c1a3932fcfab6a27b4da47f54ded6039cc1d258b32be8b3d13b94b4f8331469c

Analysis

max time kernel
25s
max time network
159s
platform
android_x86
resource
android-x86-arm-20240624-en
resource tags

androidarch:armarch:x86image:android-x86-arm-20240624-enlocale:en-usos:android-9-x86system
submitted
02-09-2024 08:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0e30948b3327a093bd7b35a10f65bc1f03a9b8d1d3e242dd6b5726e9136aaff0.apk
Size

16.0MB
MD5

be5e2f074432526ef36156e82bb219cf
SHA1

6cf0b782485e77218710fa024f1c11f122d84f60
SHA256

0e30948b3327a093bd7b35a10f65bc1f03a9b8d1d3e242dd6b5726e9136aaff0
SHA512

84633c70391513b388cdaf77634e0c6a60d270be121bfef6d94cbcc5f88e34a929659d13d2f05348e83f56c356be3eb9dc9fc44fbeca8cf6637cc19cba8af845
SSDEEP

393216:yf0YUtNuYwbvbaSafQ0Wejue+95sweOsjIYPaP:y9GNujbDaS4WeaeI5sqC8

Score

8^/10

discovery evasion persistence

Malware Config

Signatures

Checks if the Android device is rooted. 1 TTPs 2 IoCs
evasion

System Information Discovery
T1426

Processes:

com.apkpure.aegon

ioc process

/system/app/Superuser.apk com.apkpure.aegon
/system/xbin/su com.apkpure.aegon
Checks known Qemu pipes. 1 TTPs 2 IoCs
Checks for known pipes used by the Android emulator to communicate with the host.
evasion

System Checks
T1633.001

Processes:

com.apkpure.aegon

ioc process

/dev/socket/qemud com.apkpure.aegon
/dev/qemu_pipe com.apkpure.aegon
Queries information about running processes on the device 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about running processes on the device.
discovery

Process Discovery
T1424

Processes:

com.apkpure.aegon

description ioc process

Framework service call android.app.IActivityManager.getRunningAppProcesses com.apkpure.aegon
Acquires the wake lock 1 IoCs

Processes:

com.apkpure.aegon

description ioc process

Framework service call android.os.IPowerManager.acquireWakeLock com.apkpure.aegon

ioc	process
/system/app/Superuser.apk	com.apkpure.aegon
/system/xbin/su	com.apkpure.aegon

ioc	process
/dev/socket/qemud	com.apkpure.aegon
/dev/qemu_pipe	com.apkpure.aegon

description	ioc	process
Framework service call	android.app.IActivityManager.getRunningAppProcesses	com.apkpure.aegon

description	ioc	process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.apkpure.aegon

Queries information about active data network 1 TTPs 2 IoCs

discovery

System Network Connections Discovery

T1421

Processes:

com.apkpure.aegoncom.apkpure.aegon:accessibility

description	ioc	process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.apkpure.aegon
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.apkpure.aegon:accessibility

Queries the mobile country code (MCC) 1 TTPs 1 IoCs
discovery

System Network Configuration Discovery
T1422

Processes:

com.apkpure.aegon

description ioc process

Framework service call com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone com.apkpure.aegon
Checks the presence of a debugger
evasion

description	ioc	process
Framework service call	com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone	com.apkpure.aegon

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 2 IoCs

persistence

Broadcast Receivers

T1624.001

Processes:

com.apkpure.aegoncom.apkpure.aegon:accessibility

description	ioc	process
Framework service call	android.app.IActivityManager.registerReceiver	com.apkpure.aegon
Framework service call	android.app.IActivityManager.registerReceiver	com.apkpure.aegon:accessibility

Checks CPU information 2 TTPs 1 IoCs

System Checks
T1633.001

System Information Discovery
T1426

Processes:

com.apkpure.aegon

description ioc process

File opened for read /proc/cpuinfo com.apkpure.aegon
Checks memory information 2 TTPs 1 IoCs

System Checks
T1633.001

System Information Discovery
T1426

Processes:

com.apkpure.aegon

description ioc process

File opened for read /proc/meminfo com.apkpure.aegon

description	ioc	process
File opened for read	/proc/cpuinfo	com.apkpure.aegon

description	ioc	process
File opened for read	/proc/meminfo	com.apkpure.aegon

com.apkpure.aegon
1⤵
- Checks if the Android device is rooted.
- Checks known Qemu pipes.
- Queries information about running processes on the device
- Acquires the wake lock
- Queries information about active data network
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Checks CPU information
- Checks memory information
PID:4249

com.apkpure.aegon:accessibility
1⤵
- Queries information about active data network
- Registers a broadcast receiver at runtime (usually for listening for system events)
PID:4434

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Discovery

Process Discovery

T1424

System Information Discovery

T1426

System Network Configuration Discovery

T1422

System Network Connections Discovery

T1421

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.apkpure.aegon/databases/StartApp-d6864f2502af7851-journal

Filesize
512B

MD5
523f3f822b1d1b11041cac14aaba96d4

SHA1
03d10e843a1159325baa9d4f132d4c91e558b544

SHA256
cb74b6a1bfeb14a31f1e882581d80b0b8777ee797818909e5075df5e002c1a8a

SHA512
386cbe87406e5e3e260f1fe4d16693f458b66e466e6ce9f41f993fbfd52b3e20af048a87ad42ad689a0fa8e6c810242c387bc6173b740b94bbc2eff0d883870c

Download Submit
/data/data/com.apkpure.aegon/databases/StartApp-d6864f2502af7851-shm

Filesize
28KB

MD5
cf845a781c107ec1346e849c9dd1b7e8

SHA1
b44ccc7f7d519352422e59ee8b0bdbac881768a7

SHA256
18619b678a5c207a971a0aa931604f48162e307c57ecdec450d5f095fe9f32c7

SHA512
4802861ea06dc7fb85229a3c8f04e707a084f1ba516510c6f269821b33c8ee4ebf495258fe5bee4850668a5aac1a45f0edf51580da13b7ee160a29d067c67612

Download Submit
/data/data/com.apkpure.aegon/databases/StartApp-d6864f2502af7851-wal

Filesize
28KB

MD5
62046f444c2f21087cf4d3f8e240e006

SHA1
6ab56d9ea9d5fc5d7774c76988343d8e9046c043

SHA256
67b4fe30482bcea2705e811bdd179ed3529c8920ca5833a4bfa6d5b4d1cedb9a

SHA512
7604a66778212a0ecec3f328144ebeae1a283393e2eac2e18cb77ce963c2e17a46e0f5acbe4f2a28ee632624b967e2f33d330a9e2f16274648e4c48e52936897

Download Submit
/data/data/com.apkpure.aegon/databases/com.google.android.datatransport.events

Filesize
4KB

MD5
f2b4b0190b9f384ca885f0c8c9b14700

SHA1
934ff2646757b5b6e7f20f6a0aa76c7f995d9361

SHA256
0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514

SHA512
ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1

Download Submit
/data/data/com.apkpure.aegon/databases/com.google.android.datatransport.events-journal

Filesize
32KB

MD5
155d73f882b642d57eaba949b3ee6791

SHA1
ebc669743a0e8cfdd8f1d8f8750a430162e0b419

SHA256
402a2807c4eaab89729bee36aa0865fce129b013e9db02fea8d7ddaf5665c76e

SHA512
05af0638ae8f2102be9d4216c085b542423e4dde1dd56f671a95f42c3101455b05d7ef8e6619b6fd982a77c2c7f370f23741a208ada195764c5088eaac658d53

Download Submit
/data/data/com.apkpure.aegon/databases/com.google.android.datatransport.events-shm

Filesize
32KB

MD5
bb7df04e1b0a2570657527a7e108ae23

SHA1
5188431849b4613152fd7bdba6a3ff0a4fd6424b

SHA256
c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479

SHA512
768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

Download Submit
/data/data/com.apkpure.aegon/databases/com.google.android.datatransport.events-wal

Filesize
52KB

MD5
9208ce41c037b37e6ef562ed5199097f

SHA1
815e359a4bc6c771968846c2a9963741a14f9478

SHA256
6e41e6c99d0d48927192246cfa9e145dccfb956d2cbd9b36a3542fb8c80ddeb5

SHA512
2aae0dc7e86a7a94b3f0c9c0225b684db040e1993c54721e629921dda58c12baf7d6b6f455c9af83ff8a0ac456df5b0dc572df3871a39f4153967d3dcafdce67

Download Submit
/data/data/com.apkpure.aegon/databases/downloads.db-journal

Filesize
512B

MD5
9a66c7a8d790f6d99aa7ca95688b20f2

SHA1
5a09cda2470ddff84c2e2e876b1fff9f922af3fe

SHA256
13af6f0ed580093fce34f4599d5684197b7abd1a3e26f6206b093bfb11797303

SHA512
336588d90ac88eb626d8753030286d3717b422aaffb1b729999e587236509176bee57dc1ddd233349aed1ecbff63e04b54b4bdc320a806f32a0ca1efd289b665

Download Submit
/data/data/com.apkpure.aegon/databases/downloads.db-wal

Filesize
140KB

MD5
b192e042645a4136f8e816c09435f8cf

SHA1
12733d4f5eccfc808cb088b1f176eecb3d314690

SHA256
49df31b2c6d283eae31ca922035b424ef8c7125939a513c5420d7b191bab45dd

SHA512
ef073772ff1c3316edeeb3a9ece2b6c1dd0ff2aaa7edbe8004d75ca5223819bb2c2584b06e0fe76fb139c8eed6f247909e92daf4ad210262354953958c0361d9

Download Submit
/data/data/com.apkpure.aegon/databases/google_app_measurement_local.db

Filesize
16KB

MD5
7237409e0640cfab7bdbd429bf821a3b

SHA1
4c3da934842f8d4835dfe2a9c275a300e5123309

SHA256
5c8e1b63d187efafe1e09bfadd83fd360176d689b57b5a0cc40e6854c12449fa

SHA512
c8afaf6a8ee43ce3601feff417bfaec563c01bcff0aae24577054034112b2020967f25b0b1a919c3c9e5e81d62a21a87e908b782c4d5cb8bba8ac259108e9c1f

Download Submit
/data/data/com.apkpure.aegon/databases/google_app_measurement_local.db

Filesize
16KB

MD5
b495e4835a218b33a91f3e3b1fae1917

SHA1
effb31d111f232db1b8354f601150acd9da78884

SHA256
8238e1f4d6e4e23cabc763a9089322fbce995c6839b71b2b757779f1532c5f9c

SHA512
0b787c53620131877016d5284d8efa73a7c32497ea119cfe3e7b12ba4cdfb46034cef92e5745fa1f1cfd67747166e67a3bcc7e8d8a6602c7fe885818b8db083b

Download Submit
/data/data/com.apkpure.aegon/databases/google_app_measurement_local.db-journal

Filesize
512B

MD5
7ab18e7f35f26a26ecd49c0cddf39820

SHA1
b416e68daae24b2997e3a9c4eebacd6fce754afa

SHA256
dcb7a78921079c3bf808bf0e899e7eb1ad43a9c7a16ef3c300694dd6268cfd21

SHA512
bbc515fd12111e1481188ca1978d665421bcd8fdb810a6e97a95f80cfd51644e92f265bee9a0d7a584f9c153cd8e13c92c880da3a604ba90b0cd51e81b876c06

Download Submit
/data/data/com.apkpure.aegon/databases/google_app_measurement_local.db-wal

Filesize
36KB

MD5
046fb8a27cb43d4cae090d2cae697151

SHA1
2d9f7237ee9070554798b87a9cc001f88ac84d4c

SHA256
56e3f242dacdfe8f79fda90889ff11d9f4cf09ad8d8ba609b54743d77ad9a0e4

SHA512
b3bf06efd95fa3cceeb06c8ca4d9898c8a1f07fe9d9cc7bd55dee798c7598544896a22839d830a39dc13434d94b2f45cb1632d3506f26e6d762c29bae80ee0d6

Download Submit
/data/data/com.apkpure.aegon/files/.com.google.firebase.crashlytics/66D576820257-0001-1099-5C2E970FA5B3BeginSession.cls_temp

Filesize
8KB

MD5
8cd8077f19afffeab9fc9e36858fccba

SHA1
bba8d2a350a2ef6b983d5c671fffcf37a582c9cd

SHA256
6ebace1d9069f7fbe8c9feb81d674dec7f5a7e79ddc580c0d0cfd8232e043e47

SHA512
47f50590fd9abe1ef4ea974c71b23f8df8c34a7247600b80bfafa94dbbfe3d9eda82ef24b069fde2882dfd1d37f62864046f1d8b283c14f70c48a88188e99214

Download Submit
/data/data/com.apkpure.aegon/files/.com.google.firebase.crashlytics/66D576820257-0001-1099-5C2E970FA5B3SessionApp.cls_temp

Filesize
32KB

MD5
6b3998f761effecf5de6cdc5f9c9f9a0

SHA1
20284d3410df642982e43197a02355e5e2ac0718

SHA256
53eae339888284a7ca65723767352eabb0af98610f6d0e21e8b1f677a8a81d55

SHA512
c57eff19ca6292385bc6a9d908d16e231ca274181fae841c716be9289a94e60c3359844b362260422f3ba4fbe48e4345e7aa03e6e9ed138ef6fcdf0a395fff49

Download Submit
/data/data/com.apkpure.aegon/files/.com.google.firebase.crashlytics/66D576820257-0001-1099-5C2E970FA5B3SessionDevice.cls_temp

Filesize
48B

MD5
1259ecf4689f83376bf373856c23d57c

SHA1
19507a1426d938dd77930f194bd65779565f5982

SHA256
2861892e8f098662c173abcaf15b2480496b48dc1e96eb777cd6a3124dd63e17

SHA512
0ab328ff2fdbb8b4778315c9ad769b3205a29c39771162529bd5598a5e370468e75edb05b89cf0d6f3e18d226fa2bd19fb70e68fb59023a80fe49f8e3185b230

Download Submit
/data/data/com.apkpure.aegon/files/.com.google.firebase.crashlytics/66D576820257-0001-1099-5C2E970FA5B3SessionOS.cls_temp

Filesize
14B

MD5
9b3d4522944ce6396563812bfdb92fa9

SHA1
6d2a6133c8f01938a48ccc77ef86ad8ca335c020

SHA256
d32805d685a3f50caa7f1c0bd7c8804c4d937a866513289f60e3184f7a591ed9

SHA512
091d87643712530bf9006135db42a5a50742bb5ca3026bcc5f2c1c17bf4fd984a8938d29263b0abde3d15cac196d2230902534e200b0b79485e3a1bd97d95727

Download Submit
/data/data/com.apkpure.aegon/files/.com.google.firebase.crashlytics/report-persistence/sessions/66D576820257000110995C2E970FA5B3/report

Filesize
748B

MD5
4ea445e6a111cb0b5c85cde1225dcac2

SHA1
300dca4ab5752e5b11b5bb9d2b66067187b6a03d

SHA256
b952a3b18660ac40233f0868107477fc60ef0a3f10ee33f7318122dbd816a792

SHA512
5f2e67b8db88d4e022cbec47fa55cc03a21851672467184dbf8520f30cb2498203333e4493197c59a3ea93dad92eacc527d81837884e6d8c2674272cf08de9ec

Download Submit
/data/data/com.apkpure.aegon/files/PersistedInstallation1387714440028017283tmp

Filesize
560B

MD5
9322877ad6659181e3b0b1719db03eea

SHA1
3662cf681f5517475e142942db454244a6e59245

SHA256
46540004cc2c138f0d649e5003322866a8586395d2cd8ae01944dd8d49f56f68

SHA512
207bf5a6db26a426d0ee37218b2b1900e4790bfc43f080482aafa32a96ad30a997543a1a696030726c5134711a2072d27df7226e8b1a700340478f3ca3ad8939

Download Submit
/data/data/com.apkpure.aegon/files/PersistedInstallation3202421280568563907tmp

Filesize
512B

MD5
10d236344a5d5cc57247f5c59baacf46

SHA1
fe9922cce64444bf954bc9853d62fd664c94c0c2

SHA256
ab6593ba8c6dc6efe8be5e9f20d7811db84a321b1ff84a252d434602900c514b

SHA512
feb81256037936ef052a65ccee84d7fb245b3ae24124b67e033b5935dcfb498d467fba53ae3557790050a792b3712cb41d536b5d1d19ce03d8ace6a2cb3080e7

Download Submit
/data/data/com.apkpure.aegon/files/com.apkpure.aegon_c/commainw2c6c7m5i6an9.

Filesize
34KB

MD5
9574bd462cd8e7648a755f24f0851608

SHA1
72584826cc2fea7d2ba5f98dff50cb4f34766ec0

SHA256
4d79511d4798b93d6ce33442ee9f0f35f58a91f32f4177a524b25f5e1e0ec7d7

SHA512
2b704ba4c14b592186f278fa362cbbd4068a1e8734735ac3e01577e573c16b894c5c015be63576a183f78f1ee8cbd85aee947b05eb763fc05d20c7b36bb36159

Download Submit