0e30948b3327a093bd7b35a10f65bc1f03a9b8d1d3e242dd6b5726e9136aaff0

Resubmissions

26-06-2024 23:09

240626-25grdsscjk 10

26-06-2024 22:32

240626-2fzkxaxgja 10

Analysis

max time kernel
26s
max time network
67s
platform
android_x86
resource
android-x86-arm-20240624-en
resource tags

androidarch:armarch:x86image:android-x86-arm-20240624-enlocale:en-usos:android-9-x86system
submitted
26-06-2024 22:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0e30948b3327a093bd7b35a10f65bc1f03a9b8d1d3e242dd6b5726e9136aaff0.apk
Size

16.0MB
MD5

be5e2f074432526ef36156e82bb219cf
SHA1

6cf0b782485e77218710fa024f1c11f122d84f60
SHA256

0e30948b3327a093bd7b35a10f65bc1f03a9b8d1d3e242dd6b5726e9136aaff0
SHA512

84633c70391513b388cdaf77634e0c6a60d270be121bfef6d94cbcc5f88e34a929659d13d2f05348e83f56c356be3eb9dc9fc44fbeca8cf6637cc19cba8af845
SSDEEP

393216:yf0YUtNuYwbvbaSafQ0Wejue+95sweOsjIYPaP:y9GNujbDaS4WeaeI5sqC8

Score

8^/10

discovery evasion persistence

Malware Config

Signatures

Checks if the Android device is rooted. 1 TTPs 2 IoCs
evasion

System Information Discovery
T1426

Processes:

com.apkpure.aegon

ioc process

/system/app/Superuser.apk com.apkpure.aegon
/system/xbin/su com.apkpure.aegon
Checks known Qemu pipes. 1 TTPs 2 IoCs
Checks for known pipes used by the Android emulator to communicate with the host.
evasion

System Checks
T1633.001

Processes:

com.apkpure.aegon

ioc process

/dev/socket/qemud com.apkpure.aegon
/dev/qemu_pipe com.apkpure.aegon
Loads dropped Dex/Jar 1 TTPs 1 IoCs
Runs executable file dropped to the device during analysis.
evasion

Download New Code at Runtime
T1407

Processes:

com.apkpure.aegon

ioc pid process

/data/user/0/com.apkpure.aegon/files/com.apkpure.aegon_c/commainw2c6c7m5i6an9. 4257 com.apkpure.aegon
Queries information about running processes on the device 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about running processes on the device.
discovery

Process Discovery
T1424

Processes:

com.apkpure.aegon

description ioc process

Framework service call android.app.IActivityManager.getRunningAppProcesses com.apkpure.aegon
Acquires the wake lock 1 IoCs

Processes:

com.apkpure.aegon

description ioc process

Framework service call android.os.IPowerManager.acquireWakeLock com.apkpure.aegon

ioc	process
/system/app/Superuser.apk	com.apkpure.aegon
/system/xbin/su	com.apkpure.aegon

ioc	process
/dev/socket/qemud	com.apkpure.aegon
/dev/qemu_pipe	com.apkpure.aegon

ioc	pid	process
/data/user/0/com.apkpure.aegon/files/com.apkpure.aegon_c/commainw2c6c7m5i6an9.	4257	com.apkpure.aegon

description	ioc	process
Framework service call	android.app.IActivityManager.getRunningAppProcesses	com.apkpure.aegon

description	ioc	process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.apkpure.aegon

Queries information about active data network 1 TTPs 2 IoCs

discovery

System Network Connections Discovery

T1421

Processes:

com.apkpure.aegoncom.apkpure.aegon:accessibility

description	ioc	process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.apkpure.aegon
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.apkpure.aegon:accessibility

Queries the mobile country code (MCC) 1 TTPs 1 IoCs
discovery

System Network Configuration Discovery
T1422

Processes:

com.apkpure.aegon

description ioc process

Framework service call com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone com.apkpure.aegon
Checks the presence of a debugger
evasion

description	ioc	process
Framework service call	com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone	com.apkpure.aegon

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 2 IoCs

persistence

Broadcast Receivers

T1624.001

Processes:

com.apkpure.aegoncom.apkpure.aegon:accessibility

description	ioc	process
Framework service call	android.app.IActivityManager.registerReceiver	com.apkpure.aegon
Framework service call	android.app.IActivityManager.registerReceiver	com.apkpure.aegon:accessibility

Checks CPU information 2 TTPs 1 IoCs

System Checks
T1633.001

System Information Discovery
T1426

Processes:

com.apkpure.aegon

description ioc process

File opened for read /proc/cpuinfo com.apkpure.aegon
Checks memory information 2 TTPs 1 IoCs

System Checks
T1633.001

System Information Discovery
T1426

Processes:

com.apkpure.aegon

description ioc process

File opened for read /proc/meminfo com.apkpure.aegon

description	ioc	process
File opened for read	/proc/cpuinfo	com.apkpure.aegon

description	ioc	process
File opened for read	/proc/meminfo	com.apkpure.aegon

com.apkpure.aegon
1⤵
- Checks if the Android device is rooted.
- Checks known Qemu pipes.
- Loads dropped Dex/Jar
- Queries information about running processes on the device
- Acquires the wake lock
- Queries information about active data network
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Checks CPU information
- Checks memory information
PID:4257

com.apkpure.aegon:accessibility
1⤵
- Queries information about active data network
- Registers a broadcast receiver at runtime (usually for listening for system events)
PID:4471

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Discovery

Process Discovery

T1424

System Information Discovery

T1426

System Network Configuration Discovery

T1422

System Network Connections Discovery

T1421

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.apkpure.aegon/databases/StartApp-d6864f2502af7851-journal

Filesize
512B

MD5
2aa9168e832f525d183e60c75b9f86fd

SHA1
99a09dfe862c9ee3f22e32424c8c1d46ed38e988

SHA256
399adc606a2b8c9e4627a52826fb526adc4448607a0282ba87d6d656bd56becd

SHA512
a35b3c1487fa7d1b56ee7fd4d83b52260490e8f632dd3ae68729017885b778f165989f8b3352af3b14ac2f131dc0e3d32cecaeabd0a38cb111965cd996466f25

Download Submit
/data/data/com.apkpure.aegon/databases/StartApp-d6864f2502af7851-wal

Filesize
28KB

MD5
5892300cfeb312fcfc824d952e813ee7

SHA1
b280bd1b91c3362838efbe18bfe3a1f5ad205f0e

SHA256
814577e4e1a262613cd6dda735be935dc974b3e8c98739fa0b9cf0374b97779e

SHA512
75eb715d7c498c9afcf4da7580b7e63b9fa3c1dba6b495c20025f32b3e136f10088d9693f974b29a4b0b0267734a765a245463e17bad6067f043cdacc4b6b349

Download Submit
/data/data/com.apkpure.aegon/databases/com.google.android.datatransport.events

Filesize
4KB

MD5
f2b4b0190b9f384ca885f0c8c9b14700

SHA1
934ff2646757b5b6e7f20f6a0aa76c7f995d9361

SHA256
0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514

SHA512
ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1

Download Submit
/data/data/com.apkpure.aegon/databases/com.google.android.datatransport.events-journal

Filesize
512B

MD5
adf54d7039691d2b9df277a77a5c369c

SHA1
69cbef973476a764e1e130f7e881642ad8021c2c

SHA256
3a0e9c90e1daf38ce34c34465faec1c0b93c22b5a3b4ea565580cb070b365a7a

SHA512
5246d2e6364be91adc5878b7e27778c00bb98faa72c508b4185e5733e59dd19a10e7e9fc43adcacac97fd4a35a5fb3c2d050d8033077a6cf848996fc823fd05f

Download Submit
/data/data/com.apkpure.aegon/databases/com.google.android.datatransport.events-shm

Filesize
36KB

MD5
b5289d1152e2ea38200d5a6bc74c807d

SHA1
cd905f756f446e90617a39bda04082d0cd4d61c6

SHA256
ee7f17b5e10474b0223d41a41fa7a87f8a8390113c5fe8c9edf2363fb0f9634d

SHA512
6693a45e375a7cb03ac907a4247089db06b1340f6c6844be0172dd7e1c761bd274b9453b76cab8e0eaa22c4e30d9c02e7013cf73e2b06e6411b47b9aceb6e2e8

Download Submit
/data/data/com.apkpure.aegon/databases/com.google.android.datatransport.events-wal

Filesize
52KB

MD5
9a5973fe8c8b20d3bd72ac67381b8c59

SHA1
f1fee747ab3dad1e04559228dd7888913b234b74

SHA256
5f495ec7fc272c901bbfb6048006dbaeb366c3ec294a7016b0ed820af6344462

SHA512
bf7405bc762e14effd1d16fd559a27bd6b2afe88f9566f28e045e109d87e952f989f394d920a75da00a0cf4b2f510a3389954dcf208f9e8675e46f5dd0174d21

Download Submit
/data/data/com.apkpure.aegon/databases/downloads.db-wal

Filesize
140KB

MD5
35a6eadc717045cf720570e421ea9e76

SHA1
d2b112280e146ac18b52668f6e58d8a346b3d703

SHA256
1b9fe6c8a9cab578dfc449e48ae79a04e20048f8493672979127a85d51e7cfec

SHA512
4a554a635b1688f65c4f3950d265b7e01ffb8c74ccebb7dab1ef19f34ad072edb6ae2036954516361bb29c6f4b8d84ddae44acf1bf215c84dfe3cbd848769f54

Download Submit
/data/data/com.apkpure.aegon/databases/google_analytics_v4.db-journal

Filesize
512B

MD5
4721ee4560b92559efaa9bae4b7f9306

SHA1
8f5f897e38009d94ad91b4e49eab3897b9af7f1f

SHA256
902215c87a05e7a7fb98d424ab3baeecc80497966678466c5031665be79614b5

SHA512
553e497b637796af772c6bf5778b7886c02b3e42b850d2e80b40e6be3572e2b51ada2615e33f94ac0ea4168a29f8d8c67d14f46dcba28bcd5bba98be8a529e34

Download Submit
/data/data/com.apkpure.aegon/databases/google_app_measurement_local.db

Filesize
16KB

MD5
7237409e0640cfab7bdbd429bf821a3b

SHA1
4c3da934842f8d4835dfe2a9c275a300e5123309

SHA256
5c8e1b63d187efafe1e09bfadd83fd360176d689b57b5a0cc40e6854c12449fa

SHA512
c8afaf6a8ee43ce3601feff417bfaec563c01bcff0aae24577054034112b2020967f25b0b1a919c3c9e5e81d62a21a87e908b782c4d5cb8bba8ac259108e9c1f

Download Submit
/data/data/com.apkpure.aegon/databases/google_app_measurement_local.db-journal

Filesize
512B

MD5
04752997878ea3adcd951f8cd01bb67d

SHA1
a84f9fdd96b91919239a3c0a71a91f0969183b7c

SHA256
827d526ab25c78eead7001e6346303a35defe2fb22bf64a994a16b692079abfd

SHA512
773bd18146ca71a26331c3045f3fad1b8e18e3bf1aea47cf5686238aa7de1d1018c321750d862bbe6671d50dd7834827d551ee9d26bc73d0ad1a6434dc16fd42

Download Submit
/data/data/com.apkpure.aegon/databases/google_app_measurement_local.db-shm

Filesize
32KB

MD5
bb7df04e1b0a2570657527a7e108ae23

SHA1
5188431849b4613152fd7bdba6a3ff0a4fd6424b

SHA256
c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479

SHA512
768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

Download Submit
/data/data/com.apkpure.aegon/databases/google_app_measurement_local.db-wal

Filesize
36KB

MD5
c0bf6a1f45b820ac3009d37a0f6c34c1

SHA1
f4e007689afe8172f714e7bdee1525600a8fd98b

SHA256
6faa309ccd1d690d171d0cb4c28b95e4deef10ac6b9573644f5647d7b7b492a3

SHA512
a98501574f35f21be8dc3313d0e0dbb94549c7c528691c92ec4d0f913da1e0599296c9c15dbcf7eb6a4149997d681a771e0cc6d0985f590d27a73ba4050c0d13

Download Submit
/data/data/com.apkpure.aegon/files/.com.google.firebase.crashlytics/667C970A0368-0001-10A1-F3F34A37CA5ABeginSession.cls_temp

Filesize
75B

MD5
dcdef4a50d9a442b87894452446f2bc7

SHA1
f3ad676f20123fa9d5852b06da895740aa2c7577

SHA256
ba72b777e606d5c9aa1ef2cd03af94043f8950ea035bbb4de376c3d5f49f8b39

SHA512
04bb507d815c98719e223e4e0052b107aa511db575d4e855e6c9037efc0c20624ec9d905818bf30beafc7f0a2cefcc0c18524d1d58e8da8cfd88e2aa57d290e8

Download Submit
/data/data/com.apkpure.aegon/files/.com.google.firebase.crashlytics/667C970A0368-0001-10A1-F3F34A37CA5ASessionApp.cls_temp

Filesize
75B

MD5
5960ca8f5dde6d772b37e1aba167188c

SHA1
afd7901950fd04b7fbbb62872f3f56ff6b247b5d

SHA256
33a61f61b6a72301414837c2ed8dc58f21579aa906eef93cb6946e7352c29aab

SHA512
d516323e3f664f7e06af5ea2b79c569205439827d4de2346c8a10e857069bbf09bfc9a9b29cad2c5faddc6bb826a7c68d0cb9bfbbd642611d5cedd7940725e70

Download Submit
/data/data/com.apkpure.aegon/files/.com.google.firebase.crashlytics/667C970A0368-0001-10A1-F3F34A37CA5ASessionDevice.cls_temp

Filesize
48B

MD5
1259ecf4689f83376bf373856c23d57c

SHA1
19507a1426d938dd77930f194bd65779565f5982

SHA256
2861892e8f098662c173abcaf15b2480496b48dc1e96eb777cd6a3124dd63e17

SHA512
0ab328ff2fdbb8b4778315c9ad769b3205a29c39771162529bd5598a5e370468e75edb05b89cf0d6f3e18d226fa2bd19fb70e68fb59023a80fe49f8e3185b230

Download Submit
/data/data/com.apkpure.aegon/files/.com.google.firebase.crashlytics/667C970A0368-0001-10A1-F3F34A37CA5ASessionOS.cls_temp

Filesize
14B

MD5
9b3d4522944ce6396563812bfdb92fa9

SHA1
6d2a6133c8f01938a48ccc77ef86ad8ca335c020

SHA256
d32805d685a3f50caa7f1c0bd7c8804c4d937a866513289f60e3184f7a591ed9

SHA512
091d87643712530bf9006135db42a5a50742bb5ca3026bcc5f2c1c17bf4fd984a8938d29263b0abde3d15cac196d2230902534e200b0b79485e3a1bd97d95727

Download Submit
/data/data/com.apkpure.aegon/files/.com.google.firebase.crashlytics/report-persistence/sessions/667C970A0368000110A1F3F34A37CA5A/report

Filesize
748B

MD5
1dd5e2e50a9b5217b6b3d20e2f536f4f

SHA1
937a18d2e22132f60bf0c5cd638c7c4ac7759f93

SHA256
9e86f6e2fd1c288a7c35b0a150df8beae9bef37ee7ed6121585eeaed783b2648

SHA512
eb58807c83e0cfc707193497015cd801eae0427e99790a5138811f5331b43a5c01698ef21e1fc2ba75871f9f4f380e3c83da65029afa323e63e1839bf1ed7c2f

Download Submit
/data/data/com.apkpure.aegon/files/PersistedInstallation7742024473337434100tmp

Filesize
561B

MD5
7701d6454450551b864a446933b26fbb

SHA1
d85755472b9764cab2ca954ae9ecffe99a2f1254

SHA256
e3c303c825d4e4458d06ed3a551ac25eeba139e3649cec06985d2965376a5607

SHA512
c5cb3dd430802270cb15a4efe81c32296db557ba2dd01747adc7db006edde43042b34cec047e34ebd443e1b014f247dbbd67b67e37d6f44fc65935785e72ecf5

Download Submit
/data/data/com.apkpure.aegon/files/PersistedInstallation7773953404725018593tmp

Filesize
32KB

MD5
4f5af43b1599cd8fb63cdcd7c57a8023

SHA1
4ea9b26cfa5037c01df0abf8f15e22cba97d2314

SHA256
23f5b1be0786f6ba2a8a518f9375adc4cf2f152549b7f35b7e402dc51472a9b5

SHA512
39595c886f282787a9f015234b3cf08182dc4afb0b8862823e2036d2bfc7437e3f7340152931efa2768e31626715204c59755cfdae54e4a176de1d578fc87971

Download Submit
/data/data/com.apkpure.aegon/files/com.apkpure.aegon_c/commainw2c6c7m5i6an9.

Filesize
34KB

MD5
0d330221751fa2cef3ac7da59838f316

SHA1
b2094307f69678debc9a9a1847fa7a10d8453ecc

SHA256
671269debc0c30681b81e2ae42a3a34d4cdfc53542d2a6bb62d4dae54d8595f6

SHA512
675b30e60da638f12fa267e780b05f32738c3b274983e976cbc09a513e9b8f527b4e086dcc9986572016ac798939c97848c1193eeb9230545e43d263f6e1829b

Download Submit
/data/user/0/com.apkpure.aegon/files/com.apkpure.aegon_c/commainw2c6c7m5i6an9.

Filesize
78KB

MD5
31e49ac1902b415e6716bc3fb048f381

SHA1
49e5d0883a1ff5147eadc0d8ec46299358ebffcc

SHA256
ed2d91e9d6429ebf0371a98f2faecdc755b766faa4e70b6fd9746853c9b69234

SHA512
b26c4d314da292dbb5f1869f1f49ee7b70d004826ac2301d6e9879af9d286295b67de39da805eec71de597c8214c0b11ad3b79cf4be9d46468904e40860c8afa

Download Submit