e27fa21948dc8ae84fd454dec0d75de57a7e9875a5b39fd43d6aad4c75902630

Analysis

max time kernel
4s
max time network
188s
platform
android_x64
resource
android-x64-20240603-en
resource tags

androidarch:x64arch:x86image:android-x64-20240603-enlocale:en-usos:android-10-x64system
submitted
04/06/2024, 20:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
com.qihoo.plugin.splash.apk
Size 670KB
Sample240604-yzfqcsag47
SHA256 b606f0029b8403132c706d3d31b02b8880ef951be7fdd9cff6cee04f7d15330f
MD5 dedfedd73b92b9f264e5244ab5d76fc1
SHA1 7da66f9ef927cfebc2c103d7454ce00bf00e7d31
SHA512 81c646fa27c1e5adb56e6e0895c2cae1af6b0398ac5590c170fffce0a3c88ca56439d911b600d2e231605bc4e6314c2c84636ed1b7f1a9b6d4ac4f55f5e0380e
SSDEEP 12288:N/IsDcayTTDKEMhuxi+gq6NMiB4rNrOSSqXDf61U6c5L9dZ+N/sT4IFAkvCfCb:5B6TDvMhv7q6NMNrNrOQuUdTkN/sT/24
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

banker discovery evasion persistence

Malware Config

Signatures

Loads dropped Dex/Jar 1 TTPs 1 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/com.qihoo.plugin.splash/files/torch/core/3.7/finalcore.jar	5151	com.qihoo.plugin.splash

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
banker discovery

Security Software Discovery
T1418.001
Queries the unique device ID (IMEI, MEID, IMSI) 1 TTPs
discovery

System Network Configuration Discovery
T1422
Reads information about phone network operator. 1 TTPs
discovery

System Network Configuration Discovery
T1422

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs

persistence

Broadcast Receivers

T1624.001

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	com.qihoo.plugin.splash

com.qihoo.plugin.splash
1⤵
- Loads dropped Dex/Jar
- Registers a broadcast receiver at runtime (usually for listening for system events)
PID:5151

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Credential Access

Discovery

Software Discovery

T1418

Security Software Discovery

T1418.001

System Network Configuration Discovery

T1422

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

finalcore.jar

Path /data/data/com.qihoo.plugin.splash/files/torch/core/3.7/finalcore.jar
Size 153KB
SHA256 79e1eee2d72cb40e0c931ed08e609891a41b0a2802d6e0b98abd7970238b4eee
MD5 bc3cb0eef1d19c47cf3f1a2211258aee
SHA1 7f10b763a43b6900cd9925b014c1a794994d37dd
SHA512 51f66294dbc34d4c618e2b16449c47f73734f1d5a57d2e40927ff5ab808604206fda84af29653cb9b018f30749e54a0a481e796cfc7b016a317ff7e83860df86
SSDEEP 3072:GYRLLNEK/MG/+UL3TMPAi7GGawe/JchKfbNewyfVF4BTP7rLqchL:GYLLNEkMG/+g27GGze/JSi5IuHLBL
MD5 SHA1 SHA512 SSDEEP

Submit Download

core_update

Path /data/data/com.qihoo.plugin.splash/files/torch/single/core_update
Size 13B
SHA256 733f1f4919033c0a9cf848bbd62af7bdc448ce8146bfaa6abe2fba06fda88fa1
MD5 d12171a13ccc569d9d5a28fec8e937e8
SHA1 49b55c6637f44904fb5d970f19df01f412d11690
SHA512 bab8b8563d27345314e9c2cc3a6a1ecd895ebb9e879d0c77ad02f46243dbe5f07e83445bde9c0876366a7617380a661e03120d65c37c6c5bac63ea63f44c7824
MD5 SHA1 SHA512

Submit Download

profile_task

Path /data/data/com.qihoo.plugin.splash/files/torch/single/profile_task
Size 13B
SHA256 df283bdd6fe2e3eac04aade900e2ebb55a038b225aeb484876f6a3ca1f885379
MD5 bae1b4a68baa426075b7b2e063320745
SHA1 e9f37cf32b3ce67adfae18fd51077d9ad31f5f05
SHA512 4a13276ff7e000baac7122c5842e637d3791a4b5f75978a36b4e8a0f11a6095e18b7316d35489f8ba62f12c581e2f12218976252fc75fcf18cd6ffb4a720ba40
MD5 SHA1 SHA512

Submit Download

waitingDown

Path /data/data/com.qihoo.plugin.splash/files/torch/single/waitingDown
Size 13B
SHA256 07dbff0ce0416c1d6d64d1e533414e64762a0b70e21e82b9d49cc2cd33776071
MD5 7be1bc01db615a198d0b5c6d99cb0e76
SHA1 421cd62e166da27d66677294b506c736a3c9c625
SHA512 aa602623b2e7f1bb0031316b53ed65025b471efe771bf515f9bbb24ba0cda9e3bd739d1bb381f311e8fff942aef0ae968fe6fce07c811e2823ebfbb7e897c306
MD5 SHA1 SHA512

Submit Download

finalcore.jar

Path /data/user/0/com.qihoo.plugin.splash/files/torch/core/3.7/finalcore.jar
Size 346KB
SHA256 d482194392c58bab488d65622c27be7a91f673d1c3398e9dcfcfc015f20ce7eb
MD5 7ca872b45694937f04aca732b336950c
SHA1 762652d725c00e27a3a9316322fb0049b154cf45
SHA512 260b9bf7a17e0e71cc5e05d447c578c062c80dfe35b27c658bda6c3071a30a1649e2181f287d0f3823d34f99aab604fb8b520da7cd9e1f9ce7b6552d5897fbf9
SSDEEP 3072:8fcr1NhMo6PtC2GdpKRKLpTpUQGtfOjibyKkW+8HSTJ8QRHXvCcxGJTzlmRPbErT:8kL+GLpTCQGtfIOVSTJ/f6lmR4go3Z3l
MD5 SHA1 SHA512 SSDEEP

Download

.sfp

Path /storage/emulated/0/Android/data/com.qihoo.plugin.splash/files/.sfp/.sfp
Size 83B
SHA256 78f54b0da43d73669c8327a9056c98f31486babb35649a6902bee9dce2295ba8
MD5 f6f33cc680c5307f2df03e613e286c4d
SHA1 a5138b46000ab99b332a6876bb03e1c616f77b04
SHA512 b2b6c20661cd4fff6d96658015fda8031602ac1d93cc16472d6e1b632b5bcb76c2812d33e74200f93eb59df1a95378941911de62f29ee26b910650048d52fbe0
MD5 SHA1 SHA512

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads