f989a884889b7ac450c21902bec20e3ceb31532d4d65105a5084c4819a03e32f

Analysis

max time kernel
174s
max time network
184s
platform
android_x64
resource
android-x64-20240611.1-en
resource tags

androidarch:x64arch:x86image:android-x64-20240611.1-enlocale:en-usos:android-10-x64system
submitted
16/06/2024, 02:01

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ab99a1110f11fdc79bfd6bad86034afd.apk
Size 10.3MB
Sample240616-cf2ylayeqm
SHA256 f989a884889b7ac450c21902bec20e3ceb31532d4d65105a5084c4819a03e32f
MD5 ab99a1110f11fdc79bfd6bad86034afd
SHA1 d744813f243f5f8f881f56ae792eada1fead029f
SHA512 0d02f7146fbe0ce0017046e0c8e01fd921f3716f1356b9c81af37c3b335ff66c1111380d2e25fafd93a45727457ec918ac316e4c4ec1f5d8c5f73f2e905ee39d
SSDEEP 196608:4QJbwwFKvkS1IC16cIOb3I6ro5LyyH4JbRgi7sDaELFiZl2LOFO1f6d2L1FO146k:fJbwwIvkArfIOb3m54J1giYZi72LT1fz
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

collection discovery evasion impact persistence

Malware Config

Signatures

Checks if the Android device is rooted. 1 TTPs 2 IoCs

evasion

System Information Discovery

T1426

ioc	Process
/system/app/Superuser.apk	com.zallfuhui.driver
/sbin/su	com.zallfuhui.driver

Queries information about the current nearby Wi-Fi networks 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about the current nearby Wi-Fi networks.

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.wifi.IWifiManager.getScanResults	com.zallfuhui.driver

Requests cell location 2 TTPs 1 IoCs

Uses Android APIs to to get current cell location.

collection discovery evasion

Location Tracking

T1430

Geofencing

T1627.001

description	ioc	Process
Framework service call	com.android.internal.telephony.ITelephony.getCellLocation	com.zallfuhui.driver

Domain associated with commercial stalkerware software, includes indicators from echap.eu.org 1 IoCs

flow	ioc
16	alog.umeng.com

Queries information about active data network 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.zallfuhui.driver

Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.wifi.IWifiManager.getConnectionInfo	com.zallfuhui.driver

Queries the unique device ID (IMEI, MEID, IMSI) 1 TTPs
discovery

System Network Configuration Discovery
T1422
Reads information about phone network operator. 1 TTPs
discovery

System Network Configuration Discovery
T1422
Checks the presence of a debugger
evasion

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs

persistence

Broadcast Receivers

T1624.001

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	com.zallfuhui.driver

Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

impact

Data Encrypted for Impact

T1471

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	com.zallfuhui.driver

Checks CPU information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	com.zallfuhui.driver

com.zallfuhui.driver
1⤵
- Checks if the Android device is rooted.
- Queries information about the current nearby Wi-Fi networks
- Requests cell location
- Queries information about active data network
- Queries information about the current Wi-Fi connection
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Uses Crypto APIs (Might try to encrypt user data)
- Checks CPU information
PID:5131

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Privilege Escalation

Defense Evasion

Execution Guardrails

T1627

Geofencing

T1627.001

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Discovery

Location Tracking

T1430

System Information Discovery

T1426

System Network Configuration Discovery

T1422

System Network Connections Discovery

T1421

Lateral Movement

Collection

Location Tracking

T1430

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

T1471

Replay Monitor

Loading Replay Monitor...

Downloads

cc.db

Path /data/data/com.zallfuhui.driver/databases/cc/cc.db
Size 36KB
SHA256 abda5dd4cc2e7dbb951637c4b49d6990f9f34411fab4dee1a387dbcc8e7eed40
MD5 67c12933d1e0e63d9801a6aa43092ce7
SHA1 b6936908554e4a1986b8eb08289e2d3545e8ff74
SHA512 db8b818daa3ff4ec7678645f84bf8b45c809bcbb758ea78b28982d071572655bba2d20e6f1ca4f0d057ab34fa655c5bc40457dc65050180351a2fc04a47175dd
SSDEEP 12:TLgRP2yMHdqVcV7p5WUYUW5LfpBKKyBGtbDrNTSFbycKrHBGtb5RmBEyPbP/WQQ:TLt7sL7yot3BVrHotGGSP/WQQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

cc.db

Path /data/data/com.zallfuhui.driver/databases/cc/cc.db
Size 36KB
SHA256 38f8548795ca7470b449dd1de9598c07a247ba59883c0764c9c96ff0b7d31d7f
MD5 0908e924aa236931dc7166fef6e00862
SHA1 7782648d6d8f6e835bd47058d4852932c096a467
SHA512 3c16fbc5172aed04cd206e776c46d26e911732c6e3631536410a71f1d217449475727ac9b3175e827c5ce645a1da9e05900258ee6ca27c936a9060f241361dee
SSDEEP 12:TL/sP2yMHdqVcV7p5WUYUW5LfpBKKyBGtbDrNTSFbycKrHBGtb5RmBEyPb8FOwGQ:TLd7sL7yot3BVrHotGGSgGQQQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

cc.db-journal

Path /data/data/com.zallfuhui.driver/databases/cc/cc.db-journal
Size 8KB
SHA256 e34435ae4d820ac400e72a1cc9d67615aeb7c85a1642b5380110a682f3f047ce
MD5 ba541cd7393eaf074dd49e01c2ed6447
SHA1 45b9b2d086b5162f6c412a6c99d907d4bac31bc6
SHA512 e29fde743fa47ca2fa4244c4505e5722c532d7a311e16b31e0ef86aac28588a71312295c6c129b86d15363d6980eb371c6cbb419a1f0a1d42678933b0b26c256
SSDEEP 12:7+t9ZCvqL/sP2yMHdqVcV7p5WUYUW5LfpBKKyBGtbDrNTSFbycKrHBGtb5RmBEyZ:7+tPCvqLd7sL7yot3BVrHotGGSl
MD5 SHA1 SHA512 SSDEEP

Submit Download

cc.db-journal

Path /data/data/com.zallfuhui.driver/databases/cc/cc.db-journal
Size 8KB
SHA256 b8bcbdf3de62f4613a417ad531b8967dfe244d0796876434c8db35d2d8689bb6
MD5 955c4f8fbfa5d3e25f5bd104bc36b4ca
SHA1 7ba596dee74e3efaf0e56594bf8d683c4c9817f3
SHA512 ec8989ca2696e88ee531ac062788109e1c7dca3affbfba5f2ba62ee305a761d203a726656a18169d5e4255c7caad4b9949cce69d5b63fc08493e71b15d63ae19
SSDEEP 12:7+ts/KqL+/E6P2yMHdqVcV7p5WUYUW5LfpBKKyBGtbDrNTSFbycKrHBGtb5RmBE0:7+ts/KqLpr7sL7yot3BVrHotGGST
MD5 SHA1 SHA512 SSDEEP

Submit Download

cc.db-journal

Path /data/data/com.zallfuhui.driver/databases/cc/cc.db-journal
Size 12KB
SHA256 54ac8960e02d6e8c3d60603e23526e4c725802e06b70e1bdbc36454ed9e359e8
MD5 969c52a459d0f79cf911a155dcf13130
SHA1 93f1c1f376822c0337a71f6ca09851da8986b91e
SHA512 f845e62b857a4cfec5fa9353c4096f3bc02af1c66e5a35e74c233484457037b580cdfe23fd27846705f96f1132e51bd80f354f517a7929f1c26b418767d2fbe1
SSDEEP 12:7+tvWm2OXQnqLWEOVP2yMHdqVcV7p5WUYUW5LfpBKKyBGtbDrNTSFbycKrHBGtbK:7+tvWVRnqLEe7sL7yot3BVrHotGGS7
MD5 SHA1 SHA512 SSDEEP

Submit Download

cc.db-journal

Path /data/data/com.zallfuhui.driver/databases/cc/cc.db-journal
Size 512B
SHA256 3b5c795374b0cda91c375a42d4d390e19162e742412b50545a8c895506fcd193
MD5 af5079e551254365aa5616b336eebb2f
SHA1 dcc5f33dad13ad713c986e0d56e68a9e7758fdad
SHA512 de4fcf6752f7e846cafd98621182f4eab4a6f737e8549fd582fdd1353bc1f32a13b2e85cbcf773e5109dbc954cf92d899396ad44fdd0e9122b471ffb2643276f
MD5 SHA1 SHA512

Submit Download

cc.db-journal

Path /data/data/com.zallfuhui.driver/databases/cc/cc.db-journal
Size 8KB
SHA256 1f6a7b7315426590f2030cb885da550d73ce2ecc70fba55b5e73dd4ae696e601
MD5 2a8f1f4fb51a561a803bf1ea8e035696
SHA1 49fd36a5c7e1b82ed11d41645f410e432b984418
SHA512 1fb0e5147423b68b04993988b057f8403ccbe184f1609b9dbe1f5fa516c7ec9aa5c88b123c4ec081f3159599dbc6c568af8a5f1b3810ab4da0e7d5638776a84d
SSDEEP 6:7+/l9bn1Ipg9bNFlEuWdOlOERX4PBX4ogLugMBX4suuKoen:7+tsqLiuWdwRmBEyPbne
MD5 SHA1 SHA512 SSDEEP

Submit Download

cc.db-journal

Path /data/data/com.zallfuhui.driver/databases/cc/cc.db-journal
Size 8KB
SHA256 58b5930a93a3b0345919e2b888633bc390d36c0cce12a653731217aa43ebfce3
MD5 1475bbf8212d0569a00746820a28ca73
SHA1 8b9efec19416bcc90b50ff17ce0f9766a0b9ddb9
SHA512 71fdac70dc61853719d6e6b3930b589186ee63133b08bbe7d371d89fb68148d95d36c10fb0ba9932f81f1ff509afac534b44f320d46c7f926b21bedac12313bb
SSDEEP 6:7+/l9JFPg9bNFlLdrlOERX4PBX4ogLugMBX4suuKIt/I:7+tjBqLJdTRmBEyPbLI
MD5 SHA1 SHA512 SSDEEP

Submit Download

hmdb

Path /data/data/com.zallfuhui.driver/databases/hmdb
Size 12KB
SHA256 885e337c2156e4dbf2176a9677ade50418740532d222ccae5ad4aa371b54c6a4
MD5 ea628e04765adaf4238a5dcdff4bbd51
SHA1 a801947619ea8c368efe9c006a324dc6339ac60b
SHA512 c0287b0e7b690a7231a37d1745c49f3d861b22aa65dd769ba6a8b5ab9da55443f749957781ee05a405019c39e1be45d37a971b821bffd62a1d5620bc39119abe
SSDEEP 6:l9bNFlLdrlOERX4PBX4ogLugMBX4suuKTqiOw2:TLJdTRmBEyPbsOw2
MD5 SHA1 SHA512 SSDEEP

Submit Download

hmdb-journal

Path /data/data/com.zallfuhui.driver/databases/hmdb-journal
Size 8KB
SHA256 77f8111c235c3633c1289553d49cf6002dec1aa82cdab26c787542ecfbf28669
MD5 869900ef88169e5206ed421901ba857a
SHA1 9fbb03711e54dc386ce7215ef70f65d6838916df
SHA512 425b946238da60c7387951ea3bfd1efbaca13e68f91806e4701d717e3aa527e9568c844b2c1d57470c9d2f880409fa5749409baf429555bb0dbd730fd07e9537
SSDEEP 6:7+/l9f0/mHn1EkWg9bNFlEuWdOlOERX4PBX4ogLugMBX4suuK4w:7+t9/uqLiuWdwRmBEyPbRw
MD5 SHA1 SHA512 SSDEEP

Submit Download

hmdb-journal

Path /data/data/com.zallfuhui.driver/databases/hmdb-journal
Size 512B
SHA256 5da4644c69040b9be3a1e3b8abebecb1762a9e916db9ae75c27ce066a9867eda
MD5 93337f661931d28d27fe9b258ea96ebb
SHA1 8ea08e21c4ed6d2dc1eccecc87a9589766ba3d9a
SHA512 58586f162b7fcf65e819d5c85c6c11b86959729a90c3c86dfd474fe8cd539499ba1f855acf0bde3e76eb93134257ed6051e5abe338c05d087c5b1c5f81952d92
MD5 SHA1 SHA512

Submit Download

.imprint

Path /data/data/com.zallfuhui.driver/files/.imprint
Size 919B
SHA256 0ef5bc74f74d0d73077ac1553a7698f61efbe3c3892cec24822a77792ea50c79
MD5 fc8904bccedb2a695ca261bbe8867883
SHA1 d04c0a949e41c142ed86781b89cb2a163e5bad78
SHA512 6c9bf88b6e4ba78b8f9bafa492e8a3c5fa3f468ae2622774febeddb612d83590ccb0413a12f3a464250d918bc77ad093fc40f6fc25e789e2f3a5b865d90265d4
MD5 SHA1 SHA512

Submit Download

exchangeIdentity.json

Path /data/data/com.zallfuhui.driver/files/.umeng/exchangeIdentity.json
Size 162B
SHA256 3156023fd855717e4d04ce96de1def968ecf5631171519ead5bb1cd15a2ef435
MD5 1728ecbf5f9e534fe4c192332460b3d4
SHA1 d9824a127b9ec8f40e279a46461dbd503b7ee1a9
SHA512 4bd9e409a490cf5aff1abf11629b42b2ead7583d4c81b51bb9b883450359141e2e5870dc993dd8102bb38492da6a357f2b7ce822a711b04cc8a2358051a6e8c3
MD5 SHA1 SHA512

Submit Download

umeng_it.cache

Path /data/data/com.zallfuhui.driver/files/umeng_it.cache
Size 350B
SHA256 1910462b5a1677a431b0c7aa97f3e957afdeff32919328965639aab026d46d62
MD5 5bb8ccc91d466522a39255b252935797
SHA1 69001fa3fcd2f8e6a638ce1eb82f139a90ecb054
SHA512 07ca72fdf4baceb9d3c50d07f682aaa6be9c3e0d0c5965b41d6789cde5246ebacd705baec0630407209ec3aee58fe9a4d4374e387981e717e49e5cb18081a9b7
MD5 SHA1 SHA512

Submit Download

umeng_it.cache

Path /data/data/com.zallfuhui.driver/files/umeng_it.cache
Size 178B
SHA256 90922d43c14672ce3c7f439f452bc19952e75ec81153803f84738f9dd2b84680
MD5 7f78e89b97105cbcb214b57aae4e22f1
SHA1 52ccc34390bddb92372074527f84f557c1c3dafd
SHA512 ba27caf80f99ca50904e9730c4ec8cb22eb64e7f265181c424d84c50c7560e32144b8a15f68a4c0a7317e102bca20a4a48ca65a218992983e546cf61a64194c4
MD5 SHA1 SHA512

Submit Download

journal.tmp

Path /storage/emulated/0/Android/data/com.zallfuhui.driver/cache/uil-images/journal.tmp
Size 31B
SHA256 68bb33ddeed9200be85a71f70b377985f9ee68e91578afbde8321463396f1274
MD5 8c92de9ce46d41a22f3b20f77404cc1d
SHA1 8671a6dca00edb72be47363a7071be65cf270373
SHA512 30f45fe9954215d6adafcc8f0a060a7ff41963a64f9b849a37f0d18fe045038d429ec13bf15226769c4ba78dad3c52f3d9e0dbbb4fcdea4828a1efe956e48f56
MD5 SHA1 SHA512

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads