Analysis
- max time kernel
179s - max time network
196s - platform
android_x86 - resource
android-x86-arm-20240611.1-en - resource tags
- submitted
18/06/2024, 15:43
General
- Target Aliucord.apk
- Size 110.8MB
- Sample240618-s52bcstgmk
- SHA256 bfa2fd5ac16c58752f19d6f6800ad09c87f5b4d62cb67c167a4e23158506aafc
Malware Config
Signatures
- Checks if the Android device is rooted. 1 TTPs 2 IoCs
- Loads dropped Dex/Jar 1 TTPs 3 IoCs
Runs executable file dropped to the device during analysis.
- Queries account information for other applications stored on the device 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect account information stored on the device.
- Queries information about running processes on the device 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about running processes on the device.
- Reads the content of photos stored on the user's device. 1 TTPs 1 IoCs
- Acquires the wake lock 1 IoCs
- Legitimate hosting services abused for malware hosting/C2 1 TTPs 8 IoCs
- Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
- Queries information about active data network 1 TTPs 1 IoCs
- Checks the presence of a debugger
- Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
- Checks memory information 2 TTPs 1 IoCs
Processes
-
com.aliucord1⤵
- Checks if the Android device is rooted.
- Loads dropped Dex/Jar
- Queries account information for other applications stored on the device
- Queries information about running processes on the device
- Reads the content of photos stored on the user's device.
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Queries information about active data network
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Checks memory information
-
/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.aliucord/code_cache/Aliucord.zip --output-vdex-fd=82 --oat-fd=83 --oat-location=/data/user/0/com.aliucord/code_cache/oat/x86/Aliucord.odex --compiler-filter=quicken --class-loader-context=&2⤵
- Loads dropped Dex/Jar
-
Network
MITRE ATT&CK Enterprise v15
MITRE ATT&CK Mobile v15
Persistence
Event Triggered Execution
1Broadcast Receivers
1Foreground Persistence
1Defense Evasion
Download New Code at Runtime
1Foreground Persistence
1Virtualization/Sandbox Evasion
1System Checks
1Replay Monitor
Loading Replay Monitor...
Downloads
Aliucord.zip
com.google.android.datatransport.events
com.google.android.datatransport.events-journal
com.google.android.datatransport.events-shm
com.google.android.datatransport.events-wal
google_app_measurement_local.db
google_app_measurement_local.db
google_app_measurement_local.db
google_app_measurement_local.db
google_app_measurement_local.db
google_app_measurement_local.db
google_app_measurement_local.db-journal
google_app_measurement_local.db-wal
google_app_measurement_local.db-wal
google_app_measurement_local.db-wal
google_app_measurement_local.db-wal
google_app_measurement_local.db-wal
google_app_measurement_local.db-wal
app.json
device.json
os.json
session.json
6671AB8600C3-0001-113B-B90AA7CB72CCBeginSession.cls_temp
6671AB8600C3-0001-113B-B90AA7CB72CCSessionApp.cls_temp
6671AB8600C3-0001-113B-B90AA7CB72CCSessionDevice.cls_temp
6671AB8600C3-0001-113B-B90AA7CB72CCSessionEvent0000000000.cls_temp
6671AB8600C3-0001-113B-B90AA7CB72CCSessionEvent0000000001.cls_temp
6671AB8600C3-0001-113B-B90AA7CB72CCSessionOS.cls_temp
6671AB8600C3-0001-113B-B90AA7CB72CCkeys.meta
6671AB8600C3-0001-113B-B90AA7CB72CCkeys.meta
6671AB8600C3-0001-113B-B90AA7CB72CCkeys.meta
6671AB8600C3-0001-113B-B90AA7CB72CCuser.meta
6671AB8600C3-0001-113B-B90AA7CB72CCuser.meta
crashlytics-userlog-6671AB8600C3-0001-113B-B90AA7CB72CC.temp
crashlytics-userlog-6671AB8600C3-0001-113B-B90AA7CB72CC.temp
crashlytics-userlog-6671AB8600C3-0001-113B-B90AA7CB72CC.temp
crashlytics-userlog-6671AB8600C3-0001-113B-B90AA7CB72CC.temp.tmp
event0000000000
event0000000001
report
user
AdjustAttribution
AdjustIoActivityState
AdjustIoActivityState
AdjustIoActivityState
AdjustIoActivityState
AdjustIoActivityState
AdjustIoActivityState
AdjustIoPackageQueue
AdjustIoPackageQueue
CACHE_KEY_ACCESSIBILITY_REDUCED_MOTION_ENABLED
CACHE_KEY_APPLICATION_COMMANDS
CACHE_KEY_LATENCY_TEST_RESULT
CACHE_KEY_PHONE_COUNTRY_CODE_V2
CACHE_KEY_SELECTED_CHANNEL_IDS
CACHE_KEY_SELECTED_EXPRESSION_TRAY_TAB
CACHE_KEY_STICKER_ANIMATION_SETTINGS_V1
CHANNEL_HISTORY_V3
CONTACT_SYNC_LAST_UPLOAD_TIME
EMOJI_HISTORY_V4
NOTIFICATION_CLIENT_SETTINGS_V3
NOTIFICATION_CLIENT_SETTINGS_V3
PREFERRED_VIDEO_INPUT_DEVICE_GUID
PersistedInstallation7229361438693338660tmp
PersistedInstallation8138941567569157712tmp
SEARCH_HISTORY_V2
STICKER_HISTORY_V1
STORE_CHANNELS_V26
STORE_FAVORITES
STORE_GUILD_PERMISSIONS_V5
STORE_GUILD_SELECTED_V5
STORE_GUILD_SELECTED_V5
STORE_SETTINGS_ALLOW_ANIMATED_EMOJIS
STORE_SHOW_HIDE_MUTED_CHANNELS_V2
STORE_USERS_ME_V13
STORE_USER_RELATIONSHIPS_V9
UNREAD_MESSAGE_MARKER_V3
USER_EXPERIMENTS_CACHE_KEY
dso_deps
dso_manifest
dso_state
dso_state
androidx.work.workdb-journal
androidx.work.workdb-wal
androidx.work.workdb-wal
Aliucord.zip
Aliucord.zip
Anonymous-DexFile@0xee819000-0xee8192a0