68a42cc171c91bd585e3355fdde8598b897396af9cd54aa712b9ed53a46d7cef

Analysis

max time kernel
177s
max time network
178s
platform
android_x64
resource
android-33-x64-arm64-20240611.1-en
resource tags

androidarch:arm64arch:x64image:android-33-x64-arm64-20240611.1-enlocale:en-usos:android-13-x64system
submitted
13/06/2024, 12:11

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
FlashCast_1.2.2_APKPure.apk
Size 33.6MB
Sample240613-pc1mksscmk
SHA256 68a42cc171c91bd585e3355fdde8598b897396af9cd54aa712b9ed53a46d7cef
MD5 130d5dc131db3acc7f53e28ebfae69e8
SHA1 14f4020a16443a4f9adc7ca0c346bd14ea86a5a0
SHA512 2e0db56b1e50c617d4d4ae6cc8e91f6a3676f85d8014bca5a00eabf90844ab79b8838539e1c602302a36c41b3cb148f5d5e417b5454645e9b66e4ed63b2d9ec4
SSDEEP 786432:JwzmJE6n9GthbkPA9KmWoeLiaVdNsdFT0Q8O9:JwzmJES9X4KmW5LiJrThX9
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

discovery evasion execution impact persistence

Malware Config

Signatures

Checks if the Android device is rooted. 1 TTPs 2 IoCs

evasion

System Information Discovery

T1426

ioc	Process
/system/xbin/su	opasc.flash.cast.yusou
/system/app/Superuser.apk	opasc.flash.cast.yusou

Queries information about running processes on the device 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about running processes on the device.

discovery

Process Discovery

T1424

description	ioc	Process
Framework service call	android.app.IActivityManager.getRunningAppProcesses	opasc.flash.cast.yusou

Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

Application may abuse the framework's foreground service to continue running in the foreground.

evasion persistence

Foreground Persistence

T1541

description	ioc	Process
Framework service call	android.app.IActivityManager.setServiceForeground	opasc.flash.cast.yusou

Queries information about active data network 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	opasc.flash.cast.yusou

Reads information about phone network operator. 1 TTPs
discovery

System Network Configuration Discovery
T1422
Checks the presence of a debugger
evasion

Schedules tasks to execute at a specified time 1 TTPs 1 IoCs

Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.

execution persistence

Scheduled Task/Job

T1603

description	ioc	Process
Framework service call	android.app.job.IJobScheduler.schedule	opasc.flash.cast.yusou

Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

impact

Data Encrypted for Impact

T1471

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	opasc.flash.cast.yusou:AppMetrica

Checks memory information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	opasc.flash.cast.yusou

opasc.flash.cast.yusou
1⤵
- Checks if the Android device is rooted.
- Queries information about running processes on the device
- Makes use of the framework's foreground persistence service
- Queries information about active data network
- Schedules tasks to execute at a specified time
- Checks memory information
PID:4636

opasc.flash.cast.yusou:AppMetrica
1⤵
- Uses Crypto APIs (Might try to encrypt user data)
PID:4805

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Scheduled Task/Job

T1603

Persistence

Foreground Persistence

T1541

Scheduled Task/Job

T1603

Privilege Escalation

Defense Evasion

Foreground Persistence

T1541

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Discovery

Process Discovery

T1424

System Information Discovery

T1426

System Network Configuration Discovery

T1422

System Network Connections Discovery

T1421

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

T1471

Replay Monitor

Loading Replay Monitor...

Downloads

com.google.android.datatransport.events

Path /data/data/opasc.flash.cast.yusou/databases/com.google.android.datatransport.events
Size 88KB
SHA256 7a23825cf50398701de9ff09e7dbea42699d901e973399c90c417c3db2e38bdf
MD5 bd72f1b1122edd60ff7b607c3693df05
SHA1 56562e64faf893244cfefbc8eb2cc1855335ca27
SHA512 e2718e8746463171991a3d0f8258ca86637fe0253cec30e42dbde2eb5e4e33f7176119fed1ec2c47e8236acf46435d5dd72f119d33f0f2763bee1db789f269c7
SSDEEP 384:XHpZrRimuUDUj64GK5oDyDSLW0GKs29ZhB:XpZtixUJ4GK5oDyDSLW0q2l
MD5 SHA1 SHA512 SSDEEP

Submit Download

com.google.android.datatransport.events-journal

Path /data/data/opasc.flash.cast.yusou/databases/com.google.android.datatransport.events-journal
Size 24KB
SHA256 1c5be40c85e2dad124c88ddeb8c1e5e57437dbf6b81659db67677ea609091755
MD5 3b9ddddc2808d6bb1725411645836380
SHA1 a61b5bbe253f4714947701f58811dd855744f558
SHA512 ee9374e799842156775a289c1666bcdc47719f150bbfc75deb08c41cdeca7cd4d7e3767f6ddb3bde4dee680acd09a77a9b0aa3e1263b2e09fac81693adfaa5ab
SSDEEP 48:YpIGqIg59MENZBdUdndVd/729IvdldHlq8/Jq4qPSo:GIG8MEX0wIyNjao
MD5 SHA1 SHA512 SSDEEP

Submit Download

com.google.android.datatransport.events-journal

Path /data/data/opasc.flash.cast.yusou/databases/com.google.android.datatransport.events-journal
Size 36KB
SHA256 fb8264b84912bdc4cc0227a94874961ac3689ed4f15249cab3c45c3d5eaf202e
MD5 c2931bf090e0d2f31074e66c3f4f5087
SHA1 62b8fbe4c4e8959ab03f4c796b192ae883aa6c2d
SHA512 4fa8ba7b76f043da62fb035068d732e42a5b0d1c04f46f2b7d2bbacdead735721c13420c09337bbd318f76c36c28d25c622bb4d14619c34ef848ff042cdc5fad
SSDEEP 48:TqEE8WcyU0s/UxSKu7cgMllkfQzxU4qHzk9/9tqHzk9SN20vk9dcfj0Wvm+mBtK:tE8LB0s/UQKu7cR+fQzxEk9/Yk9STNcc
MD5 SHA1 SHA512 SSDEEP

Submit Download

com.google.android.datatransport.events-journal

Path /data/data/opasc.flash.cast.yusou/databases/com.google.android.datatransport.events-journal
Size 16KB
SHA256 280a558b940f43919115125dde057ca8d7415bddfb0576432f304316fbbffac4
MD5 6d7dcdfc0456a15766a0faaecdfceeaa
SHA1 326208d9d28e638e1a4d5ebf4bb58fb170e73262
SHA512 6cd93703642d705f09ed9bca983485907ef74e37080244b9ebb786e25bda26daada4c8c74f719aaa6748f231fd38a46f194eaec5b93c4f974f38e8d7cd071925
SSDEEP 48:7MNqNUSLxkNjOSJw0zNhSWCgbBqs/g59MENZBdUdndVd/729IvdldHlq8/Jq4qPf:7Ic1OtOAfDvZlcMEX0wIyNjaU
MD5 SHA1 SHA512 SSDEEP

Submit Download

com.google.android.datatransport.events-journal

Path /data/data/opasc.flash.cast.yusou/databases/com.google.android.datatransport.events-journal
Size 16KB
SHA256 67f22c409bad6190193dbe493fb7d69d8bac26d6401f356b0f342ea75da3b781
MD5 c572d5da414292517b984b02ad1ba4bc
SHA1 0a2f097e30f53560ac86bdd731b2cf4efed580e7
SHA512 55ab5fc1acd0ce0822cc6b67c1621bd1f52ce9ea0ae8d3a27a9d3ecf20a350241949da6cd2d70afd3463814a2dc3700c256e5687e0cf7f1d136fc62c5929386f
SSDEEP 48:YLn0/hF0aiJrN0UMKvNBrX8cNjOSJw0zNhSWCgb3Rq4g59MENZBdUdndVd/729If:KnScxNZvfrsctOAfDvZ1sMEX0wIyNjat
MD5 SHA1 SHA512 SSDEEP

Submit Download

com.google.android.datatransport.events-journal

Path /data/data/opasc.flash.cast.yusou/databases/com.google.android.datatransport.events-journal
Size 16KB
SHA256 c799551a3b4ee2184ff5115270ae791c43f7ba34e66590b8a5e9b0471e7fea44
MD5 661044b6b7b51fb26985720fdef239b0
SHA1 8825e15e62639a5c4d2ac4af42f6e95b4872ed4b
SHA512 4f507edc6544e297ddb2d10bd8b23f227054e46bef97620b2f64eff70a8c0268406bd5ced512833bd9dca1f49c476f2397a3470bd22e0acc9c2c8727646fe594
SSDEEP 96:LlN/BScxNfddJvfrsctOAfDvZL8MEX0wIyNjad:RVZdRfrVtOAfDxLEj8
MD5 SHA1 SHA512 SSDEEP

Submit Download

com.google.android.datatransport.events-journal

Path /data/data/opasc.flash.cast.yusou/databases/com.google.android.datatransport.events-journal
Size 52KB
SHA256 20e9512e737544bf1c6f55413ff3fa94b5aaa9414df55e3954eaa182876f774a
MD5 e7d05e705efe10c2f10c75ab0dc2bf12
SHA1 f2ac7851b852a5fcfa5ba527cacb53d5a5acb23f
SHA512 5463f01c0a286307eda89e1364ac172caad861564d806c468630b7ce621d3fc544459a862dd0209bf5feff1b72ee5e953514e9034700dbd6ea26da34e5c9c311
SSDEEP 192:7+bHEjBUjsWp87dOhLH84HJ91zt9xPjPA2hXMTuoK5ow8yw8Wnr9DYjc6ztL0i9N:7MHQBgsLW0GMJK5oDyDWpoc329ZhP
MD5 SHA1 SHA512 SSDEEP

Submit Download

google_app_measurement_local.db

Path /data/data/opasc.flash.cast.yusou/databases/google_app_measurement_local.db
Size 16KB
SHA256 79cb179500ab2ca218215c7cb006e0b5d7059041334956a312ecab42f4fa8087
MD5 b47301c86fb7062a7a53c03b6f3bd1cb
SHA1 55f08334d18c279b29999e9cefa9733d0b4b19fa
SHA512 c9e3cdcb3dbce1db41bb79a4a77430e07fbf1eeff18fe7497e1fd3be6ab18217cbbdeee14c64c220c2d647522d7a70f7e9dfa470b8fedb5c043df09e6268e46b
SSDEEP 12:Yb4AqxA0kn9qMRjNejzmzrfRmBEyPbP/wEB5mfeyl:YUAQAkmzr0GSP/f8
MD5 SHA1 SHA512 SSDEEP

Submit Download

google_app_measurement_local.db

Path /data/data/opasc.flash.cast.yusou/databases/google_app_measurement_local.db
Size 16KB
SHA256 1063ae402fb75ce24f0d5a31e90e502ec8ccc6f60f31f521d0344b2c9e719483
MD5 065b4aff3f57bead1ee15c374a2f09f2
SHA1 552833a3b7e8c9819c5df1e8cc26e572d1f3bbbf
SHA512 c215a2ffe2f810e9b6bd956b81d052fba37d3b80976721b3cc3d4ad37ca7eb8662ba80060f2a715645f0fef0caf43ce2d288dc7c9d95dd1370b988f39763cc6b
SSDEEP 12:TLMEYE9zmzrfRmBEyPbP/hqzs1kn+/0Fl6+t+IB5mfeyl:TL/pmzr0GSP/hIsunlF/L8
MD5 SHA1 SHA512 SSDEEP

Submit Download

google_app_measurement_local.db

Path /data/data/opasc.flash.cast.yusou/databases/google_app_measurement_local.db
Size 16KB
SHA256 0ed53c3378f99d9f61c530409d53ef197d89aa10b973e54e2cf2833cd9fc64ef
MD5 293c6d241729958a888421721681b5f2
SHA1 c815977e416530609b5db772f349f80a34710aa1
SHA512 574bfb8b9434f90e70b67d38b3fbcd9da5d54994eb7b8b768cb5ed0cc2081d86d8195ad4ae3cc16bce66fd5acdafb5388e8b39c0108d20f190be986032053110
SSDEEP 12:TLmuEi9zmzrfRmBEyPbP//fiH49blqYFlIKR2n+/0Fl6+t+IB5mfeyl:TLvpmzr0GSP//fy499FV2nlF/L8
MD5 SHA1 SHA512 SSDEEP

Submit Download

google_app_measurement_local.db

Path /data/data/opasc.flash.cast.yusou/databases/google_app_measurement_local.db
Size 16KB
SHA256 c2f64b8a3a4e8688573dbf8f67f24dbe926479f66c079641c87c03c5edeff06e
MD5 9b85a47d40fde67500c4f03af7c0a7a1
SHA1 f19e323932a328c41a485cd61660a73b370c7dc4
SHA512 d98b177440a57002b790f07f0dad7fdf8328393af5058b392ea3bb5cc86406412a5505106bb57f59d87c90da2ed1dfb1dedf7902208a3ed049e4f9c0025018e6
SSDEEP 12:TLyEEE9zmzrfRmBEyPbP/oYPRmfer+X49blqYFlIKR2n+/0Fl6+t+IB5mfeyl:TLfpmzr0GSP/o+oX499FV2nlF/L8
MD5 SHA1 SHA512 SSDEEP

Submit Download

google_app_measurement_local.db

Path /data/data/opasc.flash.cast.yusou/databases/google_app_measurement_local.db
Size 16KB
SHA256 fb7d73cfbbed8ae5f6dd5c992feef62d4be5202e057c27ab332116ebfac967a0
MD5 06fc177c84d5e4c69dc69719a4f4b2b4
SHA1 c47e13e4dbf484063385eb0d7bf9ea85ffb7b019
SHA512 47a6d315527728c20afb72d4ae12c0ef8653564cc56bbb3f45af31a887e7d0d0f474a0ac435ef13f17fb9e2b7cfb52c67e093087efc520dd4e95cf50d5c1b7b9
SSDEEP 24:TLQEpmzr0GSP/bqo3aGoX499FV2nlF/L8:TrArSP/bqoqGoI5V2n/L8
MD5 SHA1 SHA512 SSDEEP

Submit Download

google_app_measurement_local.db

Path /data/data/opasc.flash.cast.yusou/databases/google_app_measurement_local.db
Size 16KB
SHA256 bd61fef6b00bfcb841219088e9d0e0433c6e260a05c830f077034110c0223c11
MD5 e496d430065fa7e9bbae6b08d750408d
SHA1 a2acebf32e32d8fb3ae1b586c4f180346d6375e8
SHA512 b5c684986f132a566feb24264832891ffb1b509a6e0f51e096a3abec09cd58ff3dcd5b7412b580cd26ce18ab42661276cd4ee43dbe07c30a8ccd7a111ee3b299
SSDEEP 6:l9bNFlQls1wElO0yAgLusi2JLnrcERX4PBX4ogLugMBX4suuK+/W4vt1lz1:TLeEwE9zmzrfRmBEyPbP/W4vnlZ
MD5 SHA1 SHA512 SSDEEP

Submit Download