f9388ccb5b780d1527949641958afdecae08a28a67b8a0840ab68af25b9a3c6c

Analysis

max time kernel
179s
max time network
186s
platform
android_x86
resource
android-x86-arm-20240611.1-en
resource tags

androidarch:armarch:x86image:android-x86-arm-20240611.1-enlocale:en-usos:android-9-x86system
submitted
16/06/2024, 04:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ccplaymerket.apk
Size 5.9MB
Sample240616-e9cxnszemh
SHA256 86632ccbff13be30bb5628e130facf92e8d84e22f95eb5fbf117695209b7f83f
MD5 fec090046d831ce52cf95b5487b866ff
SHA1 f004c200eb9b2b78ea24cb4d7b9e7aab7de258e7
SHA512 df647a0887a0e714604c1643877fc9f1197bef76e89324df8edd2fdabe91898ea44fca652851c67af3db52a27d9bcc7873bd9fe68289d9db1c4437ae57a830ad
SSDEEP 98304:EXB2RaqiyR/tRSbgxPCnOpdtXU0jkys0X8bp9Tf7eKtw2k69O0d8gkgv4FSuoyA7:EXBHfOCnQdaPyseW/htu0yNtkubium
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

banker collection credential_access discovery evasion persistence

Malware Config

Signatures

Makes use of the framework's Accessibility service 4 TTPs 1 IoCs

Retrieves information displayed on the phone screen using AccessibilityService.

collection evasion credential_access

Input Injection

T1516

Screen Capture

T1513

Keylogging

T1417.001

GUI Input Capture

T1417.002

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	com.lion.market

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
banker discovery

Security Software Discovery
T1418.001

Queries information about running processes on the device 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about running processes on the device.

discovery

Process Discovery

T1424

description	ioc	Process
Framework service call	android.app.IActivityManager.getRunningAppProcesses	com.lion.market

Requests cell location 2 TTPs 1 IoCs

Uses Android APIs to to get current cell location.

collection discovery evasion

Location Tracking

T1430

Geofencing

T1627.001

description	ioc	Process
Framework service call	com.android.internal.telephony.ITelephony.getCellLocation	com.lion.market

Queries information about active data network 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.lion.market

Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.wifi.IWifiManager.getConnectionInfo	com.lion.market

Reads information about phone network operator. 1 TTPs
discovery

System Network Configuration Discovery
T1422

Listens for changes in the sensor environment (might be used to detect emulation) 1 TTPs 1 IoCs

evasion

User Evasion

T1628.002

description	ioc	Process
Framework API call	android.hardware.SensorManager.registerListener	com.lion.market

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs

persistence

Broadcast Receivers

T1624.001

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	com.lion.market

com.lion.market
1⤵
- Makes use of the framework's Accessibility service
- Queries information about running processes on the device
- Requests cell location
- Queries information about active data network
- Queries information about the current Wi-Fi connection
- Listens for changes in the sensor environment (might be used to detect emulation)
- Registers a broadcast receiver at runtime (usually for listening for system events)
PID:4297
- getprop
  2⤵
  PID:4375

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Privilege Escalation

Defense Evasion

Execution Guardrails

T1627

Geofencing

T1627.001

Hide Artifacts

T1628

User Evasion

T1628.002

Input Injection

T1516

Credential Access

Input Capture

T1417

GUI Input Capture

T1417.002

Keylogging

T1417.001

Discovery

Location Tracking

T1430

Process Discovery

T1424

Software Discovery

T1418

Security Software Discovery

T1418.001

System Network Configuration Discovery

T1422

System Network Connections Discovery

T1421

Lateral Movement

Collection

Input Capture

T1417

GUI Input Capture

T1417.002

Keylogging

T1417.001

Location Tracking

T1430

Screen Capture

T1513

Command and Control

Exfiltration

Impact

Input Injection

T1516

Replay Monitor

Loading Replay Monitor...

Downloads

com.lion.market.db

Path /data/data/com.lion.market/databases/com.lion.market.db
Size 4KB
SHA256 0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514
MD5 f2b4b0190b9f384ca885f0c8c9b14700
SHA1 934ff2646757b5b6e7f20f6a0aa76c7f995d9361
SHA512 ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1
MD5 SHA1 SHA512

Submit Download

com.lion.market.db-journal

Path /data/data/com.lion.market/databases/com.lion.market.db-journal
Size 512B
SHA256 5cdaa5d7f127099144579b04f14a55ec0ed58cf0573b6f0bb6bea6291ac881f6
MD5 2206d17eb025a1614cce6a47e2f8989b
SHA1 9a65ee477f2c61add989f41ff5d6058e643f1dbf
SHA512 b674e508a4125f52a4be0b4a46aa5e51f46451a56d3b1a3de69f918763d4bc74ad65f555ba534db15a7e406eae5ab07c7cf28dd8e04979ad16690530023ed7ae
MD5 SHA1 SHA512

Submit Download

com.lion.market.db-shm

Path /data/data/com.lion.market/databases/com.lion.market.db-shm
Size 32KB
SHA256 c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
MD5 bb7df04e1b0a2570657527a7e108ae23
SHA1 5188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA512 768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012
SSDEEP 3::
MD5 SHA1 SHA512 SSDEEP

Submit Download

com.lion.market.db-wal

Path /data/data/com.lion.market/databases/com.lion.market.db-wal
Size 60KB
SHA256 7e40409fd991c2bce9b1b6d266ef27f1a3eabe6c14c57973dddfb52f7068337d
MD5 6aaea86a07e1c762a26b083726e15101
SHA1 fd4c16673a7b54f7ec085884c1c5c649131381d2
SHA512 fe1b59378ba52b56dd44d4cb16a71778fae6b24955167069c1de187a253b297c9790e328960973469ac23a11756f9e2b5d0b0636ae4da1ab3302085568f55c22
SSDEEP 48:9zNSP/BUqbgscC7YOPNrMC28v5mSP/UAY:50PWqbgscvkNr1DPK
MD5 SHA1 SHA512 SSDEEP

Submit Download

TDtcagent.db

Path /data/data/com.lion.market/files/TDtcagent.db
Size 32KB
SHA256 b455bb6d9ca4b802054f6f1e72d66184b37897ba60a1e5b5de456454ddd07828
MD5 0fcb31920c258bcb52a89d3acddf2d4a
SHA1 dd764d611e087ef4e43f0a5cd3f3be85e062eb17
SHA512 009f5d30aedf58e5c88835cee9a6b87a073660627beda8a09070eeb9139be05f78d11677ce31152f57a988ff132a469d9231140fea3f4c7cb078d39fa55509a3
SSDEEP 24:Ts3nxeb0TDHYB0ECWYqlBl8Uxz/gpEGSZGQQQ:TgxeYTDHY8qlBaUd/gpTS
MD5 SHA1 SHA512 SSDEEP

Submit Download

TDtcagent.db

Path /data/data/com.lion.market/files/TDtcagent.db
Size 20KB
SHA256 2bc52a2af51ff8d252a6547adac10d21a288e784ef9d9ff8d844f783de9888c6
MD5 8887f3e19d7ec06a9bfaf34296639af8
SHA1 8d46f4ad6dd9736e42fe7471a62ab60cc2ae4b7a
SHA512 2ea84a1836eda900954988bb5f2ecf9fa135d5131a734d27984b3afc07569004de086c881ffb6f5bf2cbc3c639e099e1e692a53006dd26c82674def084c05db2
SSDEEP 3:pqepsbbJaERRjC7ovolXqD1ejW/:pq7HJaERRW7JXen
MD5 SHA1 SHA512 SSDEEP

Submit Download

TDtcagent.db

Path /data/data/com.lion.market/files/TDtcagent.db
Size 24KB
SHA256 d76ef98e8d84a99a44fd54f5465c5874132221a5bfd159f3d7dd63cfcf95125b
MD5 0fe0964b832b1724f146b0620649cb81
SHA1 3eeb88d24b44ae62b454b3a326421f95d8ce1af4
SHA512 5b9e4e87055e98996ae3bb5589983e8f465946ea5bb9c1e2a15a4fefad016c2a9000692987e0fd6ea2e7a5fef695f4166c47f35dcb951a094533c37148681244
SSDEEP 3:qqH/DbMTJvviW8Q/X9Qow78fFQckwoGcaJEaERRjC+b:d/DbMTJvyo9kIQcrTJEaERRWk
MD5 SHA1 SHA512 SSDEEP

Submit Download

TDtcagent.db

Path /data/data/com.lion.market/files/TDtcagent.db
Size 24KB
SHA256 8e7d282bacb437271f0af39e582566c03fbc0b33408f261f88d76812e8265524
MD5 f5704255945fc1281335af1e8eae77c9
SHA1 215b95bf7bd7b54db524cac5d2c13d706f342a0a
SHA512 a308b4339be5ce2fb6d21b487384fb087d5bcda93b61530eae5d62725e7323e24a8cf98f1386c4da765b4100103acd07974e90cb6c7826790714d0d317102a9e
SSDEEP 6:tj5nUFLQcrr8aERRWBQclgHIQcrTJEaERRWk:fUFLQcP6WBQcliIQcvl6Wk
MD5 SHA1 SHA512 SSDEEP

Submit Download

TDtcagent.db

Path /data/data/com.lion.market/files/TDtcagent.db
Size 28KB
SHA256 9b502a469eadf6d142813d137dd88c4bd1e1e135ddc204adb4901ef399af30de
MD5 17b04d33f5d31c59d70342fc75cd1516
SHA1 ffb5e35ae76446d2847df9f5cba576ea65bd627b
SHA512 439aad577dc44823d334eedeb53fb5c503a629ce7707ac4db372430adcce9da5600408b77aa4737a365712093582504ede98fc2772d595cc2ec4cc4546788b65
SSDEEP 3:rqK9/HLRo4kEn3iWhqPw/km6dAgDAJEaERRjC7o8oz6PO5n:rqotdnXqPaP6DWEaERRW7hZkn
MD5 SHA1 SHA512 SSDEEP

Submit Download

TDtcagent.db

Path /data/data/com.lion.market/files/TDtcagent.db
Size 40KB
SHA256 22d66d2fb92b9aa7dcd6aff53144df2402f1daa4a1457d37e852868b015e8e05
MD5 04f8d442c77df7647ebe76e957ca22b9
SHA1 efb10dd8a7f5d86e1e8d18278b1b0b390dcf6e8b
SHA512 c1674ad0db824dfb5b4d0230fa1f0533c7185e35ae05654c83a2564f7b7bd8776ddcda6ac27369f51ddc8601b647eb781f36c3ee1f32e5652f12750a03ce93ec
SSDEEP 192:f8q/BeHdryd/B0evQvcTjkUt2ZbIeh2cP1Wu0T67eU4:JVdrEc/kUt2ZrhF9Wu0N
MD5 SHA1 SHA512 SSDEEP

Submit Download

TDtcagent.db-journal

Path /data/data/com.lion.market/files/TDtcagent.db-journal
Size 512B
SHA256 81c48e0679dccb7cf69c12cd4f0293315af3ed44ede380404ad4482457d0ede8
MD5 5de4520d567af159ee9ac1c9e4f61c7c
SHA1 87d254c431cd57619602417cdf380233ce2abd50
SHA512 5ae0b0c144eb34c5243ca2d33bca860679d83b946bacc50a1572de41ae18072e1ec608265f8eca8a8b6efa8eedb766d5397e172f9a3544ef2d0e9cce54c3b086
MD5 SHA1 SHA512

Submit Download

TDtcagent.db-wal

Path /data/data/com.lion.market/files/TDtcagent.db-wal
Size 72KB
SHA256 243d2bf10271c0517a1cc18792aacef32fd510973f8c8689154a3746ebca96f3
MD5 19ffb28af57703ecac25b7f173a5a613
SHA1 b64583b0ff6bf6a0508ee41dc05ad8cf92421285
SHA512 bab7dffad7a31ef874f2968873e1a5f6e68ee52699a7f1a519b74c67c9ca004df1dc486f3461d953813c70c80d096c02d0618cfa120a1f9069be3ec850e82e4f
SSDEEP 96:df0PBaqrPkUd/gpWP23ql8Ud/gpWPe8ql8Ud/gpWPltg8ql8Ud/gpWPf:dI0C5Bea23q/Beae8q/Bea08q/Beaf
MD5 SHA1 SHA512 SSDEEP

Submit Download

TDtcagent.db-wal

Path /data/data/com.lion.market/files/TDtcagent.db-wal
Size 8KB
SHA256 c6114fbe6b85b713f88bf6cc7f0d4b74e7dc7898db95974e7c983cf88da0c82a
MD5 43c101bc7136513d6e6bb3fec0b5dea6
SHA1 fe10bc74a3abe51294d6cdc0338ca34563ca7854
SHA512 ca3dff10a32b536f6b6b1d8c100f047d3cf85117e0fb34c4c9b311d303bca91978561371a2587f065d2199e41650d9506724a109a029daeea3b4d938f8122b62
SSDEEP 3:OlH/lo1oFx/J/oxjvislljepsbbJaERRjC7ovW/u5oeKrXqD1ejW/:K6HxDiElj7HJaERRW71/u5urXen
MD5 SHA1 SHA512 SSDEEP

Submit Download

TDtcagent.db-wal

Path /data/data/com.lion.market/files/TDtcagent.db-wal
Size 8KB
SHA256 35299b99c397eec287882703a6857ce7255ce580e47b32543ec7d4bd71550725
MD5 7e4ed6217abe1b7db462b695b49a9372
SHA1 33cb989b7e0e82e8314fa4514c5ba695ded350ec
SHA512 605db99e9e5bfead02d0c5daff8767f2de6ab6c4bfb0f0a511bc1ce3dabb153b001277c6d191d09a01b8089bfb901b0356f93a386d3f6df1c08d89da0787a520
SSDEEP 6:K25IQcFN/DbMTJvB6foo9kIQcrTJEaERRWk:KtXDuYvkIQcvl6Wk
MD5 SHA1 SHA512 SSDEEP

Submit Download

TDtcagent.db-wal

Path /data/data/com.lion.market/files/TDtcagent.db-wal
Size 8KB
SHA256 6d943d9867ddd133bb0ee594b6784b3d1dc98a9f5dd77e05854dbb998a1d6b19
MD5 b68ed2937cf8262a5065d433a24f49d1
SHA1 8d334130e2b4d250470446c958f4d5e7cc2383db
SHA512 4cfe48e3136eccdcf9c9b8a733e1979a7cb6d01c193bca27764277a9fce3280354fe7f4609ebf56990085a2aa3b9874786d07a752eea11fe342ec87c5af62aea
SSDEEP 6:KOFC742Fi+wQj5n8F3mT9bFLQcrr8aERRWBQclgHIQcrTJEaERRWk:KqC7ijwUobFLQcP6WBQcliIQcvl6Wk
MD5 SHA1 SHA512 SSDEEP

Submit Download

TDtcagent.db-wal

Path /data/data/com.lion.market/files/TDtcagent.db-wal
Size 8KB
SHA256 5827f3c5ac60cb5245f3a38e0ece90fc3c9bab19b4469ec24ba62ee6931faa16
MD5 ba7628c1097419841305fab6d9b3a777
SHA1 3c7743c92119585a01295693ec96788e08206c05
SHA512 0997d132596311bed90fd2f18ed6d060c9f6660a2d3dbf7dfb6e9fb69d521e903c9872538176817a6819c432e734bb5159726f04390e5bc2ed3cfc9caee4b66f
SSDEEP 3:OlH/llxsXPlFjrcoe9/HLRo4kEn3iWglTzrTpO+mE4kqPw/km6dAgDAJEaERRjC8:KiNH0tdnSGkqPaP6DWEaERRW7hZkn
MD5 SHA1 SHA512 SSDEEP

Submit Download

TDtcagent.db-wal

Path /data/data/com.lion.market/files/TDtcagent.db-wal
Size 24KB
SHA256 32bfd09c1fe5931091f200744d19a6469d21fdbc64d02fed9ca271e4a166fef4
MD5 02aa519143efa96b577fdb42f547355f
SHA1 0f5f5309b4326405b11f84abd9fc8b897a2bd4eb
SHA512 b049c5ce157cd3910949740cf00ba7145437d368429d39f000480cfad99758e569a8e10aaeaebb7ab0f09821f57223f962f2006ebb1e01c795747163ec8674a5
SSDEEP 192:F8q/BeaHdrhevQveTjkUt2ZbIeh2cR1Wu0T67eU4:fQEe/kUt2ZrhFXWu0N
MD5 SHA1 SHA512 SSDEEP

Submit Download

jpush_stat_cache.json

Path /data/data/com.lion.market/files/jpush_stat_cache.json
Size 132B
SHA256 e11fa1f1ab4ab221a6c70e49c6b644f37322cb5c449dfb5a18e81842e26753f3
MD5 f617e30101babcb1ce7a9dab4c9dc83b
SHA1 27949c096cb67809bf5b5deec8989435e3237d4b
SHA512 a36ed4a904beff94dd88cf535cf49cd66a5e64925dd4a711a7aaeba6121526679e4d9c6766de58b0346befd460db059d6b0925c243aced247ebee63838306a1f
MD5 SHA1 SHA512

Submit Download

.ccplay_com.lion.market

Path /storage/emulated/0/.ccplay_com.lion.market
Size 15B
SHA256 2803938220892127f61e92adbb452bfb4041794162408b09ae68f7f82ea45dbf
MD5 27598b61d844914b41a0a9cde80fb4ce
SHA1 e0deabe6efc8332027d25feda360c04f00b8dd54
SHA512 a0dd710a51dd9d1ab5a11bf7799a3efbd413ba8a594f41446f28b1a05b8e34e6f88abdedc6c40048361d7c2aab45a4fc9430a567200b5a53643440672f7f2892
MD5 SHA1 SHA512

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads