37b301bc0c499a6464de118799e72f51ad473d4d9323749448a13faac4bf63c0

Analysis

max time kernel
3s
max time network
158s
platform
android_x86
resource
android-x86-arm-20240611.1-en
resource tags

androidarch:armarch:x86image:android-x86-arm-20240611.1-enlocale:en-usos:android-9-x86system
submitted
13/06/2024, 16:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
AlipayMSP206_PPS3_V3.5.4.0619.apk
Size 354KB
Sample240613-typveszgjp
SHA256 46f025d57f9aed1fb674c0fe8fc77add93cf00ea6e1633596955f33426be7688
MD5 12ae4560d8350db4bd6fa3bc1589614c
SHA1 dbbfce036a1823aaec9d1c7b621adbd7317f7fa9
SHA512 df7348142a8c294d0d7f7ce77795fd0f81f60831ca1831164e5060c900aa90af430b11f6972103a5c6307d81d8cdf095105a9ab3d01c2183d10d01910976c6fd
SSDEEP 6144:ipIlfloegHi/BBs3dWcfihtB7+Y3Ju4g29f5C8EcPK+WvyQcy2fn1E:ip2JgC/BBsNWfh3Vcc5CLE8Rcy2fn1E
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

collection discovery evasion

Malware Config

Signatures

Requests cell location 2 TTPs 1 IoCs

Uses Android APIs to to get current cell location.

collection discovery evasion

Location Tracking

T1430

Geofencing

T1627.001

description	ioc	Process
Framework service call	com.android.internal.telephony.ITelephony.getCellLocation	com.alipay.android.app

Queries information about active data network 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.alipay.android.app

Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.wifi.IWifiManager.getConnectionInfo	com.alipay.android.app

com.alipay.android.app
1⤵
- Requests cell location
- Queries information about active data network
- Queries information about the current Wi-Fi connection
PID:4260

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Execution Guardrails

T1627

Geofencing

T1627.001

Credential Access

Discovery

Location Tracking

T1430

System Network Connections Discovery

T1421

Lateral Movement

Collection

Location Tracking

T1430

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads