c3e7aef9f46e982f32ac2409b58fe2e6586706bf5fa704fd4008f28ef2287fe7

Analysis

max time kernel
3s
max time network
131s
platform
android_x64
resource
android-x64-arm64-20240611.1-en
resource tags

androidarch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20240611.1-enlocale:en-usos:android-11-x64system
submitted
13/06/2024, 02:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
com.qihoo.plugin.splash.apk
Size 448KB
Sample240613-dcm6psvhnj
SHA256 b6682034e1fcfe8f448a2a604c3dc473d842732bfb34b53377d43e418a001a6e
MD5 c2113e90fb97212c968fbab23cd8ba5c
SHA1 c7a0854d096f549b93b0e6bf28e36ff7fe27bc43
SHA512 0bdc8398dae373d48d84601eacced88b5eeddde469f46ee87d0c6fa16bbc6e1f91db863c1345e2a70152dc38d8c4ce9c01f4981d67daeea1fb3f82a03d25ba02
SSDEEP 12288:MhDEVb5D8huxi+gq6NMiB4rOZXL9dZ+N/st4IFAkvPQL:juhv7q6NMNrOpTkN/st/Lq
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

banker discovery evasion

Malware Config

Signatures

Loads dropped Dex/Jar 1 TTPs 1 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/com.qihoo.plugin.splash/files/torch/core/3.7/finalcore.jar	4582	com.qihoo.plugin.splash

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
banker discovery

Security Software Discovery
T1418.001
Reads information about phone network operator. 1 TTPs
discovery

System Network Configuration Discovery
T1422

com.qihoo.plugin.splash
1⤵
- Loads dropped Dex/Jar
PID:4582

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Credential Access

Discovery

Software Discovery

T1418

Security Software Discovery

T1418.001

System Network Configuration Discovery

T1422

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

finalcore.jar

Path /data/user/0/com.qihoo.plugin.splash/files/torch/core/3.7/finalcore.jar
Size 153KB
SHA256 79e1eee2d72cb40e0c931ed08e609891a41b0a2802d6e0b98abd7970238b4eee
MD5 bc3cb0eef1d19c47cf3f1a2211258aee
SHA1 7f10b763a43b6900cd9925b014c1a794994d37dd
SHA512 51f66294dbc34d4c618e2b16449c47f73734f1d5a57d2e40927ff5ab808604206fda84af29653cb9b018f30749e54a0a481e796cfc7b016a317ff7e83860df86
SSDEEP 3072:GYRLLNEK/MG/+UL3TMPAi7GGawe/JchKfbNewyfVF4BTP7rLqchL:GYLLNEkMG/+g27GGze/JSi5IuHLBL
MD5 SHA1 SHA512 SSDEEP

Submit Download

finalcore.jar

Path /data/user/0/com.qihoo.plugin.splash/files/torch/core/3.7/finalcore.jar
Size 346KB
SHA256 d482194392c58bab488d65622c27be7a91f673d1c3398e9dcfcfc015f20ce7eb
MD5 7ca872b45694937f04aca732b336950c
SHA1 762652d725c00e27a3a9316322fb0049b154cf45
SHA512 260b9bf7a17e0e71cc5e05d447c578c062c80dfe35b27c658bda6c3071a30a1649e2181f287d0f3823d34f99aab604fb8b520da7cd9e1f9ce7b6552d5897fbf9
SSDEEP 3072:8fcr1NhMo6PtC2GdpKRKLpTpUQGtfOjibyKkW+8HSTJ8QRHXvCcxGJTzlmRPbErT:8kL+GLpTCQGtfIOVSTJ/f6lmR4go3Z3l
MD5 SHA1 SHA512 SSDEEP

Download

core_update

Path /data/user/0/com.qihoo.plugin.splash/files/torch/single/core_update
Size 13B
SHA256 30509e1ff431c1d98f18cacff53838bc37bc34dcd07653b5fbbc1a2602e88a1b
MD5 514746e9925af43e2c728c0bcb65d0b9
SHA1 1616cb3e7054edff965c0f53cd97f473ea0c444e
SHA512 c5f33c4a74fb6d97be4faaacd787e1510314a47619e3f229ffaf36501e006cb5d22485bdfb2959a8f8bb12e77ca1437040f8bf6c5a7a131141096fe44af7124b
MD5 SHA1 SHA512

Submit Download

profile_task

Path /data/user/0/com.qihoo.plugin.splash/files/torch/single/profile_task
Size 13B
SHA256 51a3f237bf6c61f14020501cbcac3c16a263728edf1bdace9290464d1703cfdd
MD5 e9e8450d9c3cc251effaf7aa24ea0a85
SHA1 a50812ac2c6cab0a21c20eeabdf18dd2b534d0de
SHA512 23784dd5283aeee9194eaf7b1d4bbf3a7867124842794e94c9cc4af86f5ad0230ba0e0cde727ae97455c9319fd97fed231017a775df58eef8eaf01af44ae8cdc
MD5 SHA1 SHA512

Submit Download

waitingDown

Path /data/user/0/com.qihoo.plugin.splash/files/torch/single/waitingDown
Size 13B
SHA256 be066b3bb26a033e522dd4c641ec6f1687e1d3b2ccfc9ef23f8b5f6f67304955
MD5 93bef342a71074715e30ddec2ce9d217
SHA1 29d960a8b735d66232abcd599eeef707fff77eee
SHA512 1580d2ea9705d33ad22ece708f45667fafc3f7d4b3525c9fb6341b74dad5c91099e51c6376d2e41c5585f618a5c477ec95ca3a80c921b125b77178f2c99f8746
MD5 SHA1 SHA512

Submit Download

.sfp

Path /storage/emulated/0/Android/data/com.qihoo.plugin.splash/files/.sfp/.sfp
Size 83B
SHA256 9380030042f5f35c69dc9f6b00eb93f421072203200c546979648493a79eb62d
MD5 92f9aac8aab79c07bb408f75f9f8e3b0
SHA1 df8850482b6a3179482c9ad4ad3b6f8830d403f9
SHA512 4733e8a1f55e8e99555329379c3b7d8f2d7175515f3e2ba40ce57f068015119f3c78b0b10bcd93939911d53872317100b2293b45cbb63a74d16b4fe377e973f4
MD5 SHA1 SHA512

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads