679b9c419e4c72f51149e8b94f5e387977ac79081c2b27ad1c1964333307a26b

Analysis

max time kernel
2s
max time network
132s
platform
android_x86
resource
android-x86-arm-20240611-en
resource tags

androidarch:armarch:x86image:android-x86-arm-20240611-enlocale:en-usos:android-9-x86system
submitted
11/06/2024, 15:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
alipay_plugin.apk
Size 354KB
Sample240611-sdnaes1gpj
SHA256 e86f24838e0aa5527adf3d129652bf70b67990989bf7e8c8d61c3356231ce1ac
MD5 7b3353b143078dbafd37485f8136728e
SHA1 f2d312754bb2c4854849381997561d09a90b4fb9
SHA512 0f326957abeebaed130da1f6ec7a53de5dd9671d6ae7d975f2b6172af4c323df81efd0f6d4b8a1e4197d5dd35d4419c658f1c936a404bbf9d7e73ee71a5e06f8
SSDEEP 6144:Iv8DL7okgHi/BBs3dWcfihtB7+Y3Ju4g2Tf5C8EcPK+WvyQcy2fny43:Iv67gC/BBsNWfh3VcG5CLE8Rcy2fny43
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

collection discovery evasion

Malware Config

Signatures

Requests cell location 2 TTPs 1 IoCs

Uses Android APIs to to get current cell location.

collection discovery evasion

Location Tracking

T1430

Geofencing

T1627.001

description	ioc	Process
Framework service call	com.android.internal.telephony.ITelephony.getCellLocation	com.alipay.android.app

Queries information about active data network 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.alipay.android.app

Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.wifi.IWifiManager.getConnectionInfo	com.alipay.android.app

com.alipay.android.app
1⤵
- Requests cell location
- Queries information about active data network
- Queries information about the current Wi-Fi connection
PID:4305

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Execution Guardrails

T1627

Geofencing

T1627.001

Credential Access

Discovery

Location Tracking

T1430

System Network Connections Discovery

T1421

Lateral Movement

Collection

Location Tracking

T1430

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads