1b5875710a524b9447af6d8f398ba733fdb09d15d99844e24fca8736b92fa899

Analysis

max time kernel
178s
max time network
190s
platform
android_x86
resource
android-x86-arm-20240611.1-en
resource tags

androidarch:armarch:x86image:android-x86-arm-20240611.1-enlocale:en-usos:android-9-x86system
submitted
17/06/2024, 04:23

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
muzhiwanapp.apk
Size 6.8MB
Sample240617-ezzzfstgnc
SHA256 63a4443e53422abf80dffa60c088c72921a4d839d4070613427d9165909ea7e6
MD5 25a12b3e3d69b621f16d6809d57e37ee
SHA1 7c3026ac9bef20aa6c274a0ae0b2894ed27a39c6
SHA512 d04d3fd4fa2d0911f1831b29c5b3031cd45349f8b916a1400a1789751c341272edcdb37b20ba468f759962f1aa7da174a58ced8cfaab1ccefa27dba19b445b47
SSDEEP 196608:udfDsgl7Fo3HcMg5+knzUsd3wIm1vM4MY2oNs:eAKm3lO+kz7dg3oGs
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

discovery evasion impact persistence

Malware Config

Signatures

Checks if the Android device is rooted. 1 TTPs 1 IoCs

evasion

System Information Discovery

T1426

ioc	Process
/sbin/su	sh

Queries information about running processes on the device 1 TTPs 3 IoCs

Application may abuse the framework's APIs to collect information about running processes on the device.

discovery

Process Discovery

T1424

description	ioc	Process
Framework service call	android.app.IActivityManager.getRunningAppProcesses	com.muzhiwan.market
Framework service call	android.app.IActivityManager.getRunningAppProcesses	com.muzhiwan.market:mult
Framework service call	android.app.IActivityManager.getRunningAppProcesses	com.muzhiwan.market:mzwlogservice

Acquires the wake lock 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.muzhiwan.market

Queries information about active data network 1 TTPs 2 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.muzhiwan.market:mult
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.muzhiwan.market

Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.wifi.IWifiManager.getConnectionInfo	com.muzhiwan.market

Reads information about phone network operator. 1 TTPs
discovery

System Network Configuration Discovery
T1422

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 2 IoCs

persistence

Broadcast Receivers

T1624.001

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	com.muzhiwan.market
Framework service call	android.app.IActivityManager.registerReceiver	com.muzhiwan.market:mult

Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

impact

Data Encrypted for Impact

T1471

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	com.muzhiwan.market

com.muzhiwan.market
1⤵
- Queries information about running processes on the device
- Acquires the wake lock
- Queries information about active data network
- Queries information about the current Wi-Fi connection
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Uses Crypto APIs (Might try to encrypt user data)
PID:4296
- getprop ro.board.platform
  2⤵
  PID:4430
- cat /sys/class/net/wlan0/address
  2⤵
  PID:4473
- getprop ro.mediatek.platform
  2⤵
  PID:4489
- cat /sys/class/net/wlan0/address
  2⤵
  PID:4570

com.muzhiwan.market:mult
1⤵
- Queries information about running processes on the device
- Queries information about active data network
- Registers a broadcast receiver at runtime (usually for listening for system events)
PID:4330
- cat /sys/class/net/wlan0/address
  2⤵
  PID:4611

com.muzhiwan.market:mzwlogservice
1⤵
- Queries information about running processes on the device
PID:4385
- sh
  2⤵
  - Checks if the Android device is rooted.
  PID:4595
- getprop ro.board.platform
  2⤵
  PID:4642
- su
  2⤵
  PID:4668
- getprop ro.mediatek.platform
  2⤵
  PID:4683

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Process Discovery

T1424

System Information Discovery

T1426

System Network Configuration Discovery

T1422

System Network Connections Discovery

T1421

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

T1471

Replay Monitor

Loading Replay Monitor...

Downloads

mzw.apk

Path /data/data/com.muzhiwan.market/data/mzw.apk
Size 42KB
SHA256 abffa567da8045874417654e8a98ef889f729455aa0e48b11a89b95e386e0ef8
MD5 85d09558a30b56872ec4df7909292387
SHA1 799259262e84952063d2013b843285d4b9865c5e
SHA512 3a97ecb531586f8b4d85877a2bfd5878c0b63c99ca12a6adb06d143fc676f67a5ee060e25a730c36eaa9693ab15048782f1810e818f5fd8005c60dd9465fe755
SSDEEP 768:ccPev5+Ew7aX4WkB/ggrXFWLKxP7X+Fu91Rv6XY3QpDJX7aMkuzkjEC:ccPehW9WkdbgLKxP7wuHt6X1FLaMm3
MD5 SHA1 SHA512 SSDEEP

Submit Download

mzw.d

Path /data/data/com.muzhiwan.market/data/mzw.d
Size 59KB
SHA256 947b819dee583b592e9e7ae338e555cdd4e22ac600cabb5450159e82b45017d9
MD5 4e28e0ae894890e8ba1bf33c38d160e5
SHA1 53bbf5e8453751a9e2c45ca19d841c876705ea37
SHA512 9361e43d38e70c5a7b9340137ef197e08ccb6385d1ef39a377cf7a3d14b4be304333065165315a6d23c9f58809b8c1939909718967f65d1625d5246952ebfcd6
SSDEEP 1536:xYRcpcHK5bgLKxewwuss6XzydaFcBowg/pL2Nka2MXX3C:acKHKUKxM/Xzyg/pyKiXnC
MD5 SHA1 SHA512 SSDEEP

Submit Download

mzw.g

Path /data/data/com.muzhiwan.market/data/mzw.g
Size 42KB
SHA256 0a5526ccfac38e61dae1d4f33bf398eed7ce923bd9f78328290415b613503dfd
MD5 40c9009df954891f0a04a798ab8b9a67
SHA1 495d2d87c70a3c4f7db522b83b80d80c919c3917
SHA512 eebb8a4ddf2a9d6d6f71454b8513608b44a052946c353a2a327b485bf33b5ea9dee477625c2497a8c3c4c2f1d51884bab1bf52530c234dc39fba8d16a8dae9f9
SSDEEP 768:AY6maX9WkB/gUrXFWLKxe7X+Fu9hRv6Xf3QpD+X7aFkuzkjEC:AYYWkZbgLKxe7wuzt6XCyLaFm3
MD5 SHA1 SHA512 SSDEEP

Submit Download

notes-db

Path /data/data/com.muzhiwan.market/databases/notes-db
Size 4KB
SHA256 0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514
MD5 f2b4b0190b9f384ca885f0c8c9b14700
SHA1 934ff2646757b5b6e7f20f6a0aa76c7f995d9361
SHA512 ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1
MD5 SHA1 SHA512

Submit Download

notes-db-journal

Path /data/data/com.muzhiwan.market/databases/notes-db-journal
Size 512B
SHA256 d3e98b959b979865be04780e053e093d53f0fbf71be8608ff881aaed0ae5cb75
MD5 5a847a9ca1650d5ca1b744d9c00532cc
SHA1 219dec03306c7f0ecde2618e7f3b80bda25fd6d0
SHA512 e53ad006f03c7af79b136e38396f11091774b916e069f67af7f86e49a7a83fafc4ade2f84a5e257b750910a2772576b66788e844818a621491f8a75e16b267ba
MD5 SHA1 SHA512

Submit Download

notes-db-shm

Path /data/data/com.muzhiwan.market/databases/notes-db-shm
Size 32KB
SHA256 b0f0410691f9b57a30f4470177f7d7aa9c106b599603863cde4dbbcdbc0ac965
MD5 fa9e03a8baf2652966ab75e59fad150b
SHA1 c92c92ece6b7a2675e0075c0e4ad5009a677a898
SHA512 20f1d354fb7a1c56c77bdf554ba75a747db37bd61f524c801639f807ad12a326c7af2d3b1af924e4f9566208de51d4ab21ad6cb5523a0c5df70a506f3b7649da
SSDEEP 96:b7YevvTq6MLG6nH8oUvTq6MLG6nH8oO13f:HYevGXJH4GXJHK
MD5 SHA1 SHA512 SSDEEP

Submit Download

notes-db-wal

Path /data/data/com.muzhiwan.market/databases/notes-db-wal
Size 28KB
SHA256 bdced84ea138d694d5e0a981e5349a5a20d296d75837e1f2b45c3f5cc7cc61a7
MD5 7aab72c65157bf6c57e7e8b6e82ebe5e
SHA1 73f7d6d50be30fd8b84415037b782b38a7186873
SHA512 8cecfe42733c8f2a864c9daecc0c2360666f951e0ba86664b9b9993c82867f4b2254679f79155854a8e7513833fab0d553463f45a8230558c4ab855d0ca8adb5
SSDEEP 24:K6yzyGSP/fvFJWGGMLi5LYcD66GNGSP/:PyzNSP/fPcMLi5RDHSP/
MD5 SHA1 SHA512 SSDEEP

Submit Download

install_file_dir

Path /data/data/com.muzhiwan.market/files/install_file_dir
Size 5KB
SHA256 17adadfbe797cc54277c3236e9a84568c102dfc63c54ed64d073d02b6424e885
MD5 72a239b77072f4a325001408279d8756
SHA1 779ff775879ecb0b2f0778ff8311de79b67eadd7
SHA512 9087ecc8d32faf66d91b1f10cddcc7c8cd7d28d28de9014f08413cad8904683d3b81cd75b25892f5342ff4b8f013fb46edf97bde91648ac1dd48d44db7584c7c
SSDEEP 96:jqYevvTq6MLG6nH8oUvTq6MLG6nH8oO13fH:mYevGXJH4GXJHK1
MD5 SHA1 SHA512 SSDEEP

Submit Download

install_file_dir-journal

Path /data/data/com.muzhiwan.market/files/install_file_dir-journal
Size 1KB
SHA256 d4092342486045b080959ca92f5a9d745d0738dae89edaf73f2dd4e8d6883d40
MD5 d7eddd3dfd21408d5c582e69efb2423b
SHA1 f3323b7db9fa489c022c42f9f9c6d2ab3e272b8f
SHA512 2f6b079009e5505a3fb53daa9c7f85e12c8586eed3fe2be9e9525618bae0b687fbf6adf6792d5b3cf60f130b1d263b399cf71f0f5c434af9e2e12f35903769e1
MD5 SHA1 SHA512

Submit Download

install_file_dir-shm

Path /data/data/com.muzhiwan.market/files/install_file_dir-shm
Size 32KB
SHA256 c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
MD5 bb7df04e1b0a2570657527a7e108ae23
SHA1 5188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA512 768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012
SSDEEP 3::
MD5 SHA1 SHA512 SSDEEP

Submit Download

install_file_dir-wal

Path /data/data/com.muzhiwan.market/files/install_file_dir-wal
Size 3KB
SHA256 b43c3f353e556b95cd999b4bbbd9f68a05d0e6b9ad3b6811c2d833a94091c559
MD5 d55dff71c436f11ff1474298384f96ea
SHA1 1f8d1f131e06a9edea9f291c1d368629a9403135
SHA512 6022662662a059ecbf769b61950657ca44c46076d142ce959271589b18b39bbc0816105064555ffc307f1b56d17e35b43890056284942696ee09eb775a4cf44f
MD5 SHA1 SHA512

Submit Download

.push_deviceid

Path /storage/emulated/0/data/.push_deviceid
Size 32B
SHA256 087253abf6b2bd758211f9b3ee3b0d326885e47dbfcf5cb47ac75473adf00528
MD5 c241f4ceca9f401205d1e531b1f23dec
SHA1 12012a75dc24b4ca663bdc8b8f81d31f296dbd15
SHA512 7eb626168251454e265e2a705a6b32c5cc2e2901045f7737c99359328f1e90eb25e29fddeec37c78d471a9935cc63274fdfe3b18ce7c4b9d49a2bf78a1be576e
MD5 SHA1 SHA512

Submit Download

.systemid

Path /storage/emulated/0/data/.systemid
Size 42KB
SHA256 14b68457395896d3ffe12b777f52fe2cc4182a6c9ba383555b12522c93657b00
MD5 7bc525aa5cfd71cd4d2ad570fd72a906
SHA1 b411e1b345b5e9e4a0e4f603b46277278981e921
SHA512 5f1973360665bdeb536d8dc2a9c5d2077990fbc6fd3653747de9d54c7032a776151f39986792ab57773623a143b2d65cfbb585aa53c823197485eba9e75c8e2f
SSDEEP 768:ccPev5+EU7aX9WkB/gUrXFWLKxe7X+Fu9hRv6Xf3QpD+X7aFkuzkjEC:ccPehi4WkZbgLKxe7wuzt6XCyLaFm3
MD5 SHA1 SHA512 SSDEEP

Submit Download

.systemmac

Path /storage/emulated/0/data/.systemmac
Size 1KB
SHA256 f1f15dc3999c65e2ad4273f562c2c0914f28110bb037c8e128d71b9fa9e11c69
MD5 769a4571bdec39e4cd01ec1290ce14e1
SHA1 c4c14a739800390b84460dd88f9f040357209c50
SHA512 66659dc3fe48487590caf2049dd6fb24dbd076a725a525d71bf2e0e94e3d6ed0d2fdddd8c4fa8cb0b4cd02d9a2ffab8ede51bf2936fa7dabbafa39eee8cfa0de
MD5 SHA1 SHA512

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads