bb79030372683fef827627d7a5950c686985067de503d7c89294e5290cc519da

Analysis

max time kernel
64s
max time network
138s
platform
android_x86
resource
android-x86-arm-20240624-en
resource tags

androidarch:armarch:x86image:android-x86-arm-20240624-enlocale:en-usos:android-9-x86system
submitted
25/08/2024, 19:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

server.apk
Size

1.2MB
MD5

87d49130a4a503761ff1ba4615adbacb
SHA1

1742fbf0da6d6ee43e801a3247e2417e809b55c0
SHA256

318ce9e35ee0dbcfc28c553cc495d3b4980c51a0f176cde40631e3c6f5c7385f
SHA512

9dd1889f90857d43a8c44f7a327e516999adff080ec722238dcc83911aada3f8eaba61652ac3b048743d08465144e87cf84a14c8b06bf9aec7dfc6f191602f6a
SSDEEP

24576:DDw9jov9HnWHQZKpxN15JKcf9+xiCLQD/1t/DnPVxq8aoKiYn/kb:DDyy9HWwZKDN15JKc1+xiC0Dd5DPVxF9

Score

7^/10

banker discovery evasion persistence

Malware Config

Signatures

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
banker discovery

Security Software Discovery
T1418.001

Domain associated with commercial stalkerware software, includes indicators from echap.eu.org 1 IoCs

flow	ioc
7	alog.umeng.com

Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

Application may abuse the framework's foreground service to continue running in the foreground.

evasion persistence

Foreground Persistence

T1541

description	ioc	Process
Framework service call	android.app.IActivityManager.setServiceForeground	com.wukongtv.wkhelper

Queries information about active data network 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.wukongtv.wkhelper

Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.wifi.IWifiManager.getConnectionInfo	com.wukongtv.wkhelper

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs

persistence

Broadcast Receivers

T1624.001

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	com.wukongtv.wkhelper

Checks CPU information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	com.wukongtv.wkhelper

com.wukongtv.wkhelper
1⤵
- Makes use of the framework's foreground persistence service
- Queries information about active data network
- Queries information about the current Wi-Fi connection
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Checks CPU information
PID:4259

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Foreground Persistence

T1541

Privilege Escalation

Defense Evasion

Foreground Persistence

T1541

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Discovery

Software Discovery

T1418

Security Software Discovery

T1418.001

System Information Discovery

T1426

System Network Connections Discovery

T1421

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.wukongtv.wkhelper/databases/bugly_db_

Filesize
4KB

MD5
f2b4b0190b9f384ca885f0c8c9b14700

SHA1
934ff2646757b5b6e7f20f6a0aa76c7f995d9361

SHA256
0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514

SHA512
ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1

Download Submit
/data/data/com.wukongtv.wkhelper/databases/bugly_db_-journal

Filesize
512B

MD5
bc55e31c944ba0ba125ae09b9a0579df

SHA1
0df444b58b84b5642c0d9b93d8cad64db59caf75

SHA256
4b9173f64248d0b30f978b0f1e34f0fdd7c1da4d072ee9f8ae3e513e8725f797

SHA512
5af6fc74bae8a77a6f0c4bf2a24ce60886b5ece48fd80b9bcb4c3e4be778eda9f2be10e2b9b2f1359ec0c46cc593de46fde55b80d32bd263e99012dc1e97e9d0

Download Submit
/data/data/com.wukongtv.wkhelper/databases/bugly_db_-shm

Filesize
32KB

MD5
bb7df04e1b0a2570657527a7e108ae23

SHA1
5188431849b4613152fd7bdba6a3ff0a4fd6424b

SHA256
c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479

SHA512
768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

Download Submit
/data/data/com.wukongtv.wkhelper/databases/bugly_db_-wal

Filesize
52KB

MD5
78bd2b70b1ca89144cdac15b6f35084c

SHA1
c31c10d23db394da4b91e6ad1006ec6f1b991826

SHA256
13389bd8d54d83cc9d9e41d2c92ff336d6e1e5adb8c496e7cb29b802764f4d63

SHA512
54388a62d71c3ba12ee32a83bc46cc7bbaeb3b21d82f731f6cd2523915e140f0b22b3ac8659120396caf6f7074047d451e4628a2efde055e8a752b41e8cf10ac

Download Submit
/data/data/com.wukongtv.wkhelper/files/.imprint

Filesize
903B

MD5
6d8936d82d4c5b3372d8009cb7734ffa

SHA1
462002df9923d7806f8125d8b21140a1643d5242

SHA256
eaa51d204906e9d33cf78b4a809afb1e5d314d327708ffe0051d0c48a161b79e

SHA512
0b7da5b9fadfd67bc88a5f347a4b1b73165663f03d4607a978ae93959e099dc7e13f12322584d29e062ca3709f99b837a385f71149fb2059a2a9ae1b637c3ed2

Download Submit
/data/data/com.wukongtv.wkhelper/files/.umeng/exchangeIdentity.json

Filesize
162B

MD5
1f915dc3915afaf8719654059d31fb18

SHA1
375d42b88f1634ee74629a08bc3c3a1c53bb389e

SHA256
3712854c462f52b15177c10fa85fb627d78abf8768af42ed78e22cef1d4e4c89

SHA512
c4e1aa9b2573e8b3adf08494caf98ee72f490348df70271e1cf14869c8a132291c5d03a023c1221c39b9be4a71b750255fdf910341480226728abd92152b7612

Download Submit
/data/data/com.wukongtv.wkhelper/files/umeng_it.cache

Filesize
310B

MD5
536ddeba7dcc965a2648d174719af5e5

SHA1
2ee258b4cfc20d5ff53ea5bf939050a796378e32

SHA256
fc2fd594bbf3167c13a077e57357f1079e6266c412d8989833c0d6af45e04eb1

SHA512
a2f7081b499fb956fe8878d3682b0dbde6b02d05e18479348924515a46043934f071739eca6f346605410fa7c1cbed0a4cf7053e24c5ac24bd1986887674d2f8

Download Submit
/data/data/com.wukongtv.wkhelper/files/umeng_it.cache

Filesize
158B

MD5
59c5b4d2749718beb8b7f1d41c68e601

SHA1
b62a1c38dd6405c769bc2dd42bc841ab59745b74

SHA256
6ef50197144f1dcee37f9299cfa49f887652baa4d8840bedc535226bd0bb4a56

SHA512
7099bd9c2fab6b1ef990cb3cfc9a695d91aeb3bb7093c495627e0d3247d497fa5afc55bd60c10d40e0b7353fae9fbf485a5924b80452e34c6cb8ae4c9a42e687

Download Submit
/data/data/com.wukongtv.wkhelper/files/wkdbl

Filesize
9KB

MD5
c528d78295e03f4e0fb20722310a2518

SHA1
4eaf270e346f4ba4abfbe35aa6fbb0793ad9e1cc

SHA256
1877a161f1680739c2fe71894f601079afeedc8274191ee181faeea3f742e1a0

SHA512
8d92a272041000eccddbfa0d73eec7d3381af862018a683d1c25e679991205090df0336d6ca0285e1996c832276ba0969df1a3d65c6eb55b945a75dd86bd212d

Download Submit
/storage/emulated/0/Android/data/com.wukongtv.wkhelper/cache/uil-images/journal.tmp

Filesize
31B

MD5
8c92de9ce46d41a22f3b20f77404cc1d

SHA1
8671a6dca00edb72be47363a7071be65cf270373

SHA256
68bb33ddeed9200be85a71f70b377985f9ee68e91578afbde8321463396f1274

SHA512
30f45fe9954215d6adafcc8f0a060a7ff41963a64f9b849a37f0d18fe045038d429ec13bf15226769c4ba78dad3c52f3d9e0dbbb4fcdea4828a1efe956e48f56

Download Submit
/storage/emulated/0/Download/WKHelper/journal.tmp

Filesize
36B

MD5
37e8e716e0e2f4a0b05cd9571d95b84d

SHA1
f8d068f6931707bddb8cd69f706f2224ad1fea3c

SHA256
7080cb592d5149c858b206d3fd0d5e3e7d601f120af00b2616bee928ee1291ca

SHA512
e62b850901835fdb73fa6224618422f721dd765861d42f6bc2dd013413e96bd910ac5313afd9b4f63da74beb12a15fac81b5157456c9caa3031862dab84423f6

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads