40aa6f968973ce35adf461872d5aa44fd64bd35c6bc50f6d4e7228239c22c0d2

Analysis

max time kernel
46s
max time network
156s
platform
android_x64
resource
android-x64-20240624-en
resource tags

androidarch:x64arch:x86image:android-x64-20240624-enlocale:en-usos:android-10-x64system
submitted
16/10/2024, 22:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

40aa6f968973ce35adf461872d5aa44fd64bd35c6bc50f6d4e7228239c22c0d2.apk
Size

4.4MB
MD5

963b8373e3ab385651cfbe4d0d226d19
SHA1

7587a27b6ebabf7e56b75c4e931851295cd39007
SHA256

40aa6f968973ce35adf461872d5aa44fd64bd35c6bc50f6d4e7228239c22c0d2
SHA512

46cef2cfd195c6c1bd110fcf33219f6c9117e0788f69e9969c2cb5e77c356e778a9be6d4090a17fc844e5a5b6648e053fa0d09fa118df483a63d1e49939abf7b
SSDEEP

98304:ZHfrbzjXCFpZpKmqk5sjcstp0ZU05uZEpSYcNQ6i2infseJjPUYl:1Skk5sjXcoZiFIOsyMk

Score

8^/10

banker collection credential_access discovery evasion execution persistence stealth trojan

Malware Config

Signatures

Removes its main activity from the application launcher 1 TTPs 3 IoCs

stealth trojan evasion

Suppress Application Icon

T1628.001

pid	Process
4930	com.tencent.mm
4930	com.tencent.mm
4930	com.tencent.mm

Makes use of the framework's Accessibility service 4 TTPs 3 IoCs

Retrieves information displayed on the phone screen using AccessibilityService.

collection evasion credential_access

Input Injection

T1516

Screen Capture

T1513

Keylogging

T1417.001

GUI Input Capture

T1417.002

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	com.tencent.mm
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId	com.tencent.mm
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByText	com.tencent.mm

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
banker discovery

Security Software Discovery
T1418.001

Queries account information for other applications stored on the device 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect account information stored on the device.

collection

Stored Application Data

T1409

description	ioc	Process
Framework service call	android.accounts.IAccountManager.getAccounts	com.tencent.mm

Queries the phone number (MSISDN for GSM devices) 1 TTPs
discovery

System Network Configuration Discovery
T1422

Reads the contacts stored on the device. 1 TTPs 1 IoCs

collection

Contact List

T1636.003

description	ioc	Process
URI accessed for read	content://com.android.contacts/data/phones	com.tencent.mm

Reads the content of the calendar entry data. 1 TTPs 1 IoCs

collection

Calendar Entries

T1636.001

description	ioc	Process
URI accessed for read	content://com.android.calendar/events	com.tencent.mm

Reads the content of the call log. 1 TTPs 1 IoCs

collection

Call Log

T1636.002

description	ioc	Process
URI accessed for read	content://call_log/calls	com.tencent.mm

Requests cell location 2 TTPs 1 IoCs

Uses Android APIs to to get current cell location.

collection discovery evasion

Location Tracking

T1430

Geofencing

T1627.001

description	ioc	Process
Framework service call	com.android.internal.telephony.ITelephony.getCellLocation	com.tencent.mm

Acquires the wake lock 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.tencent.mm

Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

Application may abuse the framework's foreground service to continue running in the foreground.

evasion persistence

Foreground Persistence

T1541

description	ioc	Process
Framework service call	android.app.IActivityManager.setServiceForeground	com.tencent.mm

Queries information about active data network 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.tencent.mm

Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.wifi.IWifiManager.getConnectionInfo	com.tencent.mm

Queries the mobile country code (MCC) 1 TTPs 1 IoCs

discovery

System Network Configuration Discovery

T1422

description	ioc	Process
Framework service call	com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone	com.tencent.mm

Listens for changes in the sensor environment (might be used to detect emulation) 1 TTPs 1 IoCs

evasion

User Evasion

T1628.002

description	ioc	Process
Framework API call	android.hardware.SensorManager.registerListener	com.tencent.mm

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs

persistence

Broadcast Receivers

T1624.001

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	com.tencent.mm

Schedules tasks to execute at a specified time 1 TTPs 1 IoCs

Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.

execution persistence

Scheduled Task/Job

T1603

description	ioc	Process
Framework service call	android.app.job.IJobScheduler.schedule	com.tencent.mm

com.tencent.mm
1⤵
- Removes its main activity from the application launcher
- Makes use of the framework's Accessibility service
- Queries account information for other applications stored on the device
- Reads the contacts stored on the device.
- Reads the content of the calendar entry data.
- Reads the content of the call log.
- Requests cell location
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Queries information about active data network
- Queries information about the current Wi-Fi connection
- Queries the mobile country code (MCC)
- Listens for changes in the sensor environment (might be used to detect emulation)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Schedules tasks to execute at a specified time
PID:4930

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Scheduled Task/Job

T1603

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Foreground Persistence

T1541

Scheduled Task/Job

T1603

Privilege Escalation

Defense Evasion

Execution Guardrails

T1627

Geofencing

T1627.001

Foreground Persistence

T1541

Hide Artifacts

T1628

Suppress Application Icon

T1628.001

User Evasion

T1628.002

Input Injection

T1516

Credential Access

Input Capture

T1417

GUI Input Capture

T1417.002

Keylogging

T1417.001

Discovery

Location Tracking

T1430

Software Discovery

T1418

Security Software Discovery

T1418.001

System Network Configuration Discovery

T1422

System Network Connections Discovery

T1421

Lateral Movement

Collection

Input Capture

T1417

GUI Input Capture

T1417.002

Keylogging

T1417.001

Location Tracking

T1430

Protected User Data

T1636

Calendar Entries

T1636.001

Call Log

T1636.002

Contact List

T1636.003

Screen Capture

T1513

Stored Application Data

T1409

Command and Control

Exfiltration

Impact

Input Injection

T1516

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.tencent.mm/databases/Dname

Filesize
32KB

MD5
0ec8d5e24581e56eb01c45155efe2049

SHA1
4de2aebc5e22d0420e54cb553c2739e50481e50a

SHA256
5bb1fd7e82a28019975971aae5f49b0eb2ddef4a943663b654ede402d2f7f616

SHA512
23f87b81f1b49b80a88b1eab7d5e08e7001486b135bedc434601eed4ab74b72804ae4f907ede18213454dfa9da7058692b012861170306adbe6b12650dd51fd4

Download Submit
/data/data/com.tencent.mm/databases/Dname-journal

Filesize
512B

MD5
0dc3857a87feef7a401f4228d4d36306

SHA1
d8803f049a98ab211b8c77c9151d8cd1bffa2b16

SHA256
b6a268f1f9d148d3369fa741b7a59ba43ab736a5b553678026f7a657ce8d66ea

SHA512
5fe63d1fa6c340f64984a63c8c2e94f505e3d468c7e0a09f51e423e4139181233300bc1702b382239682de6ad7eb9b0cc8adba1ed78977f48566f906084bb094

Download Submit
/data/data/com.tencent.mm/databases/Dname-journal

Filesize
8KB

MD5
8af2381494e47995d160828011561dfa

SHA1
43ba8298269d88917aca2858180f23511bd217d0

SHA256
f387630fb5558d73e8b4a92ae62e7e46b232b923ec2ceb115c44a4fadc9118a8

SHA512
cb0bbb8cbcf48f689bc6756b47488e6973de9fed4db5a89ee195421b3d5f88e441d1758f1e3a451d30176573fb9549cb5292552a1075a8f30095ff7560bb2b9c

Download Submit
/data/data/com.tencent.mm/databases/Dname-journal

Filesize
8KB

MD5
021c5f3d2e382814cb0e09a65031c457

SHA1
02506a10433fc3e73f012bda2345a5a75f5b95bd

SHA256
6ca1ebb2b39a3dd1b071eabffdcef24df0996ce8033fba6ee9221161bd8b9a80

SHA512
46bd40648300b3a516d8e9c7131c7a3b908e65684976bb5606c8542f07e1dcb7019247a1724e616c9003cd28edc6f9d256929b10cc4ca6bebab2af127a95df27

Download Submit
/data/data/com.tencent.mm/databases/Dname-journal

Filesize
8KB

MD5
4eceda3b6af0a6c4dfe1774f1ee5ab8a

SHA1
c7b0afceb6405191e5a6716d4fe1844d1d42dda9

SHA256
c6d6ed923182c8b746411d1fdb0ffcfb043371d4a3bb6ca7b920ef34dd508812

SHA512
9d7571516d162c62b190fd9a68841bb830b9d1082229f105bd9eef4de0ec552f091486f92a7572876d8bbe7136f84942b957fa73fa04f7f13a246dde82f42b06

Download Submit
/data/data/com.tencent.mm/databases/Dname-journal

Filesize
8KB

MD5
307dddd3a2e808ecd80cda10d199a62e

SHA1
e6f518085201ab0347a4710f08d60fba155c239c

SHA256
1f88cd3e6853c883e03e3407da46ad78b16aa0fd5584ca0d304a4ce417d794b4

SHA512
0ddc227c2c1dcead143a9380aa75caa6063b185d8fccad25b0ec4a11cced0425d06ff2218bd2c716a02319d486af252e33675bb38727e33e854f38049e50734d

Download Submit
/data/data/com.tencent.mm/databases/evernote_jobs.db

Filesize
16KB

MD5
628b73a9c8ad0f2cba4019bd4eac2d4c

SHA1
08392e6954e7e2b5b55d08d60be5161a421edd0a

SHA256
4899f6e594fc7e52e8f47acfe89d7a0fe0aaebcea5aacd7dfcd5eccc25bf6e0d

SHA512
0b00b486814ef090ed495dda7ec31a5492b5f0d06e294bdcd0ca9b52bc0e533eee644bb820045f399e2529e07076478d16171db8384c7007a50ac63eccc2a262

Download Submit
/data/data/com.tencent.mm/databases/evernote_jobs.db-journal

Filesize
512B

MD5
9cdc71da417e35fab02feded2a03c15b

SHA1
72d87237d20eddd3d3499fbe1d18277fc67fc3dc

SHA256
514d65182f80df4a433fd469dccc8d9fc83d4a2bb7229bacf4a525c002a544a3

SHA512
246cf8d9e75cee3cc22d2e6864e969f436b6ae10c5ffa27763d0570e82421e2c52f2cfa2d3123e0ef3e3af821fe2aa906e8d1aa4bca98e2d05fb4dc4f267bbc2

Download Submit
/data/data/com.tencent.mm/databases/evernote_jobs.db-journal

Filesize
8KB

MD5
eacd299b27817f275deb0134aeeccc2c

SHA1
aa2da308b3fd89c94235e3a02072233b2b56930a

SHA256
f9ee94b1adc77edd255d3a0e7dc0b8a4a94bdb0e259c34aafc97352490eb9d1b

SHA512
8c797271dbcf9023bd3a29e3a6e7feaf35c6e098ea0891f6191564fa9ed6b4453fa63d4fc1f7f5d2cc1489d3e2a1aef4c809d23a2e098fdeed399ef0de41aab4

Download Submit
/data/data/com.tencent.mm/databases/evernote_jobs.db-journal

Filesize
8KB

MD5
601c0199bd93b46494bdb8477dfad758

SHA1
263977e127bc1de8e3dfc9a4d5878e022e53a946

SHA256
4aa79398aaf1550ec43177b641d17a4e355bea753687a30fc06c73c49abe75ae

SHA512
8225b0722b38ec2f9ec80d9c331e086ba01342c122b8b59f37c6b54115b99281daf04d64307f0a89a5b83f9a53f9d93706a375160a80afc47d915d3eb979820d

Download Submit
/data/data/com.tencent.mm/databases/evernote_jobs.db-journal

Filesize
8KB

MD5
dace19f74772d4719d9304caed533f2e

SHA1
f810ec1413da5a0899f7ee843b764d039b0118d7

SHA256
928cfd74fc060342f5c09991ef71a5d44cebaaf48a3fb1bf244936ef7e77eae7

SHA512
c52f7477cd3ad40c876997115228bf74dfc11b97c144c4d213af7e586e8905b71e8e9fa2af770316ecf6c8ca88740648b243072154b897a6fc9d7faa6a8fbeee

Download Submit
/data/data/com.tencent.mm/databases/evernote_jobs.db-journal

Filesize
8KB

MD5
2c15ce6b7131898e683e4c06dc3abdc0

SHA1
9076bc139cda9888c9053d2e9421db46f163df0e

SHA256
778b1cf63a39456eaea5910a4dc331a4f10b4807f52e53420a6a61a0efa06a1c

SHA512
7e082ec079dfb2f2c9edb0f60bf9b08a2358b2d0dbeb52197d1663d1c8523e21ff3066a114af844542fd5ac3c3dd46d648db332c0241171a1fe4ff9c76f59af4

Download Submit
/data/data/com.tencent.mm/databases/evernote_jobs.db-journal

Filesize
8KB

MD5
776e9dbd1aedea8e5a25c0f0b212c0ad

SHA1
f81163e20108fd028c565979bfe006944755da8d

SHA256
3c90e03cd91a9f263c3c4ee72915c04da2a5780d9b357164278d1c69bde1bd18

SHA512
f291740044cbf19a950e40f1c544c57d107ea885a4a89b03b521e97a4e3f1656e241a13c4067e98a1aac1c728ec8e607233cdcf59f6d9c2d98d1db53f7e46cfc

Download Submit
/data/data/com.tencent.mm/files/CallLogs.txt

Filesize
3B

MD5
58e0494c51d30eb3494f7c9198986bb9

SHA1
cd0d4cc32346750408f7d4f5e78ec9a6e5b79a0d

SHA256
37517e5f3dc66819f61f5a7bb8ace1921282415f10551d2defa5c3eb0985b570

SHA512
b7a9336ed3a424b5d4d59d9b20d0bbc33217207b584db6b758fddb9a70b99e7c8c9f8387ef318a6b2039e62f09a3a2592bf5c76d6947a6ea1d107b924d7461f4

Download Submit
/data/data/com.tencent.mm/files/GP.txt

Filesize
108B

MD5
3e4cb54dc7c1d4f0afa62b804232dfbb

SHA1
351dace9da8b263d60da37199fa044e42690dbc7

SHA256
533d4302f4635bf784dec987a8a1f3265ff7ab92cb7d1062f104d680e6b22153

SHA512
ec5e82708b4bfeaee6d8531d7dea1ae82adb7416a3a563cd924487a06b7daa5ac7f9cc24c3f3127866e0e168cf1b18f6733910d8aa69dbaa6a3da12c68790a87

Download Submit
/data/data/com.tencent.mm/files/GP.txt

Filesize
126B

MD5
36590b4749629489c792a20b9604e4de

SHA1
41ef76c615d524b9f7a0d8c18899b552d9471ae2

SHA256
1cce6da226b10bdf0d57ef92dda50533da17be0dc37ac46f8126b015e02a9314

SHA512
5b87260002f2b43552bb3c50d65ecc6144882f9edd28fc05273665cd34adfbbab0b5b818b60ed12e8da189176952d0828b726a5c86c6a9a61f2e8df0213bea8e

Download Submit
/data/data/com.tencent.mm/files/GP.txt

Filesize
108B

MD5
fa145f237ac907f451a51189036ddaa4

SHA1
128bfda32df69985cbde14aa074533df2f46c171

SHA256
1467584e24756c00817d16dd041e52101f81390e9d257975d20d87c297ac8d79

SHA512
1e87f1ca07c4795865771096f8e3e5e783aacb60c4e11f7058b5bae1f08fd9900132419262ccc4014789dbc65dc55e046edd73580178878c75f39ae0b4c677b9

Download Submit
/data/data/com.tencent.mm/files/GP.txt

Filesize
136B

MD5
bc3ad906664e2c8b71db16113fb64db1

SHA1
a9ccb7d4af415506da83409a89cb4802917239a8

SHA256
5cd25a284799bcbdb766e1666878c69a3dd3fde70138ab211518107f2c2be499

SHA512
3b01fc4a0467d429aa430db35010beb7720b7a49888a24b035f605b1233073edff0a9970c3b4438ee18827786ddcb772a61f5ea4e227eb3c75b7b16780d85b8d

Download Submit
/data/data/com.tencent.mm/files/GP.txt

Filesize
126B

MD5
16dba8e3b6facd2007bc398b33e31296

SHA1
8a025186c3e0c3bc0a51c1c61afcc858de74b725

SHA256
f55edb8459405b1e13201773e415bd83f11d2d18101cf0e165f368c474b3c5ee

SHA512
c41ca9857605586742a51cd55e950f4e60a41a54b96c9d8c7c91ef8defdbdf8569dd91b217cf51d4ccbda67e0f4eb140b73c713fccf712e80ed1dabecf895186

Download Submit
/data/data/com.tencent.mm/files/Tree.txt

Filesize
351B

MD5
658f2f2332f6f568b62b1c48de0c8f95

SHA1
7a7230a95dfebd077fb06b6df973410c8092cf7e

SHA256
7d6dcbdba0e53b74b8e06b625c05c31a660a3a53b842059bf0b4c730ae270072

SHA512
9eb97e0c24a8898cc971beef599272e2ab0dbc737de6b85ecffd4067e842e6b2a42567662fa7aef57578909ba6484d20fec168f890133f5b17ea8ce931c3d805

Download Submit
/data/data/com.tencent.mm/files/accounts.txt

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
/data/data/com.tencent.mm/files/netinfo.txt

Filesize
827B

MD5
7f862d6a1a0ed5a4e055593aca20bba8

SHA1
4f310996e14b4859395b068478746006d2be462b

SHA256
52247ff18547655b53303ced8a0f30330b1cdafdf8bfc2edaadd5e8be84dc4ef

SHA512
5644833494628e9a83617634e808ff7a13e8f154da76472cf73e532a538d39f9abe31545d9f2facfb1edf3594e49f564c2f1565bf19e170650ad93ba754b68cc

Download Submit
/data/data/com.tencent.mm/files/pkinfo.txt

Filesize
9KB

MD5
de42df6381f44c0dc45891054c656259

SHA1
5a76c1ad2ff42094034a18774912bfaa79489c29

SHA256
51c06cbd2eee387145a0eac5b55b387f2da3797cfb737cbb151aacc1b145e747

SHA512
700f8a3e85a7ea4f1d15aa3046d6c96ef898ac628b797616f94737570b802ee22db555e4d81c3fe91a90c3c92e9bc45aa940d55dc2c876a6488387743eabc037

Download Submit
/storage/emulated/0/Config/sys/apps/log/log-2024-10-16.txt

Filesize
32B

MD5
2645a22ef836e09fa68c45107ec71b41

SHA1
fb78bf6cb7a2a04b7a0cf7f2046847f9a994c3b0

SHA256
965a834278b9e32d974557cbb26a7c6d783b0631ea85f2447f9eca791edf5409

SHA512
ee5c668a6f10bfa5a30c937c3b190549bb3f989cb0367af233df610f1ec3efd251a69ff6b3ef6398d6420689c990d2691fdcdc5d4bda73a237e1ff1cf72dcfd0

Download Submit
/storage/emulated/0/Config/sys/apps/log/log-2024-10-16.txt

Filesize
12B

MD5
a9256f55737b655c8cff95418411997c

SHA1
d81a4e85ecef3a4f08d50da9c75c49a3c64ffe24

SHA256
bad705c44807d12463fb587087c4e9eb24769d82981229ac8b74abc9b1a44412

SHA512
10d10a6498973ed65d47c74ba6d8831dad94213a5071353dc445de46e021689284fbbf4accf5ba1f97a0675a7652ec069ac70f38d63ba36b8595a8caf8d37574

Download Submit
/storage/emulated/0/Config/sys/apps/log/log-2024-10-16.txt

Filesize
287B

MD5
16487385e50a86600bdd7103bf663241

SHA1
25691b82916782c9f626414b8f72982540901a0c

SHA256
fa6f6c9c996a4064a1a4000e18b0d4cef9bc53b6125d87ff5691bfe59aaad79c

SHA512
42999c6ce08392526ddb1a3f46ec6c755a381b61c88ba26df48863f519f94cd86e797f175ca47434a1d92639d5e44c25a4d16a6d3ea7b70756cad2cd6ae1e6c2

Download Submit
/storage/emulated/0/Config/sys/apps/log/log-2024-10-16.txt

Filesize
32B

MD5
7240822fb8dcd1aa0c3a69137c7dcba2

SHA1
1a74a9309d020ca4433423a5ebb28c7caabf454b

SHA256
920fd239934c08565fde170c81dd16498ec465d1bcb1dfbd58fa52f521725b66

SHA512
3e057f1d894dff682d59f616f2f6d827743932edb603bf30b4d7ef06a35159d0b4b98f5dded28faa374df60ea9aaf6095a03b3a9bfe3e62be867cc4192f833e3

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads