999360b4f40c33874b5ab584e55436bf118b1689933f6df42ca2b9e227e0bb73

Analysis

max time kernel
145s
max time network
152s
platform
android_x86
resource
android-x86-arm-20240624-en
resource tags

androidarch:armarch:x86image:android-x86-arm-20240624-enlocale:en-usos:android-9-x86system
submitted
19/10/2024, 15:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ccplaymerket.apk
Size 5.2MB
Sample241019-s2ctlavgrn
SHA256 a03459bce0fbc0d43e4a0120068176d42f2120be4293d8a867fde3deb3f384be
MD5 f85968f25c7b5bb0ab0c646f8ae9be26
SHA1 3fdfc5ae63ab638afbdea45e7dfb829c925af897
SHA512 b34d535b87d8ef012f3c8dc6d8746a23d666efdaac3d8e5b6a1c0470735faf77158332ce620595fcfbd05c614aa5edf6c4433a79dcb966d6efed4a77b1ce0d7d
SSDEEP 98304:4k1+kh1sYaZO1L+yhVxPfZGXtV6IhRjs5cZBX8TYsSr5+ZQNshMg8bn4Yg2jWqWq:zfh1fNl+tY5wsStgXhhP8F
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

banker collection credential_access discovery evasion persistence

Malware Config

Signatures

Makes use of the framework's Accessibility service 4 TTPs 1 IoCs

Retrieves information displayed on the phone screen using AccessibilityService.

collection evasion credential_access

Input Injection

T1516

Screen Capture

T1513

Keylogging

T1417.001

GUI Input Capture

T1417.002

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	com.lion.market

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
banker discovery

Security Software Discovery
T1418.001

Queries information about running processes on the device 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about running processes on the device.

discovery

Process Discovery

T1424

description	ioc	Process
Framework service call	android.app.IActivityManager.getRunningAppProcesses	com.lion.market

Requests cell location 2 TTPs 1 IoCs

Uses Android APIs to to get current cell location.

collection discovery evasion

Location Tracking

T1430

Geofencing

T1627.001

description	ioc	Process
Framework service call	com.android.internal.telephony.ITelephony.getCellLocation	com.lion.market

Queries information about active data network 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.lion.market

Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.wifi.IWifiManager.getConnectionInfo	com.lion.market

Reads information about phone network operator. 1 TTPs
discovery

System Network Configuration Discovery
T1422

Listens for changes in the sensor environment (might be used to detect emulation) 1 TTPs 1 IoCs

evasion

User Evasion

T1628.002

description	ioc	Process
Framework API call	android.hardware.SensorManager.registerListener	com.lion.market

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs

persistence

Broadcast Receivers

T1624.001

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	com.lion.market

com.lion.market
1⤵
- Makes use of the framework's Accessibility service
- Queries information about running processes on the device
- Requests cell location
- Queries information about active data network
- Queries information about the current Wi-Fi connection
- Listens for changes in the sensor environment (might be used to detect emulation)
- Registers a broadcast receiver at runtime (usually for listening for system events)
PID:4260

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Privilege Escalation

Defense Evasion

Execution Guardrails

T1627

Geofencing

T1627.001

Hide Artifacts

T1628

User Evasion

T1628.002

Input Injection

T1516

Credential Access

Input Capture

T1417

GUI Input Capture

T1417.002

Keylogging

T1417.001

Discovery

Location Tracking

T1430

Process Discovery

T1424

Software Discovery

T1418

Security Software Discovery

T1418.001

System Network Configuration Discovery

T1422

System Network Connections Discovery

T1421

Lateral Movement

Collection

Input Capture

T1417

GUI Input Capture

T1417.002

Keylogging

T1417.001

Location Tracking

T1430

Screen Capture

T1513

Command and Control

Exfiltration

Impact

Input Injection

T1516

Replay Monitor

Loading Replay Monitor...

Downloads

com.lion.market.db

Path /data/data/com.lion.market/databases/com.lion.market.db
Size 4KB
SHA256 0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514
MD5 f2b4b0190b9f384ca885f0c8c9b14700
SHA1 934ff2646757b5b6e7f20f6a0aa76c7f995d9361
SHA512 ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1
MD5 SHA1 SHA512

Submit Download

com.lion.market.db-journal

Path /data/data/com.lion.market/databases/com.lion.market.db-journal
Size 512B
SHA256 58198d2687e390513f7206806509b627f96304de7bd565b1e77c5db3ebf92b9e
MD5 65dbf018d4f45653010067888d62833e
SHA1 0c9508c1a39372e18ec69749cb27b2271a87c5ca
SHA512 54f9773ab8970368aa58e9849c12ddcefdae759a99d4cd70a4477177cebc8448b6ef5bd8e38aaf003ac7d9abb33255db630dacff73360d3ea66f73304f4dbe9a
MD5 SHA1 SHA512

Submit Download

com.lion.market.db-shm

Path /data/data/com.lion.market/databases/com.lion.market.db-shm
Size 32KB
SHA256 c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
MD5 bb7df04e1b0a2570657527a7e108ae23
SHA1 5188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA512 768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012
SSDEEP 3::
MD5 SHA1 SHA512 SSDEEP

Submit Download

com.lion.market.db-wal

Path /data/data/com.lion.market/databases/com.lion.market.db-wal
Size 56KB
SHA256 166aca457e9fd4b884ca1695ee5407dd96976cc4ddee24971ecb6fe441a6934d
MD5 46963ee4468117c67c8b72c5ddd53f63
SHA1 82c439d31caa87351c99da0f2716521088d62eb3
SHA512 31e4a62a41a82ae78c43a1ceac558babe1f5ebb63a1dcc74adec62909b89f43f3f2ee305a3674c8e89fbb62d038b2424e861f4faeae84d4aff6ac8d0f48d72e9
SSDEEP 48:tHUsuzNSP/IXaJjbiscC7YOPNrMC28v5mSP/I36Vpfz/5O:JUZ0Pw0yscvkNr1DPw36Vpfz/5O
MD5 SHA1 SHA512 SSDEEP

Submit Download

TDtcagent.db

Path /data/data/com.lion.market/files/TDtcagent.db
Size 32KB
SHA256 b455bb6d9ca4b802054f6f1e72d66184b37897ba60a1e5b5de456454ddd07828
MD5 0fcb31920c258bcb52a89d3acddf2d4a
SHA1 dd764d611e087ef4e43f0a5cd3f3be85e062eb17
SHA512 009f5d30aedf58e5c88835cee9a6b87a073660627beda8a09070eeb9139be05f78d11677ce31152f57a988ff132a469d9231140fea3f4c7cb078d39fa55509a3
SSDEEP 24:Ts3nxeb0TDHYB0ECWYqlBl8Uxz/gpEGSZGQQQ:TgxeYTDHY8qlBaUd/gpTS
MD5 SHA1 SHA512 SSDEEP

Submit Download

TDtcagent.db

Path /data/data/com.lion.market/files/TDtcagent.db
Size 20KB
SHA256 1bd0900017062e8965f1c21caaeff561bdcd9886cc6a80cf04d441adc9a8c94d
MD5 9303e50b2f55f77f474b7873dcbb540a
SHA1 25323d4712500e31a2286fc0df55719319f7f947
SHA512 a92f062383e0fa65b0b3c4b0a317464b3a5ff790898c73a5d142e88ab9a0017b721a6a6e5b006f33792893d49026260ee1e75024b395a976f270f30e387514a2
SSDEEP 3:pqepsbBlDH5GmjSr3TDZtDqD1ejW/:pq7dlDXjSrjD3Den
MD5 SHA1 SHA512 SSDEEP

Submit Download

TDtcagent.db

Path /data/data/com.lion.market/files/TDtcagent.db
Size 24KB
SHA256 0a4096baa666989f3f099ccf9c3969c2a8aed2297bd6b8b214d26ef42e919196
MD5 d209acf50fa790d828cce9abbde78f7c
SHA1 08d4f66bec4d4cf30f884cfb656d951154468ad3
SHA512 dcf4a00e6eb0f972e9cdc255cb410d695c1a9563f16e6fbd7498aef6f1a3e50e25ffe2b0d6df36e2461871fe327a2c3a50a18386d6db6bef3d892dee0f2c65c8
SSDEEP 3:qqH/DbMTJvviW8Q/X9Qow78fFQckwQb5GmjSr3TDH:d/DbMTJvyo9kIQc/QLjSrjDH
MD5 SHA1 SHA512 SSDEEP

Submit Download

TDtcagent.db

Path /data/data/com.lion.market/files/TDtcagent.db
Size 24KB
SHA256 dd66cd973328d957df88ae6909cd938841dbf56a85d4404c6a593c18a6d9a3bb
MD5 a3aa0db1318c1f9142fc3a7b19b741aa
SHA1 7d5c09772528da1f10c95b565bce28aecb7075f4
SHA512 c8324ac34d1e83d10ead88514376e97d15cda582a4012c4c70c97dbd187897a97f6f1f5f62f1522eca36ba90494effa8dea572fcb959bc6acf81173947d3efc1
SSDEEP 6:tj5nUFLQc/UjSrjDIQclWk7yIQc/QLjSrjDH:fUFLQcJEQclWk7yIQc4Cb
MD5 SHA1 SHA512 SSDEEP

Submit Download

TDtcagent.db

Path /data/data/com.lion.market/files/TDtcagent.db
Size 28KB
SHA256 67798b128a267a8186826ee1e96c117466372817ca9a72344700479092ca0d76
MD5 dad421b74f3485951b29adfa73af9118
SHA1 eafc740122e9a0d49a997daee267b4eb4d8f5afd
SHA512 9b074db4d31104f384094ed5542330e57386707b36cdcab83972a63314b23ab3ee5106d2ee4bdde08c4ea1c5ee10e015eefa687d5211850c40faee81512a9370
SSDEEP 6:rqotdnXqStiZxTLjSrjDxKMaT1fBE4fxsK2gf:rqidua9GE2Wi
MD5 SHA1 SHA512 SSDEEP

Submit Download

TDtcagent.db

Path /data/data/com.lion.market/files/TDtcagent.db
Size 28KB
SHA256 a1a78b67e72b84270094fb8df6051f058cdcbd5864265d01453ac41a1b07d8e7
MD5 abac1699a83d8b75d4b2551645951124
SHA1 3d0b25627088e6ea712722ade0148adb2d1790d5
SHA512 cefa4e1da5003780e87efd2a2d4068e82b8b56495a3e2c4f77cf18b10cf528367524c0b6cb3c36c84406cb6f2e18bf835ad06be7c38f9ffb6612d7b15f02bfc4
SSDEEP 48:rZh/CkrVSfS1kuUizrvF6SMU84UQBUsRUIiUhyXc:9h/rCixBlJBdR5i+Yc
MD5 SHA1 SHA512 SSDEEP

Submit Download

TDtcagent.db-journal

Path /data/data/com.lion.market/files/TDtcagent.db-journal
Size 512B
SHA256 0f9f3ab8b35dd58f86ec4852006cb01a10315a8c23243c4403b4a8ab8155930d
MD5 542f96430ffce7268081380c85b4a796
SHA1 a06ba2d2e3e50b96583aa4b402608116535d7a3b
SHA512 d0f4d2f4bfb2f515478ba8430267911d7f44e19363adc5d6e1354ad75f35481a668ee1dc3ae30ec5d574cf041bc398fe721b5832c0673d061103d8f3eeb96feb
MD5 SHA1 SHA512

Submit Download

TDtcagent.db-wal

Path /data/data/com.lion.market/files/TDtcagent.db-wal
Size 72KB
SHA256 40933993fc437d923eb835578edfdb94019b69a07b760d2441482027bacde55d
MD5 9a443bf93bbce53149c6fd7ca385af39
SHA1 e1b4462f3a7d7af3268a9df0f602343f573f9ed1
SHA512 839a9ee865c4317fa26c114a474f671bb76ce193273d178312757413cf3d452969612fb4233742fb23e7a4105efd24674a24d7a7732501949f45bd3f39333492
SSDEEP 96:00P+VrPxUd/gpWPw3ql8Ud/gpWPb8ql8Ud/gpWPWtg8ql8Ud/gpWPL:nm2Beaw3q/Beab8q/Beav8q/Bea
MD5 SHA1 SHA512 SSDEEP

Submit Download

TDtcagent.db-wal

Path /data/data/com.lion.market/files/TDtcagent.db-wal
Size 8KB
SHA256 797a1f1c97a4c609eb6c6bc20ede5da8061e421164b83661ef640c04cc0a1bf1
MD5 01d8659ed600c3b8c6ee0713ba75c4c6
SHA1 2d4622fcb8acc462348db6aa76e3708047ccb22e
SHA512 44c6c30ad760bbadfeea0653e69bfda93f864aa00d7641f6a09486057612549b8626b9de540c4c8dca786cf90726471deb3c0f4bf6e554a7b367dca2a4405b7d
SSDEEP 3:OlH/l3WWM74RjL/3h0WM7Ro4sqepsbBlDH5GmjSr3TDU/glMh75oFynlXqD1ejW/:KIPpoE7dlDXjSrjDU/gMjYylXen
MD5 SHA1 SHA512 SSDEEP

Submit Download

TDtcagent.db-wal

Path /data/data/com.lion.market/files/TDtcagent.db-wal
Size 8KB
SHA256 717f9b83f667bdbc47840502a15f56ef79d6526237511eda74a7df1110ae4ba5
MD5 8a680dc5648817ebe0a9083dd60fc1ef
SHA1 527046a045cbeb34bfda5d7069ce65029cb764a6
SHA512 20dffd9049c2fed2551f2b35cb77c3736a58172225d9bb0a820c185c155e38604bae4a77c25f0ac12b38490cc645e13b467bd175ac0bbf7eac5fb5c60a3cf0ea
SSDEEP 6:KS0KrSta0OeV/Y/DbMTJvfKo9kIQc/QLjSrjDH:KS0KrSo0OSYDu6KkIQc4Cb
MD5 SHA1 SHA512 SSDEEP

Submit Download

TDtcagent.db-wal

Path /data/data/com.lion.market/files/TDtcagent.db-wal
Size 8KB
SHA256 d0db4567437de335a34d5412e1227b8431ee098cee6169f9bec1daf6379c80fa
MD5 a2bd33edbaba3a09a9036c59fda9ff6f
SHA1 25d7481993bd31e12f1a6311e8580bdfbda35500
SHA512 52bd4f2386c931c211f9729daa4ca1e4f211a73e559aa6426a1e47878eedcc52bb7165fd2e121bcb9013c904b146067d30dee9730544b1185f77205a94c609b7
SSDEEP 6:KCDagQuvtj5nUwagFLQc/UjSrjDIQclWk7yIQc/QLjSrjDH:KIa5OUvgFLQcJEQclWk7yIQc4Cb
MD5 SHA1 SHA512 SSDEEP

Submit Download

TDtcagent.db-wal

Path /data/data/com.lion.market/files/TDtcagent.db-wal
Size 8KB
SHA256 dda314b6e34bd3ed27474dba55b2eaa4c55b0a56f346bd267bdc5a0ccbda33cf
MD5 4bd388b44e7e118d74dd06eee6eee853
SHA1 e06e2a3c7ea743891b6bfb52361eed03500e2546
SHA512 3e1d90f3ed7a3bfe81eb4ea74850bbcee4f4370ea23966135efb5f88ba2c9ca831c4e462d32826f5d276f73ba03fa29715a5d504658f3fb67a8d741ecb5ac0e0
SSDEEP 6:KIAO/oteAf5foUVtdnWMItiZxTLjSrjDxKMaT1fBE4fxsK2gf:KH1BXdRa9GE2Wi
MD5 SHA1 SHA512 SSDEEP

Submit Download

TDtcagent.db-wal

Path /data/data/com.lion.market/files/TDtcagent.db-wal
Size 8KB
SHA256 d766b3119b29f69fe6e3b7f6199e10954aa2109de31a34753c854c765296cff7
MD5 c84b5a9e4981840e398ad68181f167d7
SHA1 0c7afb0f18aae5c92680059c61db67e8197ee1f8
SHA512 1a451eba2b8f2bdb5933a5f995d4bd1d0667b8e05398f81e4a6df5026779944acfa9ccd0760282da9cadb47c79636a6d7c5eca5bea19147f6b578e446d726b23
SSDEEP 6:KTPB0/K8VKoq5Z1z2OATomTLjSrjDDAZxTLjSrjDxKMaT1fBE4fxsK2gf:KbB0/K8VKoGTzDnAa9GE2Wi
MD5 SHA1 SHA512 SSDEEP

Submit Download

jpush_stat_cache.json

Path /data/data/com.lion.market/files/jpush_stat_cache.json
Size 132B
SHA256 25b230b70564cf38861fbc97cf53fe074213891fb0cc59eee1235c071b739f0e
MD5 1e2de15f1e1be1a9070bc317e628f532
SHA1 ec4c11ae274a6d21a1f5a25dfeb76bc64912eca9
SHA512 2004b8ba9190e7ec23cfe4fee30c2a2a5d48b7844de6800a6c2323b36449ed4cb5324f0f13f338132ffd01f09f9a4d375a2d105081895b6c4949685d9253591f
MD5 SHA1 SHA512

Submit Download

.ccplay_com.lion.market

Path /storage/emulated/0/.ccplay_com.lion.market
Size 15B
SHA256 baa85729341f5406aec42acf003c8cc4a9146302ffc15b9e125f0807729c9ea8
MD5 85149e3d4642d9fda925337c417bc877
SHA1 7f89de427719e887c28072e7ccbb24085f1515ff
SHA512 b4acb2fb0731360c2c87c62ba5463bea63ff0e48f9bc7d1282d751b78982d1e7069384dec92e7999477852b638029da062d101af17e8cd6c4d540d410039ada2
MD5 SHA1 SHA512

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads