1b5875710a524b9447af6d8f398ba733fdb09d15d99844e24fca8736b92fa899

Analysis

max time kernel
178s
max time network
193s
platform
android_x64
resource
android-x64-20240611.1-en
resource tags

androidarch:x64arch:x86image:android-x64-20240611.1-enlocale:en-usos:android-10-x64system
submitted
17/06/2024, 04:23

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
muzhiwanapp.apk
Size 6.8MB
Sample240617-ezzzfstgnc
SHA256 63a4443e53422abf80dffa60c088c72921a4d839d4070613427d9165909ea7e6
MD5 25a12b3e3d69b621f16d6809d57e37ee
SHA1 7c3026ac9bef20aa6c274a0ae0b2894ed27a39c6
SHA512 d04d3fd4fa2d0911f1831b29c5b3031cd45349f8b916a1400a1789751c341272edcdb37b20ba468f759962f1aa7da174a58ced8cfaab1ccefa27dba19b445b47
SSDEEP 196608:udfDsgl7Fo3HcMg5+knzUsd3wIm1vM4MY2oNs:eAKm3lO+kz7dg3oGs
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

banker collection credential_access discovery evasion impact persistence

Malware Config

Signatures

Loads dropped Dex/Jar 1 TTPs 4 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/data/com.muzhiwan.market/data/mzw.apk	5159	com.muzhiwan.market
/data/data/com.muzhiwan.market/data/mzw.d	5159	com.muzhiwan.market
/data/data/com.muzhiwan.market/data/mzw.apk	5282	com.muzhiwan.market:mzwlogservice
/data/data/com.muzhiwan.market/data/mzw.apk	5206	com.muzhiwan.market:mult

Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs

Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.

collection credential_access impact

Clipboard Data

T1414

Transmitted Data Manipulation

T1641.001

description	ioc	Process
Framework service call	android.content.IClipboard.addPrimaryClipChangedListener	com.muzhiwan.market

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
banker discovery

Security Software Discovery
T1418.001

Queries information about running processes on the device 1 TTPs 3 IoCs

Application may abuse the framework's APIs to collect information about running processes on the device.

discovery

Process Discovery

T1424

description	ioc	Process
Framework service call	android.app.IActivityManager.getRunningAppProcesses	com.muzhiwan.market
Framework service call	android.app.IActivityManager.getRunningAppProcesses	com.muzhiwan.market:mult
Framework service call	android.app.IActivityManager.getRunningAppProcesses	com.muzhiwan.market:mzwlogservice

Acquires the wake lock 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.muzhiwan.market

Domain associated with commercial stalkerware software, includes indicators from echap.eu.org 1 IoCs

flow	ioc
18	alog.umeng.com

Queries information about active data network 1 TTPs 2 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.muzhiwan.market
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.muzhiwan.market:mult

Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.wifi.IWifiManager.getConnectionInfo	com.muzhiwan.market

Queries the unique device ID (IMEI, MEID, IMSI) 1 TTPs
discovery

System Network Configuration Discovery
T1422
Reads information about phone network operator. 1 TTPs
discovery

System Network Configuration Discovery
T1422

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs

persistence

Broadcast Receivers

T1624.001

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	com.muzhiwan.market:mult

Checks CPU information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	com.muzhiwan.market

com.muzhiwan.market
1⤵
- Loads dropped Dex/Jar
- Obtains sensitive information copied to the device clipboard
- Queries information about running processes on the device
- Acquires the wake lock
- Queries information about active data network
- Queries information about the current Wi-Fi connection
- Checks CPU information
PID:5159

com.muzhiwan.market:mult
1⤵
- Loads dropped Dex/Jar
- Queries information about running processes on the device
- Queries information about active data network
- Registers a broadcast receiver at runtime (usually for listening for system events)
PID:5206

com.muzhiwan.market:mzwlogservice
1⤵
- Loads dropped Dex/Jar
- Queries information about running processes on the device
PID:5282

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Clipboard Data

T1414

Discovery

Process Discovery

T1424

Software Discovery

T1418

Security Software Discovery

T1418.001

System Information Discovery

T1426

System Network Configuration Discovery

T1422

System Network Connections Discovery

T1421

Lateral Movement

Collection

Clipboard Data

T1414

Command and Control

Exfiltration

Impact

Data Manipulation

T1641

Transmitted Data Manipulation

T1641.001

Replay Monitor

Loading Replay Monitor...

Downloads

mzw.apk

Path /data/data/com.muzhiwan.market/data/mzw.apk
Size 17KB
SHA256 d0990058e5204d1a1bde2eff40893cb49d1e8972ee9b7e1b03ae35ac3cd5df8b
MD5 e65188742e10046597a4c648d045699b
SHA1 37b2f1e3e89d3b0d8683737ccae2ee725e82a312
SHA512 3859b177492c74ec9448f7c57cf37beb7c747dca9580125cbd7c2e1f3a7761a3736072b1ec2ee14fa1f844f13df4163aa167b5cb9010e7e7fd00b2724553d481
SSDEEP 384:s5X5qqwv/p1FQkfP7EI5dPbh69aFw4GoXzOOo6MGd5Ij//LQf:GXjwpokfPAI5dPbh69aFuoHOjnLs
MD5 SHA1 SHA512 SSDEEP

Download

mzw.d

Path /data/data/com.muzhiwan.market/data/mzw.d
Size 59KB
SHA256 8ed0334ca9a544ae6df0b374ae02e36116be7be1edc8d22644acfa6c499dbab5
MD5 b628582deca26988e84f5a05b8dbe6ae
SHA1 bb572124fc4787458ef140050916cf9c7da61bd0
SHA512 2ed821c89fae062f6e3ee5712f632ff089a3d55834cd1ede4183d3d01fcfad2e23b53b42966fd64eb3a174d4b62bea525c3c8502c4bf4e7c6dfd0f0f6613ca8c
SSDEEP 1536:VYMqpcH/obgLKxe7wust6XTyLaFcBowg/pL2Nka2MXX3C:rqKH/BKxXMXTym/pyKiXnC
MD5 SHA1 SHA512 SSDEEP

Submit Download

mzw.d

Path /data/data/com.muzhiwan.market/data/mzw.d
Size 33KB
SHA256 d9c6e60caf46fbde6806d9a435bf1cf9e75cd079e6ffdf15c7646455d1fc68e6
MD5 b29b924ea036a89d3fe128ad672b44d7
SHA1 de946ed8fa199708a925c144f816a60ce4679d50
SHA512 f8706d824ef68815b8ca5cdc01138fbe63afe6c9832cc757d94633c4b140809fe0a5018b7bf825c630870abd35e710ddc521ba1aabae8ef3d8223037537b739f
SSDEEP 768:Orfmq7x7olxUWtZZYvyzJGRuxC8Idm0nfR9REU/qAJodsC1L/71:Orfmq7x7olzJz7C8Idm0fR9RN/qAJoL/
MD5 SHA1 SHA512 SSDEEP

Download

mzw.g

Path /data/data/com.muzhiwan.market/data/mzw.g
Size 42KB
SHA256 7a28fd857e1283e351d37931cc6e23cd6de5ad2fd4d3d23337a6f162b07f3978
MD5 c04d422c5a4bf58a127bbf2bf014965c
SHA1 3b1f3f4ad21fe0febe567e5a56996a7e61658cf9
SHA512 6cb2768a8344e3da470472ea906b5be2e33a24384efe35cdc3c0b0c24351c3b34444a4d2d6a9e21c48927b85554aaa3904fb0361071c0711841565222253e0a8
SSDEEP 768:ccPeR+EU5maX9WkB/gUrXFWLKxe7X+Fu9hRv6Xf3QpD+X7aFkuzkjEC:ccPeRiNWkZbgLKxe7wuzt6XCyLaFm3
MD5 SHA1 SHA512 SSDEEP

Submit Download

download

Path /data/data/com.muzhiwan.market/databases/download
Size 16KB
SHA256 3ec5d92abe7028b28567c5a9f069e0773cce90ca67f525e6d67ec402c5af52db
MD5 1ced0d005a5b81072efcefad72f5e251
SHA1 2313e9322d28667c91620e1c26a7963b743ec5b2
SHA512 cbc1ef3e49627fbaf898f733e3a53082aff4db6d2f0cd64f6c423d7287519fb6e0af8664667173f0b39ff03157330e19e1ad805d1c4deccdb9ad83c5cd6bad51
SSDEEP 12:TLpHC8qPgJ0XJHx4ISuSFiA7I24+s3hyx4wzRmBEyPbBvOw:TLoCCX7/SDEmfMGSN
MD5 SHA1 SHA512 SSDEEP

Submit Download

download-journal

Path /data/data/com.muzhiwan.market/databases/download-journal
Size 512B
SHA256 145d03d5f290185ec029c183dee0bafe434d29360390db31e56331d8d5f2a279
MD5 71b337c41c1876a0933f11556f1e07cd
SHA1 9240b73bb8e81d6778cc52181bf9c09f3802f533
SHA512 ca84e13e610bdb78c68d4cd8b8a29cb7208e158c77451a7dbccea0103871fcb18da4b6a27ae325481c7e2b13f1ea04ca52e36ce59310f0ab2a1e5eb353d1abc0
MD5 SHA1 SHA512

Submit Download

download-journal

Path /data/data/com.muzhiwan.market/databases/download-journal
Size 8KB
SHA256 1b0fc8630bade0a3e711840e2a1ae374c59c3542982362944d925ee8f255d206
MD5 8e91a67d7d85374cad8a99ca3cee47a2
SHA1 4294b2a49d3d58322fea924a72b5f38fa1eedf16
SHA512 7935e072d99f1778fef6146b32bfe135f0ba938cf63f4586ae4c5e83a8adfeb63947fc6bb7bc020c4e51d9fa25b6f5c2bcf86f9cf9816e9fe0188d10c9d186c0
SSDEEP 6:7+/l9xq/mHn1QtkWg9bNFlEuWdOlOERX4PBX4ogLugMBX4suuKqun:7+tYWWqLiuWdwRmBEyPbbun
MD5 SHA1 SHA512 SSDEEP

Submit Download

download-journal

Path /data/data/com.muzhiwan.market/databases/download-journal
Size 8KB
SHA256 7ffbc3fc770e985cda88a2a637f03dad92d68f02599b124b34c16b50778f2386
MD5 ce9f1f870f509743ab284577024a32ee
SHA1 fa2d50e4d284949e04138650b59446e83b502005
SHA512 b09c091fb9ea79dc273ee13bd7ada77dcfe9cc6db91873ea23bf68deb55aac872b09d3bde7131b9130126e38b09cf4132928763e3f6aa9d9e55a11638e1a8bd0
SSDEEP 6:7+/l9NPg9bNFlLdrlOERX4PBX4ogLugMBX4suuKck9s//O:7+tbqLJdTRmBEyPb7GsXO
MD5 SHA1 SHA512 SSDEEP

Submit Download

notes-db

Path /data/data/com.muzhiwan.market/databases/notes-db
Size 16KB
SHA256 bddb108ff2c0d509cd953c8dfb2b7c4e838d205291a4da8ab6c65cb98986416e
MD5 2667900bf3b5ab90121d0a3ff8ade390
SHA1 d82120444613139e2f4547f2872aa2c95ed9dbf5
SHA512 03db7a94d3760f47c9546e3c033647e853a984385e871d46d056509b8812422a2a3389551c30ec5a9360cebb5e1786315c6891611638c60642d3107dfd8006c3
SSDEEP 12:TLpEpG2mD8dpw11iGxwNLclTID6rmG98RmBEyPbBvOw:TLgGGMLi5LYcD66GNGSN
MD5 SHA1 SHA512 SSDEEP

Submit Download

notes-db-journal

Path /data/data/com.muzhiwan.market/databases/notes-db-journal
Size 5KB
SHA256 b694abb4a56699542e20d3b3a38870dc1366822ebdd30abaa321f66cfab4bd97
MD5 437260597d072bf8652ed2f2dc893f31
SHA1 1f28291d89531b1a0389941f0636f52cee8dcbd5
SHA512 cef20c4873433b811047d626e097eecab9ab41e07716871497abdc36748539f4613ae6118da0b999d3cc312411bfd04dc9004564bfbda98d81075830ce49b868
SSDEEP 96:9qYevvTq6MLG6nH8oUvTq6MLG6nH8oO13fH:AYevGXJH4GXJHK1
MD5 SHA1 SHA512 SSDEEP

Submit Download

notes-db-journal

Path /data/data/com.muzhiwan.market/databases/notes-db-journal
Size 42KB
SHA256 14b68457395896d3ffe12b777f52fe2cc4182a6c9ba383555b12522c93657b00
MD5 7bc525aa5cfd71cd4d2ad570fd72a906
SHA1 b411e1b345b5e9e4a0e4f603b46277278981e921
SHA512 5f1973360665bdeb536d8dc2a9c5d2077990fbc6fd3653747de9d54c7032a776151f39986792ab57773623a143b2d65cfbb585aa53c823197485eba9e75c8e2f
SSDEEP 768:ccPev5+EU7aX9WkB/gUrXFWLKxe7X+Fu9hRv6Xf3QpD+X7aFkuzkjEC:ccPehi4WkZbgLKxe7wuzt6XCyLaFm3
MD5 SHA1 SHA512 SSDEEP

Submit Download

notes-db-journal

Path /data/data/com.muzhiwan.market/databases/notes-db-journal
Size 8KB
SHA256 00dd976275148ab45fc5aa2e5dc72025ca2791208660112085c41197d4673d61
MD5 cfc24c7c9c8fc16ec484bc0376379704
SHA1 09cf7d094319b52844d84fab56cc95edd3c59a4e
SHA512 fd3b5c749caf2cdf31ed2c9fa3e856122355ec644e2698fca5f844b1329e45fff402005d65d7d596170a51818bc2220d2445f41b46e12cf7bee93151672dfd67
SSDEEP 96:9qYevvTq6MLG6nH8oUvTq6MLG6nH8oO13fG:AYevGXJH4GXJHKE
MD5 SHA1 SHA512 SSDEEP

Submit Download

.imprint

Path /data/data/com.muzhiwan.market/files/.imprint
Size 833B
SHA256 36beea25b236aa8474732bdaafc95ce4a270ac62486ddf8069521d0673a23937
MD5 554b5da584350daf639b628a9d13e944
SHA1 f9a7089765cbb8f9375e47dae5a85a2ee08863ea
SHA512 eed72e53d09cd57addd273570976190d9d0ad52f626f43e06d6f6f5b86eaf5d08677d34219b0a6fb591893d5fb43af1e1f4af6e1a51aa94fca21d9e3a8f1bd7b
MD5 SHA1 SHA512

Submit Download

exchangeIdentity.json

Path /data/data/com.muzhiwan.market/files/.umeng/exchangeIdentity.json
Size 162B
SHA256 be5460c04c4a89a2fd13a76f3c292716b38f7199272664184ae2fe9ddf2310b2
MD5 04069a925862431fb9285ed7e34dc49a
SHA1 61ccabf48f99f9e107f964cf13101b8dfbe2cd11
SHA512 c37a5770c40d788a422265fc0b223a878d1b74e7197f8812a04120f17a64e843c50be483afedc8985ea8d090eaa1e44ff1803d5bfdc885aa20a598948a867750
MD5 SHA1 SHA512

Submit Download

install_file_dir-journal

Path /data/data/com.muzhiwan.market/files/install_file_dir-journal
Size 1KB
SHA256 9dbbaa4ea0a220e25151621dd520c5d0d31839103bd5bf4976ff0580b4c4a60e
MD5 ae0f17077d32436c0c301a29d694b40a
SHA1 d4e0784622297689bb4192f7a6fc47d86e2fccbf
SHA512 476a1142666d9428e85fa6fba73a4bbb2545de08c9efbac36a94c0924d46ffa53ade2e658ada62a10b2b62ff2819d886c3e5f1a0654f23964a2d2412f07285c2
MD5 SHA1 SHA512

Submit Download

install_file_dir-journal

Path /data/data/com.muzhiwan.market/files/install_file_dir-journal
Size 2KB
SHA256 d1b5d629b4b8bc3c2e0754182837edb1933b9d5e735457840beed0f04984a7a4
MD5 87cd48579e9b7639c9598af857facda0
SHA1 34fd8a2d7d4ed4530599cbaccb08d2f5524ac89e
SHA512 d769398badffb6bd0094396ecb252dbc65a17bb25af9aa321a888f03179fe4a926e29b4c3f6205f60fb2dfc41e0fb565d5e0f19f33e0a1b524c63b8de0d9965f
MD5 SHA1 SHA512

Submit Download

jpush_stat_cache.json

Path /data/data/com.muzhiwan.market/files/jpush_stat_cache.json
Size 139B
SHA256 7be981de3e57a6bcc521fea056b1b177f38cf3e13299ea73aed74d8fbae17a06
MD5 e7632544cd4fee13b18a182fbefdec4a
SHA1 a8cc9183994aea73e5d1de0208ba283a8993afbf
SHA512 2cc59a9ee3eeb7bcab15abca8b2d5617293071f4f950155c2247751077a9da474e2ae7d1eae797a44cfa22a360975626fe13a880ec540a9a67c8a00abc3312b9
MD5 SHA1 SHA512

Submit Download

umeng_it.cache

Path /data/data/com.muzhiwan.market/files/umeng_it.cache
Size 245B
SHA256 6ac054dcd773bf6fe5f3f110d043a1ce2d2d9a23e4d67295965919e79a9d0995
MD5 8812af5d5830acea0e5fabb1b2f89e95
SHA1 2fc57d308eac6a8c1509c0a98ba9cac5e456c851
SHA512 b535c6b8877ce1c2b007accd29bf7add553457f35ba114f3c9ca07e151a14a8acf49de080900312688b60d68f92063c41e5d9a1342b2818776a4346c2497123e
MD5 SHA1 SHA512

Submit Download

umeng_it.cache

Path /data/data/com.muzhiwan.market/files/umeng_it.cache
Size 125B
SHA256 e78a9ff44151f71a5b69d70377e73d4850bd892472ad0e7b1343046f84aef4e7
MD5 aca38f0c91025412a0d2b9825855b9db
SHA1 2fab143310103f70882c75469e0c730358a5639f
SHA512 db8789a1c4c291a46717e287e49cfae8e13bf7c5001ddecee9d088e8f8f1b9d8964678e9600faac8cbcc47ee5bc5b86e60681b7fb4e6e2af7141d8581b6226ab
MD5 SHA1 SHA512

Submit Download

.push_deviceid

Path /storage/emulated/0/data/.push_deviceid
Size 32B
SHA256 df9b2d4227530993b5d9902cbc1bd6d59bbc60b9b19b296f91460f554caccd21
MD5 db07cb3d44dedb76feb91f18ad2f14be
SHA1 20edce53bd2c088b363612457a7c7ada6a21c62e
SHA512 032d36a201ede77dbcd1c78779a18833abf680677c838ed45dfd8448a6f51143f330df1f8b02c310519a66041a5d668fca957db10298894bb641759cb5bf47e0
MD5 SHA1 SHA512

Submit Download

.systemid

Path /storage/emulated/0/data/.systemid
Size 42KB
SHA256 3e1f345e8378b851d32ac5ddab42ebd9ac88324da9e46d4751056d759f433aa1
MD5 f0e81a0d8042f78dbb7f92c1a7c41aa4
SHA1 41d5ceda76177aa7b1d458640d2cd6a7a3dc0e55
SHA512 fe4866ac0c6c745076081de2066cf0778de37bb9290d8c8aec60063c1ff18854c243eb629236e0842996fd1f243d02b05aa475d6e6a975725e5d9b490f642b49
SSDEEP 768:/cPe25+EU7aX9WkB/gUrXFWLKxe7X+Fu9hRv6Xf3QpD+X7aFkuzkjEC:/cPeOi4WkZbgLKxe7wuzt6XCyLaFm3
MD5 SHA1 SHA512 SSDEEP

Submit Download

.systemmac

Path /storage/emulated/0/data/.systemmac
Size 1KB
SHA256 93615a45fabce74df557faae4b8cedbfb7e33841766f260bc1fee89bb83b419a
MD5 76a6a2d9fc79835a42a2965a3da150b7
SHA1 d06866290a1c0baa2760f8bc395244f07d341cf5
SHA512 7c50699e0462c96fdf12fd6440abc29d8354ac35013770e9749594dfa1be413d509f3e1ab8aaddd352c6b6088d6733e004a02397733f89bd860f769116026004
MD5 SHA1 SHA512

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads