97b58fc8798526bfea35ed6ff26272263d332554a75672a3bc54a0a56cbafee3

Analysis

max time kernel
4s
max time network
86s
platform
android_x64
resource
android-x64-20240624-en
resource tags

androidarch:x64arch:x86image:android-x64-20240624-enlocale:en-usos:android-10-x64system
submitted
04/08/2024, 01:15

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
6461851c092d0074150e4e56a146108ae82130c22580fb444c1444e7d936e0b5.apk
Size 3.3MB
Sample240804-bl7wcswdrd
SHA256 6461851c092d0074150e4e56a146108ae82130c22580fb444c1444e7d936e0b5
MD5 b731343b083f999ae0271d19ec92da4f
SHA1 05e5da65faf6fadb2a3c8dab2eb3d888ca6fad9a
SHA512 84bc70e927af425b430b7a79797e5207eb6b8d33892f2b37c80e3f8fcd987a70a8e44dfccbd3b356d98e6ed413ee1dccc42211cbbe4311adb19579db6cd46eec
SSDEEP 98304:IEVF6aL7fDW3v0AMYfccAYUMF2yIOcX3i9MNIXcK:I46x3vKcAUGOcGMK
MD5 SHA1 SHA512 SSDEEP

Score

6^/10

discovery evasion persistence

Malware Config

Signatures

Acquires the wake lock 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	ir.shz.shzkisi

Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

Application may abuse the framework's foreground service to continue running in the foreground.

evasion persistence

Foreground Persistence

T1541

description	ioc	Process
Framework service call	android.app.IActivityManager.setServiceForeground	ir.shz.shzkisi

Queries information about active data network 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	ir.shz.shzkisi

Reads information about phone network operator. 1 TTPs
discovery

System Network Configuration Discovery
T1422

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs

persistence

Broadcast Receivers

T1624.001

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	ir.shz.shzkisi

ir.shz.shzkisi
1⤵
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Queries information about active data network
- Registers a broadcast receiver at runtime (usually for listening for system events)
PID:4969

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Foreground Persistence

T1541

Privilege Escalation

Defense Evasion

Foreground Persistence

T1541

Credential Access

Discovery

System Network Configuration Discovery

T1422

System Network Connections Discovery

T1421

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

~test.test

Path /data/data/ir.shz.shzkisi/cache/~test.test
Size 4B
SHA256 9f86d081884c7d659a2feaa0c55ad015a3bf4f1b2b0b822cd15d6c15b0f00a08
MD5 098f6bcd4621d373cade4e832627b4f6
SHA1 a94a8fe5ccb19ba61c4c0873d391e987982fbbd3
SHA512 ee26b0dd4af7e749aa1a8ee3c10ae9923f618980772e473f8819a5d4940e0db27ac185f8a0e1d5f84f88bc887fd67b143732c304cc5fa9ad8e6f57f50028a8ff
MD5 SHA1 SHA512

Submit Download

google_app_measurement_local.db

Path /data/data/ir.shz.shzkisi/databases/google_app_measurement_local.db
Size 16KB
SHA256 8851a108472622304b8a86058ba3fb28421c488d145df9fa6d6ed9997b2947bd
MD5 c836f4cb391166d72967086123808f15
SHA1 8ededd6e6a49d53d9328808aff0e725c863872ba
SHA512 6e544762d5c2cb8967f003445b1345209bf95cedd2e4620ff1f9f027a308529f5e036b2ff3caae89f5a59ce79a01348f64a6bc36e69e5b5aa83d86a61fa608ba
SSDEEP 6:l9bNFlsls1ylO0yAgLusi2JLnrcERX4PBX4ogLugMBX4suuK+/RCM+/lulvl6W7C:TLiEy9zmzrfRmBEyPbP/P+/0Fl657
MD5 SHA1 SHA512 SSDEEP

Submit Download

google_app_measurement_local.db

Path /data/data/ir.shz.shzkisi/databases/google_app_measurement_local.db
Size 16KB
SHA256 ff13236b4a04e1d1315b946355b1c581eb832bc1a6332c750214ca02282a2f4c
MD5 2e22c32bc3061fb39cd751606ee72cc8
SHA1 d3c5f13733a0c84cbbd9b4bf53a9fec25b9e1d9c
SHA512 061b2f6c2186569c2f321eab7dfd77205026948902d804fed4cb089406c077cb3db085454536b6b97d427d96b647fd90d2a57d425e8e9632a43ca695e50d8c40
SSDEEP 12:TL1Ev9zmzrfRmBEyPbP/hr/gW49blqYFl/n+/0Fl657:TLQpmzr0GSP/h1499FRlFA
MD5 SHA1 SHA512 SSDEEP

Submit Download

google_app_measurement_local.db

Path /data/data/ir.shz.shzkisi/databases/google_app_measurement_local.db
Size 16KB
SHA256 fb097f43bc371964fdfcadf30c0e966723f2c42c1879251a06c7bb5f3a3d890b
MD5 ea01c1b45922b86ccb08ce34c6f2c0b5
SHA1 f51da7d7988d13714320e11b1286dfdb50a53e29
SHA512 21fedef7ac92cdcfb4287384da3c7f8208f08b2e1ca98c77a23de4c49408d30f5cb0c9d5188739fdcca352207df856c1a027ebeacc4a5e70b65bdc044399905b
SSDEEP 12:TLIEQv9zmzrfRmBEyPbP/9FAiOLauK/6AUvkWlPvIq49blqYFl/n+/0Fl657:TLEvpmzr0GSP/9PKary5ttvx499FRlFA
MD5 SHA1 SHA512 SSDEEP

Submit Download

google_app_measurement_local.db

Path /data/data/ir.shz.shzkisi/databases/google_app_measurement_local.db
Size 16KB
SHA256 655eaf7e721d2d2f5e3b0b324b552e0a2903395c6f7a014dd87b050a3bc3ab79
MD5 ccaa26871d2938b0808738152b0cac37
SHA1 e47407f51977f5627169406499a83f521cf75b00
SHA512 a274372470bef39cfc7bb2cc3329cddbb6469b70ce3fd1fa9df13987eb7b4b66b3fd269bf192f8a3110f12a3ec684b41bce3d5e3eb53e2906925d655dfc62059
SSDEEP 12:TL6uEp9zmzrfRmBEyPbP/sFAiOLauK/6AUvkWlPvIq49blqYFl/n+/0Fl65v:TL6Xpmzr0GSP/sPKary5ttvx499FRlFg
MD5 SHA1 SHA512 SSDEEP

Submit Download

google_app_measurement_local.db

Path /data/data/ir.shz.shzkisi/databases/google_app_measurement_local.db
Size 16KB
SHA256 48472f593a3e9cf9e91ee5f7d66dd9ff291bfb247eb6b46778c710fc24e8d3c4
MD5 eb52a90bb70b76e946b62f50b6f7fb85
SHA1 42d767b5d1faa7dcef4cb4e1432a5f47ec2e9ee0
SHA512 b356c858cadd14b6ecddf134f1c494c0107a1d36be9387984fc53dcb00e6779d944f058f4ac99d0fc2fe3a427cd1c2921c6fc38ecad53909fc4b5b6f04459b5c
SSDEEP 6:l9bNFl4/Sls1OelO0yAgLusi2JLnrcERX4PBX4ogLugMBX4suuK0DqiOwvs3:TLWuEOe9zmzrfRmBEyPbBvOwk3
MD5 SHA1 SHA512 SSDEEP

Submit Download