2 TTPs 1 IoCs

Checks CPU information which indicate if the system is an emulator.

evasion discovery

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	io.dcloud.H5D7DD228

Checks memory information 2 TTPs 1 IoCs

Checks memory information which indicate if the system is an emulator.

evasion discovery

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	io.dcloud.H5D7DD228

Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs

Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.

collection credential_access impact

Clipboard Data

T1414

Transmitted Data Manipulation

T1641.001

description	ioc	Process
Framework service call	android.content.IClipboard.addPrimaryClipChangedListener	io.dcloud.H5D7DD228

Queries information about running processes on the device 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about running processes on the device.

discovery

Process Discovery

T1424

description	ioc	Process
Framework service call	android.app.IActivityManager.getRunningAppProcesses	io.dcloud.H5D7DD228

Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.wifi.IWifiManager.getConnectionInfo	io.dcloud.H5D7DD228

Checks if the internet connection is available 1 TTPs 2 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	io.dcloud.H5D7DD228:pushservice
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	io.dcloud.H5D7DD228

Domain associated with commercial stalkerware software, includes indicators from echap.eu.org 1 IoCs

flow	ioc
36	alog.umeng.com

Queries the unique device ID (IMEI, MEID, IMSI) 1 TTPs
discovery

System Network Configuration Discovery
T1422
Reads information about phone network operator. 1 TTPs
discovery

System Network Configuration Discovery
T1422

Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

impact

Data Encrypted for Impact

T1471

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	io.dcloud.H5D7DD228:pushservice

io.dcloud.H5D7DD228
1⤵
- Checks CPU information
- Checks memory information
- Obtains sensitive information copied to the device clipboard
- Queries information about running processes on the device
- Queries information about the current Wi-Fi connection
- Checks if the internet connection is available
PID:4606

io.dcloud.H5D7DD228:pushservice
1⤵
- Checks if the internet connection is available
- Uses Crypto APIs (Might try to encrypt user data)
PID:4660

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Clipboard Data

T1414

Discovery

Process Discovery

T1424

System Information Discovery

T1426

System Network Configuration Discovery

T1422

System Network Connections Discovery

T1421

Lateral Movement

Collection

Clipboard Data

T1414

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

T1471

Data Manipulation

T1641

Transmitted Data Manipulation

T1641.001

Replay Monitor

Loading Replay Monitor...

Downloads

cc.db

Path /data/data/io.dcloud.H5D7DD228/databases/cc/cc.db
Size 36KB
SHA256 50484dcdc6b9c2801773018386a8143a52a5153eb2eeeaf5be8bbe46a49ca90c
MD5 86752a4be6564d8370f2f0e403995003
SHA1 29f7d50675f6e59f3b808eb6dcc8619384412115
SHA512 79c9435c1e0d41a3f97784be3e5a3cd8c0bd2d32ecdf326808bacb00c76d876d0447617d6e72ef04cd4b996c92eda4eb7bb200987ae7928ce2e0e7c8e807a5ec
SSDEEP 12:TLg5P2yMHdqVcV7p5WUYUW5LfpBKKyBGtbDrNTSFbycKrHBGtb5RmBEyPbP/WQQ:TLF7sL7yot3BVrHotGGSP/WQQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

cc.db

Path /data/data/io.dcloud.H5D7DD228/databases/cc/cc.db
Size 48KB
SHA256 7b96ab3c1482bc41f5c90c367e0980a2b63b3cf37edc8f5f3471ee5bcb6e6433
MD5 f2318cdc8e91b025b61969e607044b68
SHA1 1925d5233cf9bfaf23678cb8bf305ea09d306f7e
SHA512 0bf2b7ac6194168e64085075c6cc711d956dc60a707a2dfcbe51ebf6a945c132cd807db03659ee28484f27cd46753f9d262a3d8d3731edb6ac2d24ce5fb06e8a
SSDEEP 24:TL7Z7s9QW0uUduRwCJAWfLq8w7qTQ3o0h7igzD1ZHtU/TVGSFht9U9RCT+MQQQeQ:TXZ7/W0xopA/t379y/MSbbMRY
MD5 SHA1 SHA512 SSDEEP

Submit Download

cc.db-journal

Path /data/data/io.dcloud.H5D7DD228/databases/cc/cc.db-journal
Size 8KB
SHA256 76299598d4f33ffec4b9e0dfebb94b17cbea7d4470eed0368785d4768e5c6406
MD5 d3abe9e660ea39cbd5bbd38a7b575a9d
SHA1 8db54fd9e0816efa3c9841ad4b5434580c734e68
SHA512 0ae40c6d166d0387959a23eee2a251a649f86a2da6de5d5c1ae00872d6d70f607d40b81d901d99a966ad1da7c094fe8012c47408c0897efafd3eea30c2efde40
SSDEEP 12:7+tbHfWqL/0P2yMHdqVcV7p5WUYUW5LfpBKKyBGtbDrNTSFbycKrHBGtb5RmBEyr:7+tbHfWqLV7sL7yot3BVrHotGGSVh
MD5 SHA1 SHA512 SSDEEP

Submit Download

cc.db-journal

Path /data/data/io.dcloud.H5D7DD228/databases/cc/cc.db-journal
Size 8KB
SHA256 d9d411f9740c68e521d7e17011c5b7f772e01c9f99a6dfc1d8aab1d84affae89
MD5 d0cb70a437f797e42480b3de4adcaf3f
SHA1 2dfa1c1bb414d253f505d90db3995906d13d31ab
SHA512 904a2e0ee20011e47531d710e56a84158896a80088e635b3bf343347c89329ec0721bcc68d48448050b28657d1f40e3a3beaf921861b4c896b6d69e61df731f5
SSDEEP 12:7+t7FfqL+/3P2yMHdqVcV7p5WUYUW5LfpBKKyBGtbDrNTSFbycKrHBGtb5RmBEyV:7+t7FfqLl7sL7yot3BVrHotGGSB
MD5 SHA1 SHA512 SSDEEP

Submit Download

cc.db-journal

Path /data/data/io.dcloud.H5D7DD228/databases/cc/cc.db-journal
Size 12KB
SHA256 bf6f78a2c63dc6a79175e4c0d876fadc23de298f2d36ff2b54cbfe32bd9f7fb5
MD5 febf19222bad35bc2ec63cdaeaab0f4f
SHA1 fa507ef78f475bd39b2ba98bd9b5a6a5444ddfdd
SHA512 82eaf3f6908b1d876f7d4257c07e7bcf6d5808c5089a77985c4a69a4c5d7290722887a0c0a63316475322aa576ecb5d9513369d614b05db0c5dab3d579c8d7f6
SSDEEP 12:7+t/meFqLWEmlP2yMHdqVcV7p5WUYUW5LfpBKKyBGtbDrNTSFbycKrHBGtb5RmBy:7+t/LqLsO7sL7yot3BVrHotGGSHI
MD5 SHA1 SHA512 SSDEEP

Submit Download

cc.db-journal

Path /data/data/io.dcloud.H5D7DD228/databases/cc/cc.db-journal
Size 512B
SHA256 2279ec6321ef6da351471b40bac42900a8728179724401637aac7a17b4c8a24d
MD5 86dc647bb14505d9526e28b23ff6720a
SHA1 0a4f7ba19fc95b15e4a85ea0b433000f2ba11cb5
SHA512 6c4cb2b5f654faa24954ef7bb6e736bf54060e4c49be029a0d08190817447656cef9a2dcf227115f118374daab2bfb14460d13d237f4a9fac619746d9dd957c2
MD5 SHA1 SHA512

Submit Download

cc.db-journal

Path /data/data/io.dcloud.H5D7DD228/databases/cc/cc.db-journal
Size 8KB
SHA256 1ed86814ec88a757c071a02c3b1e8f4f08a3bb64039d847c416e40bd5696303a
MD5 ef2e9e713ed461d55f906ddfcac8c9c7
SHA1 b289fbef7140236f8fcf43839b322ecc03c17031
SHA512 33720efb5124bda07eb4bb7a902383ceb3fce71caeb6c3c3f0b872d9c6434e8223a7cfe3eace71781bd0ea1515f2545033d94ee00ad64da4b7f51834f902a775
SSDEEP 6:7+/l9Qn1CIg9bNFlEuWdN/kPlOERX4PBX4ogLugMBX4suuKg:7+twqLiuWdYRmBEyPbP
MD5 SHA1 SHA512 SSDEEP

Submit Download

cc.db-journal

Path /data/data/io.dcloud.H5D7DD228/databases/cc/cc.db-journal
Size 8KB
SHA256 5089a422cc0931e814e69ab9f604f508affb9c44a50592acf489d9663bbc18f1
MD5 510b3d0ae3f1f79ca97408986ecdb6da
SHA1 95780e8b0bcc7fcbeb122f802a98cff82d18b887
SHA512 aa7cf640e326e64766d5a0748b4afaa0009ce29a95061a06c9083f33ea8cf80afd286faa54f6cd209a2bd3acad7b4f37aa7826823b5efae301828b71edace0ad
SSDEEP 6:7+/l9VPg9bNFlLde/kPlOERX4PBX4ogLugMBX4suuKG/m:7+t3qLJdeWRmBEyPbpm
MD5 SHA1 SHA512 SSDEEP

Submit Download

pushsdk.db-journal

Path /data/user/0/io.dcloud.H5D7DD228/databases/pushsdk.db-journal
Size 4KB
SHA256 99bd6994c522dbea2c0da5f590975b5773b44fbaa503857faa3faf6ec9e68b8c
MD5 6e73e6646ead1cf95e74cb24e95d1b0c
SHA1 837188e4c9b98960ca2e1a49dea0e6343e4df757
SHA512 f8caf990ba0a2087aeaea13189addae3f786fef39690908adf0d1144ffeac6b865da679d47e8d9db1b4311089c02ed62d5b1b8075eeb3f2671bed583bdd67d65
SSDEEP 24:q/tqLqG7s9QW0uUduRwCJAWfLq8w7qTQ3o0h7igzD1ZHtU/TVGSqn:+qGG7/W0xopA/t379y/MSq
MD5 SHA1 SHA512 SSDEEP

Submit Download

pushsdk.db-journal

Path /data/user/0/io.dcloud.H5D7DD228/databases/pushsdk.db-journal
Size 8KB
SHA256 58cd20959f897870c3b5a0ba418d025e1edf44a3e3bf0386be5ad74655ee8ae9
MD5 600e1719bf11740b8db4dea1f4817b5e
SHA1 2d7b04eaa1f7be96457dc89b5b398cdb2fa6028d
SHA512 c63879da6df4b0fe8b9c992d5d0f2285f952ee3ce9ebd39e1c2630cfd0d11e2656af6c16a16f3aea6b7986cc85d9854e88c3aad30aba1ce2b1a78fbdcc925ae2
SSDEEP 24:q/Jm0oqL9T7s9QW0uUduRwCJAWfLq8w7qTQ3o0h7igzD1ZHtU/TVGSo:Mm0oqRT7/W0xopA/t379y/MSo
MD5 SHA1 SHA512 SSDEEP

Submit Download

pushsdk.db-journal

Path /data/user/0/io.dcloud.H5D7DD228/databases/pushsdk.db-journal
Size 8KB
SHA256 07deb8ad76c8a72a3bbbbb5ba46d1545fae82c71b82e63a6df297a4a2c68a6dd
MD5 f7a6a454678108ef0c579be13344b211
SHA1 cf4a9ad091aff4a306385493edc4b4859cb603a2
SHA512 6032ba095c6178e758d09a563439400a1b7406944e03d774b971c837bbf53dc199b1bdd1bbcb08843eda31aed18fad0c0bf0f9908cd175de00522b82d6eb8a6f
SSDEEP 24:7+te6t9UMCT+EnqLCTU7s9QW0uUduRwCJAWfLq8w7qTQ3o0h7igzD1ZHtU/TVGS6:7Me6bTYTnqEU7/W0xopA/t379y/MS6
MD5 SHA1 SHA512 SSDEEP

Submit Download

um_cache_1717378639739.env

Path /data/user/0/io.dcloud.H5D7DD228/files/.um/um_cache_1717378639739.env
Size 1KB
SHA256 4beb14942867f1eea3af8f194dd58b2d98d332ce536ac1616ed6e65e47ad10ac
MD5 e69483c70a136e2fc93537604d4afa5e
SHA1 8eed4e9a9c7fb6c84cc102bc9a8078a9057f6ba7
SHA512 586ecf8935e25e50357a39181da9bbbc8d84ade258b267f3d8facaf60c198622617951ac1aa3c5cb04ee787df9487c6d5138ca8a45fb227e8b55b69a31c0d9d0
MD5 SHA1 SHA512

Submit Download

init_c1.pid

Path /data/user/0/io.dcloud.H5D7DD228/files/init_c1.pid
Size 14B
SHA256 eb015efd2930208df90308090f5d0cab7c7e6c32022ba611317749d1d62c9611
MD5 8480a89a98376ec7a8d76698fa6c5b8b
SHA1 3434d426cdae23a5aeeab453b41f4bb6dd13cb48
SHA512 d6ad04f06f2e00405dcb89b48acdd8c51b17cbc20c32a840e9c73e8973c708df2978f9ab476750f57ef6fca3f1f88e1faa6edaeccdc6400e58bda6d19ed77166
MD5 SHA1 SHA512

Submit Download

umeng_it.cache

Path /data/user/0/io.dcloud.H5D7DD228/files/umeng_it.cache
Size 435B
SHA256 b1841381339a3ded509df4478edc7a3eec366c278bed0b3c0a9dba759ce79fa3
MD5 4e062845269bcf4d2afd23910005b16b
SHA1 04e65079e77807b187758f479907c8661990c875
SHA512 c6713cccf37bd16809931aa6e6e7728d50869349f71bc9692605d9014a407719a11aac2db02273e29d0d51131c46bea0722f1d72f56161814a30e716f7758356
MD5 SHA1 SHA512

Submit Download

ContextData.xml

Path /storage/emulated/0/.DataStorage/ContextData.xml
Size 111B
SHA256 ef28de20dbf27bbf95dc4dab6d42c0a1ffc06c9928ff0687e0d2594c80537e9e
MD5 b45b7c26e84d57c0d471f6e7b92eea43
SHA1 487495f0b0a3376f88bf1c36f9858b174ce71344
SHA512 ff65167499265df053afd74465b5cf1e0f8b5b7516f8b192cb3f8850416c72eb80d8e9dee82e5f5b224d15f17dc4aa060e90861701d3c72d59fdaa4b855271f6
MD5 SHA1 SHA512

Submit Download

Alvin2.xml

Path /storage/emulated/0/.UTSystemConfig/Global/Alvin2.xml
Size 408B
SHA256 abe28dce01ff2fdef3b88fe400392bbc974da90b44a66153ef00947781fbec79
MD5 cbd1edee57216517c883255bcb57d3ea
SHA1 444ea62ce8a1a4cb05f2b6ee61b6df0226703bda
SHA512 334e97670f1df0aca3fcca1b2101b34b5c9ccb2b8febe92c8ce4a07b360d0c638c6aa880036edd71ab7fc67d32a94aa899bb5ae86cb290f5ad275c4cd2211524
MD5 SHA1 SHA512

Submit Download

io.dcloud.H5D7DD228.bin

Path /storage/emulated/0/libs/io.dcloud.H5D7DD228.bin
Size 162B
SHA256 46d6bee06a912254fefa415602d48537b0e515e572e6556885209508beb0ae43
MD5 ae5f8cd835709141709ce4107b2a1064
SHA1 aa15f5fdf7c6cc79b6e2d2d51e698f396c87bd3f
SHA512 63973fc8d52fcc1763c25caff3d0c170b18854ce09e719d109d25961ea5736ef6947e78fa801c2b667b7d9369f28d375166c37a6add019c36c35b84eaad47512
MD5 SHA1 SHA512

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads