01af8e23a7c0aa875e4aeb08cfc6c366d275e758b81cc13ce5723f353ea1e4d7

Analysis

max time kernel
179s
max time network
190s
platform
android_x64
resource
android-x64-arm64-20240611.1-en
resource tags

androidarch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20240611.1-enlocale:en-usos:android-11-x64system
submitted
17/06/2024, 07:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
GameSpace-nubia_magic_src_opt.apk
Size 97.9MB
Sample240617-jplras1cra
SHA256 a4934f77614b645f050c9960ba19e218017237458ff0a6ddf7f099b4467af4e1
MD5 235f0d5ffae75c72bc9fca9e44550bf7
SHA1 293bb300a8048a199476ed014439d0d3457074b6
SHA512 a29837b5cd8647f9700b6efc31b8d65b7b3761fd7b51260cc45ec7696c31bd7077129e0a18b6879ea345a597c12b51c67c14ba7e4caba48c4ef6609f81c1938e
SSDEEP 3145728:yzRvlNTMEoVg8Gx4pGpdhslqI/qR6kwVEkXz:URvfTJW2Q8IivwV/
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

collection discovery evasion impact

Malware Config

Signatures

Checks Android system properties for emulator presence. 1 TTPs 1 IoCs

evasion

System Checks

T1633.001

description	ioc	Process
Accessed system property	key: ro.product.model	cn.nubia.gamelauncher

Queries information about running processes on the device 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about running processes on the device.

discovery

Process Discovery

T1424

description	ioc	Process
Framework service call	android.app.IActivityManager.getRunningAppProcesses	cn.nubia.gamelauncher

Requests cell location 2 TTPs 1 IoCs

Uses Android APIs to to get current cell location.

collection discovery evasion

Location Tracking

T1430

Geofencing

T1627.001

description	ioc	Process
Framework service call	com.android.internal.telephony.ITelephony.getCellLocation	cn.nubia.gamelauncher

Queries information about active data network 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	cn.nubia.gamelauncher

Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.wifi.IWifiManager.getConnectionInfo	cn.nubia.gamelauncher

Queries the unique device ID (IMEI, MEID, IMSI) 1 TTPs
discovery

System Network Configuration Discovery
T1422
Reads information about phone network operator. 1 TTPs
discovery

System Network Configuration Discovery
T1422

Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

impact

Data Encrypted for Impact

T1471

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	cn.nubia.gamelauncher

Checks memory information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	cn.nubia.gamelauncher

cn.nubia.gamelauncher
1⤵
- Checks Android system properties for emulator presence.
- Queries information about running processes on the device
- Requests cell location
- Queries information about active data network
- Queries information about the current Wi-Fi connection
- Uses Crypto APIs (Might try to encrypt user data)
- Checks memory information
PID:4454

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Execution Guardrails

T1627

Geofencing

T1627.001

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Discovery

Location Tracking

T1430

Process Discovery

T1424

System Information Discovery

T1426

System Network Configuration Discovery

T1422

System Network Connections Discovery

T1421

Lateral Movement

Collection

Location Tracking

T1430

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

T1471

Replay Monitor

Loading Replay Monitor...

Downloads

f49b2e910cef15bee0900bea2e704ab4d6660a5427721769108f2abc9bb04592.0.tmp

Path /data/data/cn.nubia.gamelauncher/cache/glide_cache/f49b2e910cef15bee0900bea2e704ab4d6660a5427721769108f2abc9bb04592.0.tmp
Size 189KB
SHA256 ec0f9d4250d9dec81f1b01e3c055989141fd390a0031a59099f39b6445d7222b
MD5 f0ce91fdc93fbad66712918ed86506f1
SHA1 d8df953a321d4674855d9029128eec3813d228fa
SHA512 cd72292d4e3453e3a6b25bd70795afe6f70e90b3e0402c3533b36ec8b5cf4f9dbb9dc66c59fe9dfc3015edd80ee658957de36018999c89daa8d765be0a9788fd
SSDEEP 3072:5v/3qZCnL3GUFj5hkp039O9qHdajQfY6Zsf+5jst43WCJnDXxo2jSxFCir6O5Oyz:5v/3qEzGURgy34926Qw66Ht2xSj9r6O5
MD5 SHA1 SHA512 SSDEEP

Submit Download

journal

Path /data/data/cn.nubia.gamelauncher/cache/glide_cache/journal
Size 180B
SHA256 ff25ec6a4ff2863ce2e32f028685f5d196f69a3042c15fc4d2635f8712408f09
MD5 e6d63e076e3d837d759425c85a0a81a5
SHA1 6a6f9a8cfad436ac0985b6ba88ce20629a726ae1
SHA512 1dc2ce9dbbb19704787c30e2bba3bf133c1953b11148ab8700dd5fdcd6899d1d336aa008ef01502edc5615e56f858f7d5870dab14b470ce53e48b2a9c9b07490
MD5 SHA1 SHA512

Submit Download

journal.tmp

Path /data/data/cn.nubia.gamelauncher/cache/glide_cache/journal.tmp
Size 31B
SHA256 68bb33ddeed9200be85a71f70b377985f9ee68e91578afbde8321463396f1274
MD5 8c92de9ce46d41a22f3b20f77404cc1d
SHA1 8671a6dca00edb72be47363a7071be65cf270373
SHA512 30f45fe9954215d6adafcc8f0a060a7ff41963a64f9b849a37f0d18fe045038d429ec13bf15226769c4ba78dad3c52f3d9e0dbbb4fcdea4828a1efe956e48f56
MD5 SHA1 SHA512

Submit Download

log.txt

Path /data/data/cn.nubia.gamelauncher/cache/log.txt
Size 1KB
SHA256 293f138614b45e2e95c377b5b5eda5f2a5cce14c0a1f4509088dc107181b6345
MD5 3e9f3c4814b5c18cd842b6ce86e7d592
SHA1 48426fea82b9a0a7cf684e04b7d5e81ee2d34cee
SHA512 9b08dbd05feb04d33c690b5cbbade93a3516efcdd86df0d973d670e939575ee2c8506bc9a470e42ae404557573220f39f10a0ac41cd1e52edb6df56687f13f60
MD5 SHA1 SHA512

Submit Download

appadd.db

Path /data/data/cn.nubia.gamelauncher/databases/appadd.db
Size 28KB
SHA256 cd48aa4732d41030451eaf2b2d7aa76269a70e47648989fef47139ebac9b4122
MD5 d79d092c7dd384cd87efb313b894dbcc
SHA1 094bee4fc12498e924bedb814984d31872331b26
SHA512 4b6d650b9c50808302de2ad799babec8976bee3d6da5fe3a24c5060fe9182820348d7b86f5b5645a564b10528d68d0a6d79c6d4a634043d4a5537b5d466dbd09
SSDEEP 12:TLsHswo6MlJQC5zMsTSFbyvtOuH4MuFMaDdWMRWpMKEZaPi5RmBEyPbGtOwGQQ:TL5bXKsjJsM6zRqGSiGQQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

appadd.db-journal

Path /data/data/cn.nubia.gamelauncher/databases/appadd.db-journal
Size 512B
SHA256 f4226a5b26eb2a2b7a8331c5cc8b9a1cffb75008c4e9252e9e17548c26aa9ad3
MD5 f222ece09027c12e5fbd95467d6e38f6
SHA1 30d0045fc994cec779ed87667d9b1ec016f6cb36
SHA512 e0b0e3cea6568e02c2c981fae56c6a8adaa6f496cf8f35854d12d675347df24b7d813aa2d2949df81fbbc41101b4ecc7f8837e5bf4eaf9b2e319ae2f10565b8d
MD5 SHA1 SHA512

Submit Download

appadd.db-journal

Path /data/data/cn.nubia.gamelauncher/databases/appadd.db-journal
Size 8KB
SHA256 81a4bbf12d47f80249f276526fe5e45a821b5595d6f8ecdf890e8039b550bd09
MD5 332e2756dc964c51048d351eb7f3530d
SHA1 a8973cc0c8b7016d4a179ae5bdab321cd6bb0844
SHA512 a2382a75b631a27c7451615a8ffdf0e9d253b13c6fbc2fe1270ead1cc564e4a79c58616f1636ce27362316c019e1763c83f8be816831cba49d4d3e20019d652a
SSDEEP 6:7+/l96gOOn1itg9bNFlEuWdN/kPlOERX4PBX4ogLugMBX4suuKr:7+t8hqLiuWdYRmBEyPbA
MD5 SHA1 SHA512 SSDEEP

Submit Download

appadd.db-journal

Path /data/data/cn.nubia.gamelauncher/databases/appadd.db-journal
Size 8KB
SHA256 40c65dbac470ccf0570488ccb6b98e0b5d05cc0b63f9389900e312d8c2eeb7de
MD5 54e0a104efce1ff8c9ced0beee209a77
SHA1 7683ea470f15bcf7d010b7345fb0075463a84ac1
SHA512 0dfcbe78027157be5ed5db0dc4a11f7773615ebe7108c66eb8e35e84ca993a8a36b0b0e27e59d137f93e1dc547578e3edd25d4c62a0788cce9763ee30d0ded57
SSDEEP 6:7+/l9rPg9bNFlLde/kPlOERX4PBX4ogLugMBX4suuKED//I:7+tlqLJdeWRmBEyPbDXI
MD5 SHA1 SHA512 SSDEEP

Submit Download

ssp_download_info.db

Path /data/data/cn.nubia.gamelauncher/databases/ssp_download_info.db
Size 28KB
SHA256 9d5be87714558c635ecc237b36c3efbea81f73804f6a752fcdc12d45b19c8728
MD5 cdfbf8b39ac661266e54a0ca403a3ec7
SHA1 44bb5e51fc4a1dbfe0779e12dca6cdc04c2a4bb4
SHA512 d55c52a0b7db97548e0b6f893f4991f991cc4dc82c9c73f7e1fccf9ddfdd01464335b9d999dc161ff465246833829aeb20b2e0f54e98fb5f7fa1cc588e52670c
SSDEEP 24:TLUEx+S+xQv+iFyFu+jK+JFdPAAHVVOyBA0pGSiI:TbvDW3zdPAAHrBtsS
MD5 SHA1 SHA512 SSDEEP

Submit Download

ssp_download_info.db-journal

Path /data/data/cn.nubia.gamelauncher/databases/ssp_download_info.db-journal
Size 512B
SHA256 79f833119a59c9ad41d18dc7d4fd906e67ccc52535c0b89cdb65f330c41a817a
MD5 598ef5c3e070207f37d6fae388080acc
SHA1 53149903d4c1cb2d4c31f548a3aa4fa06403955c
SHA512 7e0a6013cb9d0c9278aac1e5353384e794087a65c1fa0df2456bf2d3c2a5a7118b2de4cd3ab44b0dd5c2211895c1204bcd3fcc5c739aed0f6472b44666d41fbe
MD5 SHA1 SHA512

Submit Download

ssp_download_info.db-journal

Path /data/data/cn.nubia.gamelauncher/databases/ssp_download_info.db-journal
Size 8KB
SHA256 481af167dbefbf48aae2bc69cfe321942f12e83914c5684bb48fd71e3da7eb23
MD5 f2058e458d2865c3be73946ce3b6f912
SHA1 6a9537314367f69f003da8f729bf91b12a094185
SHA512 5f56a672cb4e9b7fe4257fa192702d39113c96d15f7eddd79cad580da511bdbcfd19b95afb5ae7a0867824f8fcf30ad08f935a8779bb9abd272be225d1b382b3
SSDEEP 6:7+/l90Fn14sg9bNFlEuWdN/kPlOERX4PBX4ogLugMBX4suuK2:7+trsqLiuWdYRmBEyPbl
MD5 SHA1 SHA512 SSDEEP

Submit Download

ssp_download_info.db-journal

Path /data/data/cn.nubia.gamelauncher/databases/ssp_download_info.db-journal
Size 8KB
SHA256 20c51074a3d0b150549a90a590fb2486d66f2bc884a352ecab33e8475f965265
MD5 005e4d1465d06a12456f9ec574369f42
SHA1 07bab02514c1445fc1aa36fd73eddc233146ccef
SHA512 819462a3809b5f936e60d3a999e32ffb7999d624b5624d0436c72f8a1ed8b9b5905651b4bc34783d1fbb2b26ea589bff82bf0f2005aed6ef91b6db8ca290819a
SSDEEP 6:7+/l9X6TPg9bNFlLde/kPlOERX4PBX4ogLugMBX4suuKD/Ln:7+t16LqLJdeWRmBEyPb4L
MD5 SHA1 SHA512 SSDEEP

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads