023ce9a368ece43992682377d3d341b75b7b54452bad1dc90419a86fd97c980f

Analysis

max time kernel
78s
max time network
158s
platform
android_x64
resource
android-x64-20240624-en
resource tags

androidarch:x64arch:x86image:android-x64-20240624-enlocale:en-usos:android-10-x64system
submitted
10-10-2024 17:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b.apk
Size

982KB
MD5

e6658f97192b31a14f9142cdca67f54e
SHA1

900971b86950af115dd829b925fc42d51773d0b5
SHA256

e2cb52fcd8a17d6854c048d44a22f28c45e2f7d20e6f2914f735c7f268988383
SHA512

942d2b2f56c4dbb3acbad8176852426e3e461fe1b4e0689ec023fc8b59e4b41b674e62d11e385cf16eb6853f191589c5be71ed5750c5aff017e74b1c89f193f3
SSDEEP

24576:U8TnIAQH318QfU3zkEriqUfgMpULJHx+zz7ub:U82lMjrOBYSU9H0zs

Score

7^/10

collection credential_access discovery impact persistence

Malware Config

Signatures

Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs

Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.

collection credential_access impact

Clipboard Data

T1414

Transmitted Data Manipulation

T1641.001

description	ioc	Process
Framework service call	android.content.IClipboard.addPrimaryClipChangedListener	com.android.system.ui

Domain associated with commercial stalkerware software, includes indicators from echap.eu.org 1 IoCs

flow	ioc
13	alog.umeng.com

Queries information about active data network 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.android.system.ui

Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.wifi.IWifiManager.getConnectionInfo	com.android.system.ui

Queries the mobile country code (MCC) 1 TTPs 1 IoCs

discovery

System Network Configuration Discovery

T1422

description	ioc	Process
Framework service call	com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone	com.android.system.ui

Queries the unique device ID (IMEI, MEID, IMSI) 1 TTPs
discovery

System Network Configuration Discovery
T1422
Reads information about phone network operator. 1 TTPs
discovery

System Network Configuration Discovery
T1422

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs

persistence

Broadcast Receivers

T1624.001

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	com.android.system.ui

Checks CPU information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	com.android.system.ui

Checks memory information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	com.android.system.ui

com.android.system.ui
1⤵
- Obtains sensitive information copied to the device clipboard
- Queries information about active data network
- Queries information about the current Wi-Fi connection
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Checks CPU information
- Checks memory information
PID:5069

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Clipboard Data

T1414

Discovery

System Information Discovery

T1426

System Network Configuration Discovery

T1422

System Network Connections Discovery

T1421

Lateral Movement

Collection

Clipboard Data

T1414

Command and Control

Exfiltration

Impact

Data Manipulation

T1641

Transmitted Data Manipulation

T1641.001

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.android.system.ui/files/eula.zip

Filesize
63KB

MD5
1a6d49d2adb9303a161a950db2de3927

SHA1
3f9a3ff691d967a4bc3bdffe6327cfab0c416ef4

SHA256
2eec668519c3ac15ba5e1c7bb8d83abb9bf935a32bde220e42a7047d66c824d2

SHA512
6459e8004f34945396fcec424bc37e34c7f86483a63a74a9bca2e9c70791cb0fda0ccb23b72944167693c7c71b418db41acd08dc83f2bf55594a02c5725fa4cb

Download Submit
/data/data/com.android.system.ui/files/mobclick_agent_cached_com.android.system.ui

Filesize
100B

MD5
240abb5f5e30ec4a4f2d7eb409a89136

SHA1
51bee5dc859d8c531eccc7104d6db40e83bcc060

SHA256
959e7fcba960c03384418561fc51a944b125dfd47a95cf78dfdeb607fac68cd2

SHA512
c99b7a5f08337555cf6de3ff75f903e61cc295ebdfb23303b6aac8da88da707437f1cf331c08b53be1470576e95e9fe96893103dc0d57e78e298723fabd2d5b9

Download Submit
/data/data/com.android.system.ui/files/offline_eula_body.html

Filesize
18KB

MD5
7813643485a5318f68291e87315a6fca

SHA1
207f1059f5ea34b0fc4011848fa4682608d26443

SHA256
c0487218c63d176ff68c0c6bc91866222ad9ae6420ea6fdf06790ff01a1db918

SHA512
e571984238e162b5d2c61973fa62645950f69b2a75a0c7b11d6854c9b89ab0164475c96515b7c48c8d60926c90f439e7c172d5df00b11413bd6584b0d0b3f19c

Download Submit
/data/data/com.android.system.ui/files/offline_eula_footer.html

Filesize
13KB

MD5
9818dabc2eb86d5f4f071e9d67334570

SHA1
117e7978c9293d86ea5492b90a4999cc24225dbb

SHA256
1f075332b57fdfbb9417718f3c0d9f27ffbb2c135b3291aca4b9f2911d7e9e3b

SHA512
79937390d4b02688abb0e24cef356024c3dbd3cd59d85ea3300556af59f0648293ed24fb5db740a4329fdddccf43af3b7679135555397a3adedd3eeccf5423a0

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads