56232948a56bdf7c6a69b1bdb2b636317ff84a150f69a6f86fddb1a4e56c3b6b

Analysis

max time kernel
124s
max time network
177s
platform
android_x64
resource
android-x64-arm64-20240624-en
resource tags

androidarch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20240624-enlocale:en-usos:android-11-x64system
submitted
28/07/2024, 22:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

liveWallpaperPlugin.apk
Size

162KB
MD5

91d33062e74043bb0bd9d5f66b343f3e
SHA1

aa3fab31cf6d5bc7fb1c012ada2b77ffe242a7c0
SHA256

4c3720917d9920cdec450cc85fe2fe3db39bc48cff4fea270914b475fc79f08a
SHA512

be5eb5cdab9e3348f3228fee40172b351a07d2d39ddd9d085593e3d78c13259be62425b4993a40696542902c452f7213a7b92410baf06192051640607389b80c
SSDEEP

3072:QV8ZyGg6GYtzqWn1Vmkv7YVQi5cRVl/51SGHHkmjVw:w8ZLGYtrv7O09bSGHHkYw

Score

8^/10

discovery evasion impact

Malware Config

Signatures

Checks if the Android device is rooted. 1 TTPs 1 IoCs

evasion

System Information Discovery

T1426

ioc	Process
/system/app/Superuser.apk	com.tencent.qqlive.wallpaper

Queries information about active data network 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.tencent.qqlive.wallpaper

Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.wifi.IWifiManager.getConnectionInfo	com.tencent.qqlive.wallpaper

Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

impact

Data Encrypted for Impact

T1471

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	com.tencent.qqlive.wallpaper

Checks memory information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	com.tencent.qqlive.wallpaper

com.tencent.qqlive.wallpaper
1⤵
- Checks if the Android device is rooted.
- Queries information about active data network
- Queries information about the current Wi-Fi connection
- Uses Crypto APIs (Might try to encrypt user data)
- Checks memory information
PID:4655

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Discovery

System Information Discovery

T1426

System Network Connections Discovery

T1421

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

T1471

Replay Monitor

Loading Replay Monitor...

Downloads

/data/user/0/com.tencent.qqlive.wallpaper/app_crashrecord/1004

Filesize
235B

MD5
3905a6b62ed9318e0f1f333513fbba8a

SHA1
6edc451e41375d45a64e3d23c7a51a196d0ce3db

SHA256
004ccf5c9f85c7e83be52ac4f36e4bcf09aee1a7fca2516ef68fe6ac38019028

SHA512
4c36fc3bb1772898b18ef37e1bb0c1f3989989534dc90239bd7f558f6b93a736c14e57bfbcab39e35b01b1ff736ccf70e675ac28437047e296b11f70cbcadbc3

Download Submit
/data/user/0/com.tencent.qqlive.wallpaper/app_crashrecord/1004

Filesize
58B

MD5
0d210bfb2a0e1f1b4c082a6a0f79de07

SHA1
bb8ed9e364db79d1d9f2fcde3f15091893222faa

SHA256
988722c23d78a46021d0e7ca9deee7aa8bb83288269174ffacb7316f381cca1d

SHA512
536e9867b0df29b15b789f8949be6ab37fcdeccb9d39ded981da7dc2052c9533d0ec0e6f9a5444132977605d372e1463d91bdde41b528ff2ca3f65ab152325c1

Download Submit
/data/user/0/com.tencent.qqlive.wallpaper/databases/bugly_db_

Filesize
52KB

MD5
0747182b2041a6d56a16af57f2e830a7

SHA1
5e950a8304370485f0d609f4e130b7cc9e25d76d

SHA256
65e04bd1e6423b3bab43ed962f3ca66529f0e0a7c56576d500c278acd7b5a86f

SHA512
e9e02d38a66a86800139877a9d5fd7cf611a310514b0e819e21ca5c4bb645ea62ac0be7f43a103279b46038021ef0f1639d84d7aa322e005e313e34b9c6ed87d

Download Submit
/data/user/0/com.tencent.qqlive.wallpaper/databases/bugly_db_-journal

Filesize
512B

MD5
1622f8e0e1c595762e9215b4890d99f2

SHA1
1f0c970cd1f174dca807e6f9fa1d8927925885f2

SHA256
639ef4deed0c83c85de4837e85ea10f16f422d166f21b7dbec9c9c317831d598

SHA512
1b0c6cee3771b3f382f207b315e3d573442db8472577cd001b5a2e92dda10ce592279a061987fd93f5f26fa5e9fe5100fadabb38d2167ee464d2c70ce5b24956

Download Submit
/data/user/0/com.tencent.qqlive.wallpaper/databases/bugly_db_-journal

Filesize
8KB

MD5
d38784b4d9f493758dd4219c8ea7f3fa

SHA1
41c9134f451e9aeb13cacd28f1b99b4cdda93843

SHA256
1042408803d3ec6e1c3c4fb5d42b9f2504621248bb0633b84aaef0da5dc11322

SHA512
ab290002acb4f9979bad233d8ea550575bbf50f184d0dd04910fc9b9b38752dc23724d9844c9f6c8c4c69ac1c189f4572d1f18abf53a11dfed859976ad83665a

Download Submit
/data/user/0/com.tencent.qqlive.wallpaper/databases/bugly_db_-journal

Filesize
8KB

MD5
1af6d2c1a37dab854784475cc121d62d

SHA1
c4154b13c1a6c152663a44f1f928ad542f8218d1

SHA256
cbde7eec829cc8ce3eb4e27dabf73610df41e81d131a2896bfb07c9cec03f92c

SHA512
0fe8e1ebbf5a65be737f3a4ffc4a84d188035798d65e309c88e081e2fb400bb167df10c01a95830862a68b59c1aa25b96bc10e2d7281f8dde55a3f57cf7e7244

Download Submit
/data/user/0/com.tencent.qqlive.wallpaper/databases/bugly_db_-journal

Filesize
8KB

MD5
1c7874831d634c7dbab54c8cc98564f0

SHA1
ff8a1b9e061c43e80dd7d7ddebcc34f923905fa3

SHA256
c56582f52cb3f19d05b00293ccc288db7ad7d915c31bade139348b38ac95c7a2

SHA512
2a8745fe2e4fe44be8b2a2e123fffd876a0d68ea96d18cf8ff0b16384323c578fc88f078575ad8a8a5717d7892f4556f26e72fa640073604a2e39f8db7f44d18

Download Submit
/data/user/0/com.tencent.qqlive.wallpaper/databases/bugly_db_-journal

Filesize
8KB

MD5
4f8212990c552dc97bb996baaada2e34

SHA1
f750b46632888bbd2ea307676b0d1b80befda99b

SHA256
42a51b555bf8c474466aec272ba66a070d30074062df7204b721e0d5a90a801a

SHA512
a66df77ebc34704df37e0f6f3c181fbcdb24630566f37a111555be570f66ae5baa1ef5884ed1ff787fcaa7493b7b4809f2e8e5559102d5f4319d966d6a00ae1f

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads