Resubmissions

13-06-2024 23:42

240613-3qcpkazbqk 8

13-06-2024 23:38

240613-3mwm9szapp 8

Analysis

  • max time kernel
    11s
  • max time network
    1847s
  • platform
    android_x64
  • resource
    android-x64-arm64-20240611.1-en
  • resource tags

    androidarch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20240611.1-enlocale:en-usos:android-11-x64system
  • submitted
    13-06-2024 23:38

General

  • Target

    Shopee PH_ Shop this 6.6-7.7_3.27.09_APKPure.apk

  • Size

    229.1MB

  • MD5

    c0982b9a45d3249372a069f35c530d48

  • SHA1

    211e6c454f7adf9f0b7547f4b35ec30cf3b544e9

  • SHA256

    7031ff31e01ff7edce3f830ef6bd2e83606b4c1898264d4e16261c663042bc2c

  • SHA512

    38144db25fe4fc3a4d9986e40f9eed52016366ffa0f14e1bdc99f484fca721d2399e0e93d9720703d8a997039d6553e56cd05ef79923884c5aaac385d3e5648c

  • SSDEEP

    6291456:om+xTdJkhc+TpYke9WREzFN5GHN+RppFX08ym7sHP5KOV95q6G+0Ma:oZdJkbpYkeoS5+MrX08QHXvGt

Malware Config

Signatures

  • Checks if the Android device is rooted. 1 TTPs 4 IoCs
  • Checks Android system properties for emulator presence. 1 TTPs 2 IoCs
  • Checks known Qemu pipes. 1 TTPs 2 IoCs

    Checks for known pipes used by the Android emulator to communicate with the host.

  • Loads dropped Dex/Jar 1 TTPs 4 IoCs

    Runs executable file dropped to the device during analysis.

  • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
  • Queries information about running processes on the device 1 TTPs 1 IoCs

    Application may abuse the framework's APIs to collect information about running processes on the device.

  • Acquires the wake lock 1 IoCs
  • Queries information about active data network 1 TTPs 1 IoCs
  • Queries the mobile country code (MCC) 1 TTPs 1 IoCs
  • Checks the presence of a debugger
  • Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
  • Checks CPU information 2 TTPs 1 IoCs
  • Checks memory information 2 TTPs 1 IoCs

Processes

  • com.shopee.ph
    1⤵
    • Checks if the Android device is rooted.
    • Checks Android system properties for emulator presence.
    • Checks known Qemu pipes.
    • Loads dropped Dex/Jar
    • Queries information about running processes on the device
    • Acquires the wake lock
    • Queries information about active data network
    • Queries the mobile country code (MCC)
    • Uses Crypto APIs (Might try to encrypt user data)
    • Checks CPU information
    • Checks memory information
    PID:4599

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/data/com.shopee.ph/app_lib/libanr.so
    Filesize

    474KB

    MD5

    03f0f12cbbad7a0e9219e61b1b34cc9f

    SHA1

    e5d432d96266a8e7af4d7ed95099bfe016e12888

    SHA256

    582d541baa36451d0dfcb3a07a251932af89e5666ceb0a0be0cfbfd32408b865

    SHA512

    b8f92ca8f9f40025ce8ebb43e713a401a8a707126b5e6705484f630863b8fb2f080354750c249e7be4132c265447aec81ae4fe322885c171986816e6b6b16d67

  • /data/data/com.shopee.ph/app_lib/liblinker.so
    Filesize

    224KB

    MD5

    f24b6640d8bd2ffe4df2640fdb51fc1c

    SHA1

    24c227a29a3f8f8f0aa5c32ec3a04e2f0599f6c0

    SHA256

    3aa0d85b973388020679dad367346516bf700b4cfc049442001d7d6620b43523

    SHA512

    15530285ed5e85c7c419e47677504f34f3dc4dfa70fd508ddf76407c1f50feee76241e5bebbca36474f780d454b4a5e609e9c9b5212b3bcc8018c3b0d65e50a1

  • /data/data/com.shopee.ph/app_lib/liblogger.so
    Filesize

    4KB

    MD5

    f94477401e38f147bfcdc6f4b0f033e5

    SHA1

    97649c4993b15b8ee625c38f168cdf1232cf4d96

    SHA256

    072c76895bc5a47411339f837e46222e50753df173097bf82527bd43c1d5135b

    SHA512

    3c4389fd91d1a2924ad75c980d2d687162c0404b0c26546d9cb7e044e6df732f37743fd310427a433d8c4d8e66593925c62ce05632965447a9092c286b5f2b80

  • /data/data/com.shopee.ph/app_lib/libnative-crash.so
    Filesize

    202KB

    MD5

    b93387dfa188e576b03ed005011ec2f2

    SHA1

    15cbdb3b9b297592a74c01d81dc00df2cb75955f

    SHA256

    f4d78a2b9d075fcaeebf71c95d1c3168ecb016ff187e284ac9b5225bb7397e41

    SHA512

    2e1185af6f3e742acb03e7a444445f68b3c63235bd5c1e8bf68fded05f89b1e580cf2af98ea048c575f16f9c52d58491287bff4b9e072ed480f7a28d0e3e5310

  • /data/data/com.shopee.ph/app_lib/libreflect.so
    Filesize

    8KB

    MD5

    630f6b46ea5963da0395a96b56b7367b

    SHA1

    dc9083c07cf5dd1a66b4ce74ff6c486242528ec3

    SHA256

    490cb17ee12b34564a2095364bb7ebdb646327b4f17f6ec0c89ade4ddaf537a7

    SHA512

    ec7a18cd4556094bdc28e28ec61620f67bf13962ff5d9e30d0584e57f6a88d83af1626566e158b7b215de06baa015cbe2f4cc3414ae31048ad23c9ce84a6b7ee

  • /data/data/com.shopee.ph/code_cache/1718322287880.dex
    Filesize

    1KB

    MD5

    fa5e92b1f73ce6e1facb5332bf8c1987

    SHA1

    34875178c9fa31fc1c08cf9bdc98ef176e48150f

    SHA256

    3a4e3fe970ca8edf51ecf101145c32e8c5d21f75b10e28406fc016835f86421b

    SHA512

    25f13ff1a648d98ee8183f73398afa888b1b9ad8956e5555df6ccd8b808dc7d42cf788db1e43494ab71d61d260dbf26aecb7b403f94dff1232c7620c4d19a119

  • /data/data/com.shopee.ph/databases/DBFriends0.db
    Filesize

    12KB

    MD5

    e105141809c0a21098c305e15329628a

    SHA1

    a474ec57e58b424b64f825de1a832687df0f5d16

    SHA256

    6aaf498622e24ae5a2b0ee6d4936d9b9113de2e5a65b553111cbb3289345395f

    SHA512

    36abaeff75128ecdfac3f6eba452077cf43193583641c2ce28cc2a092fb38f458bae26184591e2e5877c9555f2a745f831edc714872652e2d996a80260c0c964

  • /data/data/com.shopee.ph/databases/DBFriends0.db-journal
    Filesize

    512B

    MD5

    b8889840f9e64e255c44cb7a0d55246f

    SHA1

    5c4fab589cd7be304de0bc9b7238195261497019

    SHA256

    e3fc4d00c0f875fa6b8ff526ac434907851eedbb6d98a763a79417d21b64076e

    SHA512

    19e84c47fef8b2c9561c68d6382a51a3254457f78849ce11b22d9d79799e21e56bd754c4ef4570ac3db8536660a34ca41c35f15e6aa69f670d2c2ba347af99df

  • /data/data/com.shopee.ph/databases/DBFriends0.db-journal
    Filesize

    8KB

    MD5

    0067de25111354f9bd6ee91120ebc498

    SHA1

    e8df78e740bbf7637fe57246cfbb964812a52d61

    SHA256

    dda30c5e7c1c4fe1a72528625de0c58951048697f6cea409326326517502200c

    SHA512

    6447612f1eedad9effaf3efe85821313d276ce55064b603ba3d2408e8584f4632ad58814d1d33a320fa67e847494f1e66ef3ba50a1e05771ebf04a2337d4cae2

  • /data/data/com.shopee.ph/databases/DBFriends0.db-journal
    Filesize

    8KB

    MD5

    cc495b245da5aa3d82f27e097bb11a08

    SHA1

    bffdd706fa5c640965b032a8fcd63feb72074bee

    SHA256

    3b14e4bc5b72a909c46fbc9fea48da080f26de2050acefc11d5cebe4fae402ed

    SHA512

    855c71e83e2b92e3bb2f202881652013672be80f831078934458c3f4837839b1b0e2429e85e59b3a74f5efc8135cef29adbc8e8b7e0c1e2eab787e14ea52f356

  • /data/data/com.shopee.ph/databases/Shopee0.db
    Filesize

    12KB

    MD5

    f41f531c07d4141546a531ff9caffdcd

    SHA1

    9dcac5aed06972d0ff6bd4cc1f1cdff85b36d3f5

    SHA256

    bb8dee5b5c3779f175abbd142722eb0022b98d374783aa80145b34614a4de646

    SHA512

    e0c8d1a820cb4c098e45776e8b50ea8c83944ef2e3f005cb0acbfc07688974d370f78100ae022f62564fc4c12acfdc43b710c18ca1c30f4f575bc08b9b12d2d4

  • /data/data/com.shopee.ph/databases/Shopee0.db-journal
    Filesize

    512B

    MD5

    e9bc3b59d70329b26114d2281f6e59b5

    SHA1

    8878382606e99b0918388f315f541d869fe97666

    SHA256

    2939ece00500b11f35c86075e40e7163c3fb92262ed65ceac949802e392f039f

    SHA512

    87bae886b9f99a11a1cd5c1f8d6ae8f16effcc34af3a08b02c017820eb2efdf4ec7781833276d60153c1c30e7b4005cd5e4c8d97a4e117b868a5ac874f4a7acc

  • /data/data/com.shopee.ph/databases/com.google.android.datatransport.events
    Filesize

    56KB

    MD5

    7a334bdc909b762470f847925ad4b656

    SHA1

    44c5ca979f71eba9021fd9e779a19602ec44760f

    SHA256

    60dd1d67de3f76a0d3e9bfc5d80d8536cf352b8a5cbb811a7e661564131c5f1e

    SHA512

    f287f47ed51a7acabd96ed50b61988335f829a5c1acdf07076734d1267245abdd24860e7abdb74283c48061578c7d8304606b85030235218799b17a5b92c80be

  • /data/data/com.shopee.ph/databases/com.google.android.datatransport.events-journal
    Filesize

    512B

    MD5

    2b702dc763599f630d86279e8c4225cd

    SHA1

    dedc7522b9a62e04fc96162375cb70ad2ebcc538

    SHA256

    e076b9da059289447342c89532b515247090d148a8fa8afc4e67d2950cff3c1a

    SHA512

    08e09dfc38e6e8bb67376e6af3b675d85ad1e7616a692146720844a48317b2709061d41464f424d4ddc5833819085c9c51e5b06bcd016a3e0a4326852a03437b

  • /data/data/com.shopee.ph/databases/com.google.android.datatransport.events-journal
    Filesize

    8KB

    MD5

    5ee4d19296a1e0824e70cf973d4cb69c

    SHA1

    149e2e2b5fece1ebe604d0ecb6a21bcf643693b3

    SHA256

    cf872003b88de3d13c9a2258e0eb6cc18cf368b1a481aa750f058e2347d66290

    SHA512

    b5e34d029580e8fc239f9d11434870258a73e21667962dce2e55b5144f9b9a5961dbee7a0f78a35531fe343ef1cab43f9992e2d1a158f9d43ac7d96dab8064cc

  • /data/data/com.shopee.ph/databases/com.google.android.datatransport.events-journal
    Filesize

    8KB

    MD5

    797f5ccbf09aeda7852805df7c2a139e

    SHA1

    b5891e9a68d2cdb9f45cbafe2bab7c90843328cb

    SHA256

    4c80610826988da0960f5f21fc5d790b968a0300f0c51802f6df493fc150834b

    SHA512

    1b887ab0538b400b5cafe9facdd2ce36d651c3e5a26555ca70e6f92359a2ea4de0174eabff5ed64f5afecb13cc19f81761db3525fc96d2325dd832392c11ec0c

  • /data/data/com.shopee.ph/files/.com.google.firebase.crashlytics.files.v2:com.shopee.ph/open-sessions/666B84700364000111F7222E6967E5DE/keys
    Filesize

    20B

    MD5

    823ba33345e62ae0e141d3fb50f75e93

    SHA1

    54b7531f7dd8d6cc4fd0e1e1747597dd3e799451

    SHA256

    96057ae10356636c0a20a5241898bbd96d73b8c42cd42dd2ee00e6d2ca658768

    SHA512

    d20b50b62018516127bf6d0771339d1a33c4dcbc7d0d8e927a3119687574fbfeeb6840da31f8e9e476d150c6df6e6b98e22470d475b408efa40eed31e83ff440

  • /data/data/com.shopee.ph/files/.com.google.firebase.crashlytics.files.v2:com.shopee.ph/open-sessions/666B84700364000111F7222E6967E5DE/keys
    Filesize

    55B

    MD5

    886f61bb85ea16205ed7a890647190ee

    SHA1

    272a60fabc46ee6b8702f74ba8e873171ef32a5e

    SHA256

    7b81acefda180ce9dd6c7dd995fd111f2676020505a8c542c0fc904118049f22

    SHA512

    0ce87687fc76a75f7efb5158979804248a7f0cc2b10515c2e8f76b60b6650e9fb95824af5e70afd5a151a48a5b950048467d4587e494c37c3b2d693fd17d8091

  • /data/data/com.shopee.ph/files/.com.google.firebase.crashlytics.files.v2:com.shopee.ph/open-sessions/666B84700364000111F7222E6967E5DE/keys
    Filesize

    77B

    MD5

    8a9f306794cfb4f185b3d535ea8e7137

    SHA1

    e7aa8d38d23ec361a094176fba533556f87dcb28

    SHA256

    b22d6759ddd25765ac3fb4196cd7a508b3d51ddafaa25b2b1141dd3058d71a88

    SHA512

    bb5cdecd3ff696de6ee5114fe69d7b1d6f32045335826528010c176721eead473ee6a4d52e03b3c5ab0a816ecd75a6b5e6ec7049198cca73f03d2b97a6b2d01e

  • /data/data/com.shopee.ph/files/.com.google.firebase.crashlytics.files.v2:com.shopee.ph/open-sessions/666B84700364000111F7222E6967E5DE/keys
    Filesize

    317B

    MD5

    f5053b57a53500132bf9e41bee97edbd

    SHA1

    110646614f51b4db9929efb5d19e7cc9929cc7ac

    SHA256

    2ae9212df373513cb88f2b40832231ef6ccd2a23c38c08db59f6af12539ddcd9

    SHA512

    06d0df2e2867c2852f7cd55a8e6b9ec834337fd4fa04d7470ce5c0262ee40e28324ac4369900ae6e00147c77721185367a8141fb1c0c83a0700782b7a37f46fd

  • /data/data/com.shopee.ph/files/.com.google.firebase.crashlytics.files.v2:com.shopee.ph/open-sessions/666B84700364000111F7222E6967E5DE/keys
    Filesize

    339B

    MD5

    614b3ea92bb1b4f8e9e13e098df3cf1f

    SHA1

    3894120efa39b799fe0cc09bda791e86c0068993

    SHA256

    8149ebe013ca378529663f872bcb346a088554b82dc08b7dac055020cf8d4541

    SHA512

    c906d2f8cf47c3773505434292e44a7a183543340171c7ccceef110f58e72e54527663ae78954c533fa81ddeebcf06a4e59473c53e9571dad81fb2e1b3d44d67

  • /data/data/com.shopee.ph/files/.com.google.firebase.crashlytics.files.v2:com.shopee.ph/open-sessions/666B84700364000111F7222E6967E5DE/report
    Filesize

    778B

    MD5

    c34ccc9bb5a1f2eb625846dc6ae4e23f

    SHA1

    57a09f7b22ab366c0452ce1d39edfa86e6ff6018

    SHA256

    f581588d98c7e408952c6a02d26716bbce2679af96eab59ac5c62136617a69cf

    SHA512

    4b414e497de2fdc84f0c5931bff0849e9a7c8220e7a3dfd8ff8770526f951712fc254167e9892c87d6a18ceeb57dbf41b51e073937d078117ca3e25223027375

  • /data/data/com.shopee.ph/files/PersistedInstallation6553983656565836501tmp
    Filesize

    90B

    MD5

    c426093d1a40fc1083b2885a7f8d483c

    SHA1

    714cd28bbf8f257d9c5af540432cd536ce332ba7

    SHA256

    aba088ed03b05e8a508934cadbe34c336a14502d599c850eff6a629e56d0c3e6

    SHA512

    e3e423cc001c3d4fee8fc9c4de5719aecb7b83c0cce30f0ae0e30498fb901e1bb1b973566389034852bea98980b009f6344797d7354c7f639018a60bf578b3a2

  • /data/data/com.shopee.ph/files/mmkv/alpha_launch_config
    Filesize

    4KB

    MD5

    620f0b67a91f7f74151bc5be745b7110

    SHA1

    1ceaf73df40e531df3bfb26b4fb7cd95fb7bff1d

    SHA256

    ad7facb2586fc6e966c004d7d1d16b024f5805ff7cb47c7a85dabd8b48892ca7

    SHA512

    2d23913d3759ef01704a86b4bee3ac8a29002313ecc98a7424425a78170f219577822fd77e4ae96313547696ad7d5949b58e12d5063ef2ee063b595740a3a12d

  • /data/data/com.shopee.ph/files/shopeePH/com.shopee.app.application.ShopeeApplication/sp_xlogs-cache/shopee.mmap3
    Filesize

    150KB

    MD5

    06ae8a01d80da962c7987c264af64cec

    SHA1

    63a497994321f254b535a846ce89f076d4e378ee

    SHA256

    0c5cc90b079d0d9c1ded1376357d23a9782a704a83e01731f50ccd162e246492

    SHA512

    8720928fbe7cf8351c9dc45cb1a9c8243939c7e3c9c6957d24dbe18c0819d05ea7475e3953018f0365461fb2987ad68d8ec9f59b03aef3adbd3e4ae8ebbd0427

  • /data/data/com.shopee.ph/no_backup/androidx.work.workdb
    Filesize

    4KB

    MD5

    7e858c4054eb00fcddc653a04e5cd1c6

    SHA1

    2e056bf31a8d78df136f02a62afeeca77f4faccf

    SHA256

    9010186c5c083155a45673017d1e31c2a178e63cc15a57bbffde4d1956a23dad

    SHA512

    d0c7a120940c8e637d5566ef179d01eff88a2c2650afda69ad2a46aad76533eaace192028bba3d60407b4e34a950e7560f95d9f9b8eebe361ef62897d88b30cb

  • /data/data/com.shopee.ph/no_backup/androidx.work.workdb-journal
    Filesize

    512B

    MD5

    adbff8a710bbbb3cf038d4b9f27faec4

    SHA1

    32d6827338694a6d37945825363a5eec0d4701a4

    SHA256

    b0dc8028ad28b0c3b5a795fd956912153f03485b91be46ffccfd5dec4dabdc7d

    SHA512

    fea80a067ada487c2b6e0abe4841434cb8c32ee54311c29b72d8705c4daaa825a0a444303773c5e28ac454db0bcc0680041967ad2dd4d538495c1a698d4614e2

  • /data/data/com.shopee.ph/no_backup/androidx.work.workdb-shm
    Filesize

    32KB

    MD5

    bb7df04e1b0a2570657527a7e108ae23

    SHA1

    5188431849b4613152fd7bdba6a3ff0a4fd6424b

    SHA256

    c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479

    SHA512

    768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

  • /data/data/com.shopee.ph/no_backup/androidx.work.workdb-wal
    Filesize

    16KB

    MD5

    84c9d8eaf45d6b560ca88b3297553b70

    SHA1

    f873eedd0f270fe1645c7f982e3ddc6719c0d783

    SHA256

    ed497d195471850def59afe0ac84c466a4b5a33cae456fdac264650a90a90930

    SHA512

    2c470164ad52b6429e02deccc211ced84ca439d54649b1be9fcd7c88281a4409dc0feb8e45648e9c7462e915cff1846f03a8a2a59f765eecdbb410abec317c4f

  • /data/data/com.shopee.ph/no_backup/androidx.work.workdb-wal
    Filesize

    108KB

    MD5

    4ead708840b21c067180ba3e5eb9873f

    SHA1

    5f81b4bf997e7101a2c1134d65f74e4c4a15eed3

    SHA256

    f07d1a0fc533db535a04d05b5428e043e5640e3c907d4f18a99491397a9e48b0

    SHA512

    74385610fcb8270ab50a9d05b3b63ad0b9e2929391561d04f759b775237ccd33ab40aa99e02dc5dbbb4ba5222073957808db911cebdf1e3092601d768cbdca37

  • /storage/emulated/0/Android/data/com.shopee.ph/files/anr/portal_info_stub.txt
    Filesize

    77KB

    MD5

    d54e96fb46cf7cecf8b3d91477e4ecfb

    SHA1

    5fc3a5d6f7b9f5e4be462bb5649312060c0dc4e2

    SHA256

    96fb384729e12be61eb8aecf12655327a4433335dd289d1d7086df0cbb9c7d75

    SHA512

    aefe7d09ca47938f0b6bdfa23f2eb719e259372903f316bc04162b4f09f178358cfe9bfd2294f27170529a0a4635855f73fb3115d2fc4dd2a01d753dce6fba0d

  • /storage/emulated/0/Android/data/com.shopee.ph/files/szlog/logs_sz_20240613.csv (deleted)
    Filesize

    4KB

    MD5

    b09b24dd3d91ea4f67dc2ec1b507e000

    SHA1

    a57240d386620e0fe8cea44e4f12d643c8529cbb

    SHA256

    14f52b83033761204e080b1393132fee7c93134648d765ea55ab7129108955fa

    SHA512

    e28a8966a6d713808393553d6509099e00058b2c0245ab9c2f4722ea932e96921ec65dd32dc4e265f3b5b2562d113b3fcb5ed7be36011351cd5c018e01563567

  • /storage/emulated/0/Android/data/com.shopee.ph/files/web/cache/journal.tmp (deleted)
    Filesize

    31B

    MD5

    d6ac8c8db0504502d7f0e057a78c5ce3

    SHA1

    8f4cf91a262b24ec9c1a6e7c41fd6d16b6623bb4

    SHA256

    8f22a32cd8de58916041d1097976f2b9c80f7e9a18593d5a6b058bcaed17e22a

    SHA512

    100e74f0c65b51a17de6eeff96d5c38bd6d40e3c8ee00094fd906ba5794088fe1ad6f3a15be196480384cf01399ea26665a05471404f1eeebb0c82ae6fb104bb

  • /storage/emulated/0/Android/data/com.shopee.ph/files/web/dfdata (deleted)
    Filesize

    33B

    MD5

    7d8aa4c9e31b8d5ce598fea3ada5b770

    SHA1

    c426691d5135752d79b7050b5d4d5abcbafd12ee

    SHA256

    f5e47b78513b33118c07b1efecccda3a6dbd6ccbafb549c2b23d28767f15c3fa

    SHA512

    e17d6f23db068b27379f31ca15a10e28865fe1dc0aea5c788fb34b7d4fbab3f7fcb41821ccb63714392c91a8716fc781c96006a09a73d6264aba1e43cab98522

  • /system_ext/framework/androidx.window.sidecar.jar
    Filesize

    12KB

    MD5

    bdf3529e80318eb14e53a5bf3720c10d

    SHA1

    25c9ace4b1af6e80ebb2572345972c56505969ba

    SHA256

    bbc8300dd1e9cd08de8f66560c1ac2c928615b72b51cef9649f88974f586d64b

    SHA512

    48b9c2d01171bb651b9b54826baa51f4add48431a3efd8ceb5f7cc3bcd6f8f37edf47fabb24349dd15b3a02329cd450f90a8d164bf4f8dfae554bf3b35a8a55b