ac4db404f91cf289fb01be4fc3585414b013a5f8313639306a48c9096ea963e8

Analysis

max time kernel
2s
max time network
131s
platform
android_x86
resource
android-x86-arm-20240624-en
resource tags

androidarch:armarch:x86image:android-x86-arm-20240624-enlocale:en-usos:android-9-x86system
submitted
11/09/2024, 15:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

alipay_preset.apk
Size

350KB
MD5

b1305a5e4779e06a6c654258b02dfb15
SHA1

f9e387482bc9649fba2aaf04ba6ae02334651223
SHA256

258c17f04df6697fccf9ae1479f35543bd4a4081edda48a1ea2c37bc1b870e6a
SHA512

9a3f94b5d38dfa8f7e6b24c0dde0b940e48a757e8634754f3c37050d826e620dfc1838c783d99e94f97b08dd7474d7b619a22d037d414300c3874476fdc90cfd
SSDEEP

6144:5FeKnPt0/sEGId2fuRmlxLwEd0r2FfS4QlV7G8v9oKvFuQL2bBV2fnayx5:5FeKFFEGc2ymsMa4QlV7G8Ge62fnayv

Score

7^/10

collection discovery evasion

Malware Config

Signatures

Requests cell location 2 TTPs 1 IoCs

Uses Android APIs to to get current cell location.

collection discovery evasion

Location Tracking

T1430

Geofencing

T1627.001

description	ioc	Process
Framework service call	com.android.internal.telephony.ITelephony.getCellLocation	com.alipay.android.app

Queries information about active data network 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.alipay.android.app

Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.wifi.IWifiManager.getConnectionInfo	com.alipay.android.app

com.alipay.android.app
1⤵
- Requests cell location
- Queries information about active data network
- Queries information about the current Wi-Fi connection
PID:4204

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Execution Guardrails

T1627

Geofencing

T1627.001

Credential Access

Discovery

Location Tracking

T1430

System Network Connections Discovery

T1421

Lateral Movement

Collection

Location Tracking

T1430

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/storage/emulated/0/alipay/logs/2024-09-11/15-20-7.log

Filesize
279B

MD5
8683cf1a8e280c8c95bc5c7bb18bd5c2

SHA1
fa8e5d15ac56fe718a906d564677f42c36290530

SHA256
5255d6417e8c63451bf5bfee80ca6716f8fc5481bb65c010055afebcea010af5

SHA512
4e327c286ce7d9c17f024f0d31cad7aa346de2f9c1bd3abc57ce296233424a05ac371f16530f08315947f43a8b43a657d93fb00f78800c406abcd73e3f700f5b

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads