Analysis
-
max time kernel
11s -
max time network
1847s -
platform
android_x64 -
resource
android-x64-arm64-20240611.1-en -
resource tags
androidarch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20240611.1-enlocale:en-usos:android-11-x64system -
submitted
13-06-2024 23:38
Static task
static1
Behavioral task
behavioral1
Sample
Shopee PH_ Shop this 6.6-7.7_3.27.09_APKPure.apk
Resource
android-x86-arm-20240611.1-en
General
-
Target
Shopee PH_ Shop this 6.6-7.7_3.27.09_APKPure.apk
-
Size
229.1MB
-
MD5
c0982b9a45d3249372a069f35c530d48
-
SHA1
211e6c454f7adf9f0b7547f4b35ec30cf3b544e9
-
SHA256
7031ff31e01ff7edce3f830ef6bd2e83606b4c1898264d4e16261c663042bc2c
-
SHA512
38144db25fe4fc3a4d9986e40f9eed52016366ffa0f14e1bdc99f484fca721d2399e0e93d9720703d8a997039d6553e56cd05ef79923884c5aaac385d3e5648c
-
SSDEEP
6291456:om+xTdJkhc+TpYke9WREzFN5GHN+RppFX08ym7sHP5KOV95q6G+0Ma:oZdJkbpYkeoS5+MrX08QHXvGt
Malware Config
Signatures
-
Checks if the Android device is rooted. 1 TTPs 4 IoCs
Processes:
com.shopee.phioc process /system/xbin/su com.shopee.ph /system/app/Superuser.apk com.shopee.ph /sbin/su com.shopee.ph /system/bin/su com.shopee.ph -
Checks Android system properties for emulator presence. 1 TTPs 2 IoCs
Processes:
com.shopee.phdescription ioc process Accessed system property key: ro.product.model com.shopee.ph Accessed system property key: ro.serialno com.shopee.ph -
Checks known Qemu pipes. 1 TTPs 2 IoCs
Checks for known pipes used by the Android emulator to communicate with the host.
Processes:
com.shopee.phioc process /dev/socket/qemud com.shopee.ph /dev/qemu_pipe com.shopee.ph -
Loads dropped Dex/Jar 1 TTPs 4 IoCs
Runs executable file dropped to the device during analysis.
Processes:
com.shopee.phioc pid process /system_ext/framework/androidx.window.sidecar.jar 4599 com.shopee.ph /system_ext/framework/androidx.window.sidecar.jar 4599 com.shopee.ph /data/user/0/com.shopee.ph/code_cache/1718322287880.dex 4599 com.shopee.ph /data/user/0/com.shopee.ph/code_cache/1718322287880.dex 4599 com.shopee.ph -
Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
-
Queries information about running processes on the device 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about running processes on the device.
Processes:
com.shopee.phdescription ioc process Framework service call android.app.IActivityManager.getRunningAppProcesses com.shopee.ph -
Acquires the wake lock 1 IoCs
Processes:
com.shopee.phdescription ioc process Framework service call android.os.IPowerManager.acquireWakeLock com.shopee.ph -
Queries information about active data network 1 TTPs 1 IoCs
Processes:
com.shopee.phdescription ioc process Framework service call android.net.IConnectivityManager.getActiveNetworkInfo com.shopee.ph -
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
Processes:
com.shopee.phdescription ioc process Framework service call com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone com.shopee.ph -
Checks the presence of a debugger
-
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
Processes:
com.shopee.phdescription ioc process Framework API call javax.crypto.Cipher.doFinal com.shopee.ph -
Checks CPU information 2 TTPs 1 IoCs
-
Checks memory information 2 TTPs 1 IoCs
Processes
-
com.shopee.ph1⤵
- Checks if the Android device is rooted.
- Checks Android system properties for emulator presence.
- Checks known Qemu pipes.
- Loads dropped Dex/Jar
- Queries information about running processes on the device
- Acquires the wake lock
- Queries information about active data network
- Queries the mobile country code (MCC)
- Uses Crypto APIs (Might try to encrypt user data)
- Checks CPU information
- Checks memory information
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
/data/data/com.shopee.ph/app_lib/libanr.soFilesize
474KB
MD503f0f12cbbad7a0e9219e61b1b34cc9f
SHA1e5d432d96266a8e7af4d7ed95099bfe016e12888
SHA256582d541baa36451d0dfcb3a07a251932af89e5666ceb0a0be0cfbfd32408b865
SHA512b8f92ca8f9f40025ce8ebb43e713a401a8a707126b5e6705484f630863b8fb2f080354750c249e7be4132c265447aec81ae4fe322885c171986816e6b6b16d67
-
/data/data/com.shopee.ph/app_lib/liblinker.soFilesize
224KB
MD5f24b6640d8bd2ffe4df2640fdb51fc1c
SHA124c227a29a3f8f8f0aa5c32ec3a04e2f0599f6c0
SHA2563aa0d85b973388020679dad367346516bf700b4cfc049442001d7d6620b43523
SHA51215530285ed5e85c7c419e47677504f34f3dc4dfa70fd508ddf76407c1f50feee76241e5bebbca36474f780d454b4a5e609e9c9b5212b3bcc8018c3b0d65e50a1
-
/data/data/com.shopee.ph/app_lib/liblogger.soFilesize
4KB
MD5f94477401e38f147bfcdc6f4b0f033e5
SHA197649c4993b15b8ee625c38f168cdf1232cf4d96
SHA256072c76895bc5a47411339f837e46222e50753df173097bf82527bd43c1d5135b
SHA5123c4389fd91d1a2924ad75c980d2d687162c0404b0c26546d9cb7e044e6df732f37743fd310427a433d8c4d8e66593925c62ce05632965447a9092c286b5f2b80
-
/data/data/com.shopee.ph/app_lib/libnative-crash.soFilesize
202KB
MD5b93387dfa188e576b03ed005011ec2f2
SHA115cbdb3b9b297592a74c01d81dc00df2cb75955f
SHA256f4d78a2b9d075fcaeebf71c95d1c3168ecb016ff187e284ac9b5225bb7397e41
SHA5122e1185af6f3e742acb03e7a444445f68b3c63235bd5c1e8bf68fded05f89b1e580cf2af98ea048c575f16f9c52d58491287bff4b9e072ed480f7a28d0e3e5310
-
/data/data/com.shopee.ph/app_lib/libreflect.soFilesize
8KB
MD5630f6b46ea5963da0395a96b56b7367b
SHA1dc9083c07cf5dd1a66b4ce74ff6c486242528ec3
SHA256490cb17ee12b34564a2095364bb7ebdb646327b4f17f6ec0c89ade4ddaf537a7
SHA512ec7a18cd4556094bdc28e28ec61620f67bf13962ff5d9e30d0584e57f6a88d83af1626566e158b7b215de06baa015cbe2f4cc3414ae31048ad23c9ce84a6b7ee
-
/data/data/com.shopee.ph/code_cache/1718322287880.dexFilesize
1KB
MD5fa5e92b1f73ce6e1facb5332bf8c1987
SHA134875178c9fa31fc1c08cf9bdc98ef176e48150f
SHA2563a4e3fe970ca8edf51ecf101145c32e8c5d21f75b10e28406fc016835f86421b
SHA51225f13ff1a648d98ee8183f73398afa888b1b9ad8956e5555df6ccd8b808dc7d42cf788db1e43494ab71d61d260dbf26aecb7b403f94dff1232c7620c4d19a119
-
/data/data/com.shopee.ph/databases/DBFriends0.dbFilesize
12KB
MD5e105141809c0a21098c305e15329628a
SHA1a474ec57e58b424b64f825de1a832687df0f5d16
SHA2566aaf498622e24ae5a2b0ee6d4936d9b9113de2e5a65b553111cbb3289345395f
SHA51236abaeff75128ecdfac3f6eba452077cf43193583641c2ce28cc2a092fb38f458bae26184591e2e5877c9555f2a745f831edc714872652e2d996a80260c0c964
-
/data/data/com.shopee.ph/databases/DBFriends0.db-journalFilesize
512B
MD5b8889840f9e64e255c44cb7a0d55246f
SHA15c4fab589cd7be304de0bc9b7238195261497019
SHA256e3fc4d00c0f875fa6b8ff526ac434907851eedbb6d98a763a79417d21b64076e
SHA51219e84c47fef8b2c9561c68d6382a51a3254457f78849ce11b22d9d79799e21e56bd754c4ef4570ac3db8536660a34ca41c35f15e6aa69f670d2c2ba347af99df
-
/data/data/com.shopee.ph/databases/DBFriends0.db-journalFilesize
8KB
MD50067de25111354f9bd6ee91120ebc498
SHA1e8df78e740bbf7637fe57246cfbb964812a52d61
SHA256dda30c5e7c1c4fe1a72528625de0c58951048697f6cea409326326517502200c
SHA5126447612f1eedad9effaf3efe85821313d276ce55064b603ba3d2408e8584f4632ad58814d1d33a320fa67e847494f1e66ef3ba50a1e05771ebf04a2337d4cae2
-
/data/data/com.shopee.ph/databases/DBFriends0.db-journalFilesize
8KB
MD5cc495b245da5aa3d82f27e097bb11a08
SHA1bffdd706fa5c640965b032a8fcd63feb72074bee
SHA2563b14e4bc5b72a909c46fbc9fea48da080f26de2050acefc11d5cebe4fae402ed
SHA512855c71e83e2b92e3bb2f202881652013672be80f831078934458c3f4837839b1b0e2429e85e59b3a74f5efc8135cef29adbc8e8b7e0c1e2eab787e14ea52f356
-
/data/data/com.shopee.ph/databases/Shopee0.dbFilesize
12KB
MD5f41f531c07d4141546a531ff9caffdcd
SHA19dcac5aed06972d0ff6bd4cc1f1cdff85b36d3f5
SHA256bb8dee5b5c3779f175abbd142722eb0022b98d374783aa80145b34614a4de646
SHA512e0c8d1a820cb4c098e45776e8b50ea8c83944ef2e3f005cb0acbfc07688974d370f78100ae022f62564fc4c12acfdc43b710c18ca1c30f4f575bc08b9b12d2d4
-
/data/data/com.shopee.ph/databases/Shopee0.db-journalFilesize
512B
MD5e9bc3b59d70329b26114d2281f6e59b5
SHA18878382606e99b0918388f315f541d869fe97666
SHA2562939ece00500b11f35c86075e40e7163c3fb92262ed65ceac949802e392f039f
SHA51287bae886b9f99a11a1cd5c1f8d6ae8f16effcc34af3a08b02c017820eb2efdf4ec7781833276d60153c1c30e7b4005cd5e4c8d97a4e117b868a5ac874f4a7acc
-
/data/data/com.shopee.ph/databases/com.google.android.datatransport.eventsFilesize
56KB
MD57a334bdc909b762470f847925ad4b656
SHA144c5ca979f71eba9021fd9e779a19602ec44760f
SHA25660dd1d67de3f76a0d3e9bfc5d80d8536cf352b8a5cbb811a7e661564131c5f1e
SHA512f287f47ed51a7acabd96ed50b61988335f829a5c1acdf07076734d1267245abdd24860e7abdb74283c48061578c7d8304606b85030235218799b17a5b92c80be
-
/data/data/com.shopee.ph/databases/com.google.android.datatransport.events-journalFilesize
512B
MD52b702dc763599f630d86279e8c4225cd
SHA1dedc7522b9a62e04fc96162375cb70ad2ebcc538
SHA256e076b9da059289447342c89532b515247090d148a8fa8afc4e67d2950cff3c1a
SHA51208e09dfc38e6e8bb67376e6af3b675d85ad1e7616a692146720844a48317b2709061d41464f424d4ddc5833819085c9c51e5b06bcd016a3e0a4326852a03437b
-
/data/data/com.shopee.ph/databases/com.google.android.datatransport.events-journalFilesize
8KB
MD55ee4d19296a1e0824e70cf973d4cb69c
SHA1149e2e2b5fece1ebe604d0ecb6a21bcf643693b3
SHA256cf872003b88de3d13c9a2258e0eb6cc18cf368b1a481aa750f058e2347d66290
SHA512b5e34d029580e8fc239f9d11434870258a73e21667962dce2e55b5144f9b9a5961dbee7a0f78a35531fe343ef1cab43f9992e2d1a158f9d43ac7d96dab8064cc
-
/data/data/com.shopee.ph/databases/com.google.android.datatransport.events-journalFilesize
8KB
MD5797f5ccbf09aeda7852805df7c2a139e
SHA1b5891e9a68d2cdb9f45cbafe2bab7c90843328cb
SHA2564c80610826988da0960f5f21fc5d790b968a0300f0c51802f6df493fc150834b
SHA5121b887ab0538b400b5cafe9facdd2ce36d651c3e5a26555ca70e6f92359a2ea4de0174eabff5ed64f5afecb13cc19f81761db3525fc96d2325dd832392c11ec0c
-
/data/data/com.shopee.ph/files/.com.google.firebase.crashlytics.files.v2:com.shopee.ph/open-sessions/666B84700364000111F7222E6967E5DE/keysFilesize
20B
MD5823ba33345e62ae0e141d3fb50f75e93
SHA154b7531f7dd8d6cc4fd0e1e1747597dd3e799451
SHA25696057ae10356636c0a20a5241898bbd96d73b8c42cd42dd2ee00e6d2ca658768
SHA512d20b50b62018516127bf6d0771339d1a33c4dcbc7d0d8e927a3119687574fbfeeb6840da31f8e9e476d150c6df6e6b98e22470d475b408efa40eed31e83ff440
-
/data/data/com.shopee.ph/files/.com.google.firebase.crashlytics.files.v2:com.shopee.ph/open-sessions/666B84700364000111F7222E6967E5DE/keysFilesize
55B
MD5886f61bb85ea16205ed7a890647190ee
SHA1272a60fabc46ee6b8702f74ba8e873171ef32a5e
SHA2567b81acefda180ce9dd6c7dd995fd111f2676020505a8c542c0fc904118049f22
SHA5120ce87687fc76a75f7efb5158979804248a7f0cc2b10515c2e8f76b60b6650e9fb95824af5e70afd5a151a48a5b950048467d4587e494c37c3b2d693fd17d8091
-
/data/data/com.shopee.ph/files/.com.google.firebase.crashlytics.files.v2:com.shopee.ph/open-sessions/666B84700364000111F7222E6967E5DE/keysFilesize
77B
MD58a9f306794cfb4f185b3d535ea8e7137
SHA1e7aa8d38d23ec361a094176fba533556f87dcb28
SHA256b22d6759ddd25765ac3fb4196cd7a508b3d51ddafaa25b2b1141dd3058d71a88
SHA512bb5cdecd3ff696de6ee5114fe69d7b1d6f32045335826528010c176721eead473ee6a4d52e03b3c5ab0a816ecd75a6b5e6ec7049198cca73f03d2b97a6b2d01e
-
/data/data/com.shopee.ph/files/.com.google.firebase.crashlytics.files.v2:com.shopee.ph/open-sessions/666B84700364000111F7222E6967E5DE/keysFilesize
317B
MD5f5053b57a53500132bf9e41bee97edbd
SHA1110646614f51b4db9929efb5d19e7cc9929cc7ac
SHA2562ae9212df373513cb88f2b40832231ef6ccd2a23c38c08db59f6af12539ddcd9
SHA51206d0df2e2867c2852f7cd55a8e6b9ec834337fd4fa04d7470ce5c0262ee40e28324ac4369900ae6e00147c77721185367a8141fb1c0c83a0700782b7a37f46fd
-
/data/data/com.shopee.ph/files/.com.google.firebase.crashlytics.files.v2:com.shopee.ph/open-sessions/666B84700364000111F7222E6967E5DE/keysFilesize
339B
MD5614b3ea92bb1b4f8e9e13e098df3cf1f
SHA13894120efa39b799fe0cc09bda791e86c0068993
SHA2568149ebe013ca378529663f872bcb346a088554b82dc08b7dac055020cf8d4541
SHA512c906d2f8cf47c3773505434292e44a7a183543340171c7ccceef110f58e72e54527663ae78954c533fa81ddeebcf06a4e59473c53e9571dad81fb2e1b3d44d67
-
/data/data/com.shopee.ph/files/.com.google.firebase.crashlytics.files.v2:com.shopee.ph/open-sessions/666B84700364000111F7222E6967E5DE/reportFilesize
778B
MD5c34ccc9bb5a1f2eb625846dc6ae4e23f
SHA157a09f7b22ab366c0452ce1d39edfa86e6ff6018
SHA256f581588d98c7e408952c6a02d26716bbce2679af96eab59ac5c62136617a69cf
SHA5124b414e497de2fdc84f0c5931bff0849e9a7c8220e7a3dfd8ff8770526f951712fc254167e9892c87d6a18ceeb57dbf41b51e073937d078117ca3e25223027375
-
/data/data/com.shopee.ph/files/PersistedInstallation6553983656565836501tmpFilesize
90B
MD5c426093d1a40fc1083b2885a7f8d483c
SHA1714cd28bbf8f257d9c5af540432cd536ce332ba7
SHA256aba088ed03b05e8a508934cadbe34c336a14502d599c850eff6a629e56d0c3e6
SHA512e3e423cc001c3d4fee8fc9c4de5719aecb7b83c0cce30f0ae0e30498fb901e1bb1b973566389034852bea98980b009f6344797d7354c7f639018a60bf578b3a2
-
/data/data/com.shopee.ph/files/mmkv/alpha_launch_configFilesize
4KB
MD5620f0b67a91f7f74151bc5be745b7110
SHA11ceaf73df40e531df3bfb26b4fb7cd95fb7bff1d
SHA256ad7facb2586fc6e966c004d7d1d16b024f5805ff7cb47c7a85dabd8b48892ca7
SHA5122d23913d3759ef01704a86b4bee3ac8a29002313ecc98a7424425a78170f219577822fd77e4ae96313547696ad7d5949b58e12d5063ef2ee063b595740a3a12d
-
/data/data/com.shopee.ph/files/shopeePH/com.shopee.app.application.ShopeeApplication/sp_xlogs-cache/shopee.mmap3Filesize
150KB
MD506ae8a01d80da962c7987c264af64cec
SHA163a497994321f254b535a846ce89f076d4e378ee
SHA2560c5cc90b079d0d9c1ded1376357d23a9782a704a83e01731f50ccd162e246492
SHA5128720928fbe7cf8351c9dc45cb1a9c8243939c7e3c9c6957d24dbe18c0819d05ea7475e3953018f0365461fb2987ad68d8ec9f59b03aef3adbd3e4ae8ebbd0427
-
/data/data/com.shopee.ph/no_backup/androidx.work.workdbFilesize
4KB
MD57e858c4054eb00fcddc653a04e5cd1c6
SHA12e056bf31a8d78df136f02a62afeeca77f4faccf
SHA2569010186c5c083155a45673017d1e31c2a178e63cc15a57bbffde4d1956a23dad
SHA512d0c7a120940c8e637d5566ef179d01eff88a2c2650afda69ad2a46aad76533eaace192028bba3d60407b4e34a950e7560f95d9f9b8eebe361ef62897d88b30cb
-
/data/data/com.shopee.ph/no_backup/androidx.work.workdb-journalFilesize
512B
MD5adbff8a710bbbb3cf038d4b9f27faec4
SHA132d6827338694a6d37945825363a5eec0d4701a4
SHA256b0dc8028ad28b0c3b5a795fd956912153f03485b91be46ffccfd5dec4dabdc7d
SHA512fea80a067ada487c2b6e0abe4841434cb8c32ee54311c29b72d8705c4daaa825a0a444303773c5e28ac454db0bcc0680041967ad2dd4d538495c1a698d4614e2
-
/data/data/com.shopee.ph/no_backup/androidx.work.workdb-shmFilesize
32KB
MD5bb7df04e1b0a2570657527a7e108ae23
SHA15188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA256c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
SHA512768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012
-
/data/data/com.shopee.ph/no_backup/androidx.work.workdb-walFilesize
16KB
MD584c9d8eaf45d6b560ca88b3297553b70
SHA1f873eedd0f270fe1645c7f982e3ddc6719c0d783
SHA256ed497d195471850def59afe0ac84c466a4b5a33cae456fdac264650a90a90930
SHA5122c470164ad52b6429e02deccc211ced84ca439d54649b1be9fcd7c88281a4409dc0feb8e45648e9c7462e915cff1846f03a8a2a59f765eecdbb410abec317c4f
-
/data/data/com.shopee.ph/no_backup/androidx.work.workdb-walFilesize
108KB
MD54ead708840b21c067180ba3e5eb9873f
SHA15f81b4bf997e7101a2c1134d65f74e4c4a15eed3
SHA256f07d1a0fc533db535a04d05b5428e043e5640e3c907d4f18a99491397a9e48b0
SHA51274385610fcb8270ab50a9d05b3b63ad0b9e2929391561d04f759b775237ccd33ab40aa99e02dc5dbbb4ba5222073957808db911cebdf1e3092601d768cbdca37
-
/storage/emulated/0/Android/data/com.shopee.ph/files/anr/portal_info_stub.txtFilesize
77KB
MD5d54e96fb46cf7cecf8b3d91477e4ecfb
SHA15fc3a5d6f7b9f5e4be462bb5649312060c0dc4e2
SHA25696fb384729e12be61eb8aecf12655327a4433335dd289d1d7086df0cbb9c7d75
SHA512aefe7d09ca47938f0b6bdfa23f2eb719e259372903f316bc04162b4f09f178358cfe9bfd2294f27170529a0a4635855f73fb3115d2fc4dd2a01d753dce6fba0d
-
/storage/emulated/0/Android/data/com.shopee.ph/files/szlog/logs_sz_20240613.csv (deleted)Filesize
4KB
MD5b09b24dd3d91ea4f67dc2ec1b507e000
SHA1a57240d386620e0fe8cea44e4f12d643c8529cbb
SHA25614f52b83033761204e080b1393132fee7c93134648d765ea55ab7129108955fa
SHA512e28a8966a6d713808393553d6509099e00058b2c0245ab9c2f4722ea932e96921ec65dd32dc4e265f3b5b2562d113b3fcb5ed7be36011351cd5c018e01563567
-
/storage/emulated/0/Android/data/com.shopee.ph/files/web/cache/journal.tmp (deleted)Filesize
31B
MD5d6ac8c8db0504502d7f0e057a78c5ce3
SHA18f4cf91a262b24ec9c1a6e7c41fd6d16b6623bb4
SHA2568f22a32cd8de58916041d1097976f2b9c80f7e9a18593d5a6b058bcaed17e22a
SHA512100e74f0c65b51a17de6eeff96d5c38bd6d40e3c8ee00094fd906ba5794088fe1ad6f3a15be196480384cf01399ea26665a05471404f1eeebb0c82ae6fb104bb
-
/storage/emulated/0/Android/data/com.shopee.ph/files/web/dfdata (deleted)Filesize
33B
MD57d8aa4c9e31b8d5ce598fea3ada5b770
SHA1c426691d5135752d79b7050b5d4d5abcbafd12ee
SHA256f5e47b78513b33118c07b1efecccda3a6dbd6ccbafb549c2b23d28767f15c3fa
SHA512e17d6f23db068b27379f31ca15a10e28865fe1dc0aea5c788fb34b7d4fbab3f7fcb41821ccb63714392c91a8716fc781c96006a09a73d6264aba1e43cab98522
-
/system_ext/framework/androidx.window.sidecar.jarFilesize
12KB
MD5bdf3529e80318eb14e53a5bf3720c10d
SHA125c9ace4b1af6e80ebb2572345972c56505969ba
SHA256bbc8300dd1e9cd08de8f66560c1ac2c928615b72b51cef9649f88974f586d64b
SHA51248b9c2d01171bb651b9b54826baa51f4add48431a3efd8ceb5f7cc3bcd6f8f37edf47fabb24349dd15b3a02329cd450f90a8d164bf4f8dfae554bf3b35a8a55b