01af8e23a7c0aa875e4aeb08cfc6c366d275e758b81cc13ce5723f353ea1e4d7

Analysis

max time kernel
172s
max time network
190s
platform
android_x64
resource
android-x64-20240611.1-en
resource tags

androidarch:x64arch:x86image:android-x64-20240611.1-enlocale:en-usos:android-10-x64system
submitted
17/06/2024, 07:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
GameSpace-nubia_magic_src_opt.apk
Size 97.9MB
Sample240617-jplras1cra
SHA256 a4934f77614b645f050c9960ba19e218017237458ff0a6ddf7f099b4467af4e1
MD5 235f0d5ffae75c72bc9fca9e44550bf7
SHA1 293bb300a8048a199476ed014439d0d3457074b6
SHA512 a29837b5cd8647f9700b6efc31b8d65b7b3761fd7b51260cc45ec7696c31bd7077129e0a18b6879ea345a597c12b51c67c14ba7e4caba48c4ef6609f81c1938e
SSDEEP 3145728:yzRvlNTMEoVg8Gx4pGpdhslqI/qR6kwVEkXz:URvfTJW2Q8IivwV/
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

collection discovery evasion impact persistence

Malware Config

Signatures

Checks Android system properties for emulator presence. 1 TTPs 1 IoCs

evasion

System Checks

T1633.001

description	ioc	Process
Accessed system property	key: ro.product.model	cn.nubia.gamelauncher

Queries information about running processes on the device 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about running processes on the device.

discovery

Process Discovery

T1424

description	ioc	Process
Framework service call	android.app.IActivityManager.getRunningAppProcesses	cn.nubia.gamelauncher

Requests cell location 2 TTPs 1 IoCs

Uses Android APIs to to get current cell location.

collection discovery evasion

Location Tracking

T1430

Geofencing

T1627.001

description	ioc	Process
Framework service call	com.android.internal.telephony.ITelephony.getCellLocation	cn.nubia.gamelauncher

Queries information about active data network 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	cn.nubia.gamelauncher

Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.wifi.IWifiManager.getConnectionInfo	cn.nubia.gamelauncher

Queries the unique device ID (IMEI, MEID, IMSI) 1 TTPs
discovery

System Network Configuration Discovery
T1422
Reads information about phone network operator. 1 TTPs
discovery

System Network Configuration Discovery
T1422

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs

persistence

Broadcast Receivers

T1624.001

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	cn.nubia.gamelauncher

Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

impact

Data Encrypted for Impact

T1471

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	cn.nubia.gamelauncher

Checks memory information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	cn.nubia.gamelauncher

cn.nubia.gamelauncher
1⤵
- Checks Android system properties for emulator presence.
- Queries information about running processes on the device
- Requests cell location
- Queries information about active data network
- Queries information about the current Wi-Fi connection
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Uses Crypto APIs (Might try to encrypt user data)
- Checks memory information
PID:5032

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Privilege Escalation

Defense Evasion

Execution Guardrails

T1627

Geofencing

T1627.001

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Discovery

Location Tracking

T1430

Process Discovery

T1424

System Information Discovery

T1426

System Network Configuration Discovery

T1422

System Network Connections Discovery

T1421

Lateral Movement

Collection

Location Tracking

T1430

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

T1471

Replay Monitor

Loading Replay Monitor...

Downloads

f49b2e910cef15bee0900bea2e704ab4d6660a5427721769108f2abc9bb04592.0.tmp

Path /data/data/cn.nubia.gamelauncher/cache/glide_cache/f49b2e910cef15bee0900bea2e704ab4d6660a5427721769108f2abc9bb04592.0.tmp
Size 189KB
SHA256 ec0f9d4250d9dec81f1b01e3c055989141fd390a0031a59099f39b6445d7222b
MD5 f0ce91fdc93fbad66712918ed86506f1
SHA1 d8df953a321d4674855d9029128eec3813d228fa
SHA512 cd72292d4e3453e3a6b25bd70795afe6f70e90b3e0402c3533b36ec8b5cf4f9dbb9dc66c59fe9dfc3015edd80ee658957de36018999c89daa8d765be0a9788fd
SSDEEP 3072:5v/3qZCnL3GUFj5hkp039O9qHdajQfY6Zsf+5jst43WCJnDXxo2jSxFCir6O5Oyz:5v/3qEzGURgy34926Qw66Ht2xSj9r6O5
MD5 SHA1 SHA512 SSDEEP

Submit Download

journal

Path /data/data/cn.nubia.gamelauncher/cache/glide_cache/journal
Size 180B
SHA256 ff25ec6a4ff2863ce2e32f028685f5d196f69a3042c15fc4d2635f8712408f09
MD5 e6d63e076e3d837d759425c85a0a81a5
SHA1 6a6f9a8cfad436ac0985b6ba88ce20629a726ae1
SHA512 1dc2ce9dbbb19704787c30e2bba3bf133c1953b11148ab8700dd5fdcd6899d1d336aa008ef01502edc5615e56f858f7d5870dab14b470ce53e48b2a9c9b07490
MD5 SHA1 SHA512

Submit Download

journal.tmp

Path /data/data/cn.nubia.gamelauncher/cache/glide_cache/journal.tmp
Size 31B
SHA256 68bb33ddeed9200be85a71f70b377985f9ee68e91578afbde8321463396f1274
MD5 8c92de9ce46d41a22f3b20f77404cc1d
SHA1 8671a6dca00edb72be47363a7071be65cf270373
SHA512 30f45fe9954215d6adafcc8f0a060a7ff41963a64f9b849a37f0d18fe045038d429ec13bf15226769c4ba78dad3c52f3d9e0dbbb4fcdea4828a1efe956e48f56
MD5 SHA1 SHA512

Submit Download

log.txt

Path /data/data/cn.nubia.gamelauncher/cache/log.txt
Size 1KB
SHA256 019e510aebea6c83cb332aaf08519b6c1c115f5ef91b1efc253188b7c153b33d
MD5 2163aeff1c003bffa00a413bb8716839
SHA1 34ce1f755a2408f419808a0dafcc1106f9b3ded9
SHA512 41295033e9aa91f59fb7afb43c0f346e337467680bf98588b22877b9699b9c208f7c5f58f1a677665807e9faabb3909eac25facebca1b15a30c3abc39799c52d
MD5 SHA1 SHA512

Submit Download

appadd.db

Path /data/data/cn.nubia.gamelauncher/databases/appadd.db
Size 28KB
SHA256 3e79494216f0c11e2f4d16da89a5486d94c6e8a2a5fb8922c3eec9e450c7ccd2
MD5 7238c1f10082f445262ced1fa878a604
SHA1 06192151c3f57756b39e932506e843f948d92340
SHA512 0c2df3fd2b22430cfca3807cb4a5e49f065ff7082948bb8aefad904dd5fc988a7c78dbe31f2b4fd4cbf89c837c7bccb830b3a6a487852cd8447b1b45c252e224
SSDEEP 12:TL0Hswo6MlJQC5zMsTSFbyvtOuH4MuFMaDdWMRWpMKEZaPi5RmBEyPbGtOwGQQ:TLBbXKsjJsM6zRqGSiGQQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

appadd.db-journal

Path /data/data/cn.nubia.gamelauncher/databases/appadd.db-journal
Size 512B
SHA256 a71a25057e2d977c32ab054e11626a9a1f82d1c4b42f939ea0e2b323aa82596e
MD5 0bb77218779ee6dfd7b890c7556e6544
SHA1 613144c25cc1af97be371fae78b991237d71a551
SHA512 6562f54ab83b6656710a1707cd8efc45f9b8e9c62dc2f8780d10b239037675fd71145a549c1b3ce7f99180e278c15e5344373c62b8ddadb3e88b6071ed9759f8
MD5 SHA1 SHA512

Submit Download

appadd.db-journal

Path /data/data/cn.nubia.gamelauncher/databases/appadd.db-journal
Size 8KB
SHA256 d3640a4cb7b6404c06d48459a5dccd89c7c5844247cf18c7bd1e0474e4748265
MD5 29bd05d2f25bf7dc08fc4c7319c0524c
SHA1 5004d3aff5b5aacd3525226d1fa1a7052dbe5361
SHA512 d0ef11ebf2e6da06f46c551292dc70de8ec7e0173ae801d13607a625f3c2f09524114024e0ce2724f73eac92281fd27d6b672ed0448200c6d8997d8b706d6701
SSDEEP 6:7+/l9dFlgn1MGll/vg9bNFlEuWdOlOERX4PBX4ogLugMBX4suuKqz:7+tNlQllnqLiuWdwRmBEyPbt
MD5 SHA1 SHA512 SSDEEP

Submit Download

appadd.db-journal

Path /data/data/cn.nubia.gamelauncher/databases/appadd.db-journal
Size 8KB
SHA256 6e16b6e2e6d762b39f416210c569d29e8aed903c98247f14475f65018c67a43c
MD5 aed7bcc2e039034377636cbec1fee32f
SHA1 3ff7f19050898f0c81e5bcac36f7893cb2352a53
SHA512 9aac52aad207ee379a617428057dede1afc6f44091961d363e6ec187f87b42e93ea0709604effbdc6301cc43d1466c349106c7d11e9026277a10c734c5bd5b01
SSDEEP 6:7+/l92/GPg9bNFlLdrlOERX4PBX4ogLugMBX4suuKhU/un:7+t4/6qLJdTRmBEyPblun
MD5 SHA1 SHA512 SSDEEP

Submit Download

ssp_download_info.db

Path /data/data/cn.nubia.gamelauncher/databases/ssp_download_info.db
Size 28KB
SHA256 3c16705850725f192dd030cbda12cd3f420f4f6a81351ed391aec2ba01f83ed2
MD5 99710757b65b0c164a03f8f3cddb725c
SHA1 76b89212a00e0e0cbcaedcc805d8e0cff09ada99
SHA512 7116b9c3de67295c701f907f9ad589df8243fabfaaa3c509de10e2a633eea782b97cad423c63cd96a6c3665dcd7ee53c80b9589fccfa6734d1995bdd95157863
SSDEEP 24:TLsEx+S+xQv+iFyFu+jK+JFdPAAHVVOyBA0pGSiI:TTvDW3zdPAAHrBtsS
MD5 SHA1 SHA512 SSDEEP

Submit Download

ssp_download_info.db-journal

Path /data/data/cn.nubia.gamelauncher/databases/ssp_download_info.db-journal
Size 512B
SHA256 2eb15fa857c6a9360b260f21333a58669198a3f5ddb36034edf15a61b1804a6e
MD5 2071566814ab692466c6465ec7d41af2
SHA1 9a213bd208a363155a6536584e2b2bf158ec5b49
SHA512 59a3da1e6190fdb6965be72a8d1d2cd55f9acc652e725310436ec8571c9ab591d7eb1e70569d50bc6c595713c2eb2032d253f5f6ea6884cfa511e9ed5b89f74d
MD5 SHA1 SHA512

Submit Download

ssp_download_info.db-journal

Path /data/data/cn.nubia.gamelauncher/databases/ssp_download_info.db-journal
Size 8KB
SHA256 9367ac97b1c7859becf8200f5b839d5dca26d8f6a33d0fc35b39708c9ba30507
MD5 f6a547b923e2fb2e9e637f3c7a213d40
SHA1 f508fcff6dd39b8fa54e010bac0ac9b0d20558dd
SHA512 e3b1534fad622f3882edae44481967fddefd3e7041f324e4edb6ed80247c40cc46f62c6c92f58c3898db57a841524b5fdce96692524ba0962ad9a5804d175b48
SSDEEP 6:7+/l9BOn1bvg9bNFlEuWdOlOERX4PBX4ogLugMBX4suuKm9:7+toqLiuWdwRmBEyPbF9
MD5 SHA1 SHA512 SSDEEP

Submit Download

ssp_download_info.db-journal

Path /data/data/cn.nubia.gamelauncher/databases/ssp_download_info.db-journal
Size 8KB
SHA256 2b8137535199e3a8a9c26810d75e5a534158860037d39d61de6e53886f00f829
MD5 a8f6f2a194cc6395ccecdabcc1cf89df
SHA1 019deeab50f68e5fa16206c8e68a49331c58f989
SHA512 7d747583e7c8233518c200bbfb51d4664c3b93a24f6aa103ea3d9160b3d560bb87d24f8520ff81a8373104332641d018b9081463ca0193159dbad5d685c73db9
SSDEEP 6:7+/l9lGPg9bNFlLdrlOERX4PBX4ogLugMBX4suuKg6/1:7+tb6qLJdTRmBEyPbjK1
MD5 SHA1 SHA512 SSDEEP

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads