999360b4f40c33874b5ab584e55436bf118b1689933f6df42ca2b9e227e0bb73

Analysis

max time kernel
38s
max time network
154s
platform
android_x64
resource
android-x64-20240624-en
resource tags

androidarch:x64arch:x86image:android-x64-20240624-enlocale:en-usos:android-10-x64system
submitted
19/10/2024, 15:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ccplaymerket.apk
Size 5.2MB
Sample241019-s2ctlavgrn
SHA256 a03459bce0fbc0d43e4a0120068176d42f2120be4293d8a867fde3deb3f384be
MD5 f85968f25c7b5bb0ab0c646f8ae9be26
SHA1 3fdfc5ae63ab638afbdea45e7dfb829c925af897
SHA512 b34d535b87d8ef012f3c8dc6d8746a23d666efdaac3d8e5b6a1c0470735faf77158332ce620595fcfbd05c614aa5edf6c4433a79dcb966d6efed4a77b1ce0d7d
SSDEEP 98304:4k1+kh1sYaZO1L+yhVxPfZGXtV6IhRjs5cZBX8TYsSr5+ZQNshMg8bn4Yg2jWqWq:zfh1fNl+tY5wsStgXhhP8F
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

banker collection discovery evasion

Malware Config

Signatures

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
banker discovery

Security Software Discovery
T1418.001

Queries information about running processes on the device 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about running processes on the device.

discovery

Process Discovery

T1424

description	ioc	Process
Framework service call	android.app.IActivityManager.getRunningAppProcesses	com.lion.market

Requests cell location 2 TTPs 1 IoCs

Uses Android APIs to to get current cell location.

collection discovery evasion

Location Tracking

T1430

Geofencing

T1627.001

description	ioc	Process
Framework service call	com.android.internal.telephony.ITelephony.getCellLocation	com.lion.market

Queries information about active data network 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.lion.market

Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.wifi.IWifiManager.getConnectionInfo	com.lion.market

Queries the unique device ID (IMEI, MEID, IMSI) 1 TTPs
discovery

System Network Configuration Discovery
T1422
Reads information about phone network operator. 1 TTPs
discovery

System Network Configuration Discovery
T1422

Listens for changes in the sensor environment (might be used to detect emulation) 1 TTPs 1 IoCs

evasion

User Evasion

T1628.002

description	ioc	Process
Framework API call	android.hardware.SensorManager.registerListener	com.lion.market

com.lion.market
1⤵
- Queries information about running processes on the device
- Requests cell location
- Queries information about active data network
- Queries information about the current Wi-Fi connection
- Listens for changes in the sensor environment (might be used to detect emulation)
PID:4960

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Execution Guardrails

T1627

Geofencing

T1627.001

Hide Artifacts

T1628

User Evasion

T1628.002

Credential Access

Discovery

Location Tracking

T1430

Process Discovery

T1424

Software Discovery

T1418

Security Software Discovery

T1418.001

System Network Configuration Discovery

T1422

System Network Connections Discovery

T1421

Lateral Movement

Collection

Location Tracking

T1430

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

com.lion.market.db

Path /data/data/com.lion.market/databases/com.lion.market.db
Size 44KB
SHA256 d4b03aceb6e0951846234dc4537230bca44d104d94722529e5a7090835292475
MD5 10aad0ca160b4ccd09b7e47b009bf97e
SHA1 1ad0e9f62ada16c42d737493923b77aa5cf07712
SHA512 6e1a1e82ad0beebbf3430288468792c9091418d72fb4d2c037f09280f12160d685cda0b0f13f7b41a29dba6d261890800e44058ff5dabefb5c838b531b83d729
SSDEEP 24:TLVvGCDwrZ4rcfTuAEYOPNrg/qoMPO8v5HGS+GQQee:ToscC7YOPNrMC28v5mS
MD5 SHA1 SHA512 SSDEEP

Submit Download

com.lion.market.db-journal

Path /data/data/com.lion.market/databases/com.lion.market.db-journal
Size 512B
SHA256 8b7f6b004061bf7e4627f49695e5d7c90e72732014de05d8d811816b6fb9fff4
MD5 1f371992e67b0fe95686b1094a7cb162
SHA1 2c5731752cc36daeaaf70c07f33cf3e33bd3318b
SHA512 c2ee5efa417c60760a41c054a95d0057cf464ea147960b1f1c43868c1a5175eb12b49866040c43bd34ccf1b04de1e2d5b3024ea62684de5de01723a1c0680097
MD5 SHA1 SHA512

Submit Download

com.lion.market.db-journal

Path /data/data/com.lion.market/databases/com.lion.market.db-journal
Size 8KB
SHA256 3074ede94863baa9070e300418cccac61a52cd1ccbfde390165b44657adc679f
MD5 9aed22aa48dd19407d88447d8dd34fff
SHA1 dcbb33c132a3301a06e0cc62248653973a1f3995
SHA512 4d7019351956119227c010b71a200c290a4599efa65a201994371078262c652f87182f588e15253b6f8d2cd5855097a38cb82e2737367fc74c581a4f45d3ccd9
SSDEEP 6:7+/l95s/Hn1K9Wg9bNFlEuWdOlOERX4PBX4ogLugMBX4suuKir:7+tI/hqLiuWdwRmBEyPbTr
MD5 SHA1 SHA512 SSDEEP

Submit Download

com.lion.market.db-journal

Path /data/data/com.lion.market/databases/com.lion.market.db-journal
Size 8KB
SHA256 81f6c1984a4f5ae86a8f71683f698fff67f2675c81c1e6ead2c1b0065cc47739
MD5 3128a47ee88f7dd82fa4cc2e27f2d107
SHA1 e37ea2e290af248c8ce9cd02f09dadc7ce608bc3
SHA512 6bf8c802ead504241b9599a79393707d66433a99d0dc6c2118c28cbdfdd1c22b5e7188146c7194229db69db90a4c94a4225dd554a274760a3606faaccf643b41
SSDEEP 6:7+/l9jPg9bNFlLdrlOERX4PBX4ogLugMBX4suuKKV/A:7+tlqLJdTRmBEyPbJdA
MD5 SHA1 SHA512 SSDEEP

Submit Download

TDtcagent.db

Path /data/data/com.lion.market/files/TDtcagent.db
Size 32KB
SHA256 65ca5a0cf65f0510e225ca2057765d724590c98759ccfb0991c22945eccdc626
MD5 f63801a7c15aefc466a9f9f60f6f37dd
SHA1 80ef2791b0ec8fbebfa3b851eb958ed5433e2529
SHA512 39ba7e38bc56f595f66d40f8bcc6bbcb65ec779b143cf838c3a4c0de88a6592f1d97580716ca2b766a531bce2ecfe4c8c65accdaf9149ffd6ffa04fa6a8f30ad
SSDEEP 24:TLK3nxeb0TDHYB0ECWYqlBl8Uxz/gpEGSZGQQQ:TWxeYTDHY8qlBaUd/gpTS
MD5 SHA1 SHA512 SSDEEP

Submit Download

TDtcagent.db

Path /data/data/com.lion.market/files/TDtcagent.db
Size 20KB
SHA256 34d096672486e37bfefbdf5e568f0faf61e139c6de8f4f309d24101ad65a6f6a
MD5 eba158becabc57c4f9874e35a11115fa
SHA1 ebbc2f2e1b25ac03ee1c222ad975f263979f2ca0
SHA512 4abc922d295f35e496a11b708b850aa39ecf2ab9da97e0c4abdd1930ef63e812263625d158be92bdb96c5951900590286b9d33c4e5c4be76aa48438be309e54d
SSDEEP 24:TLPC3nxeb0TDHYB0ECWYqlBl8Uxz/gpEGSP/8GjQ:TjixeYTDHY8qlBaUd/gpTSP/zQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

TDtcagent.db

Path /data/data/com.lion.market/files/TDtcagent.db
Size 24KB
SHA256 67c34ed8c2b0035edcd1ac8ea96d3eb75ab37aa49b862e5d5398130b431bbf5d
MD5 c3042f44e6e099a493b36cebaf320375
SHA1 9e2c239424488b7a77bfbe0a2b1e65e8a092cf79
SHA512 a25acd113186b0e243b6ec7f0792e3c23d64066baf61fdf23e5e268fcccda8ccef0a3c00faf10f67ece154a21b830c238a735671b2e8041b11b6dc2109f5d893
SSDEEP 24:TL6b3nxeb0TDHYB0ECWYqlBl8Uxz/gpEGSP/aaIQcBVjY:T2TxeYTDHY8qlBaUd/gpTSP/1XiY
MD5 SHA1 SHA512 SSDEEP

Submit Download

TDtcagent.db

Path /data/data/com.lion.market/files/TDtcagent.db
Size 24KB
SHA256 9e90951ef3df7f6bd6c03ea88f19e50200fe2d6ea36c9663663a0ce2c50aedb8
MD5 3b27abd128af3c0d4e058e44c0ad23c5
SHA1 1e935e3f04e28e8c20c4e8ff7f4edcbb67a00002
SHA512 15dd7bc5bd4f98c8cefee66a9aa6028e40f9e53e2cb27a811068ef7dbdd07eb1d56eaaec3e8f2181606db173042a490b40b1c7932fada4bea3ac219ff3d7cb42
SSDEEP 48:TGxeYTDHY8qlBaUd/gpTSP/acaveUeXiY:itg8ql8Ud/gpWPHaWhN
MD5 SHA1 SHA512 SSDEEP

Submit Download

TDtcagent.db

Path /data/data/com.lion.market/files/TDtcagent.db
Size 28KB
SHA256 60a7c26968617966485bd3905fa1a5335a53f7302b6e7b24058486962698c065
MD5 bbd2d0308c7b306c904098dab96da3e7
SHA1 7f9221e5601f2673c3d935588f00d306bc522384
SHA512 676af95e059b9b2c95baab3d96c71c484ca1d46e46264ca18d19de40fed2b2207233f5e9a69bb6731df6bfc6fbc6d8a7237173396c214e362b5f7be418dcd573
SSDEEP 24:TL0h3nxeb0TDHYB0ECWYqlBl8Uxz/gpEGSP/hBfjtToM:TWxeYTDHY8qlBaUd/gpTSP/hBKM
MD5 SHA1 SHA512 SSDEEP

Submit Download

TDtcagent.db

Path /data/data/com.lion.market/files/TDtcagent.db
Size 24KB
SHA256 c7cff28cb67746c2fbc25b4ca0509a531920e2d2e38323f5d36d96b1ad852e12
MD5 44579d63168b6786e822cf88582316a2
SHA1 12767e32558eb910b5ed789c0dcab09800fb427d
SHA512 03edcc3e6279278ca36b010071ceba47b8e1033516fbf6814b23cdad8854f9648ab4dafc1f093488a998c26cd977169a03f712536cb0b1f195e4fe8ad67a3b59
SSDEEP 48:TmxeYTDHY8qlBaUd/gpTSP/h1wBc1Fctc1oPTRh91JSwU5x/Gu6zVDMjWzTp5xUJ:Ctg8ql8Ud/gpWPvwVkf+dSHeCjIEaWhN
MD5 SHA1 SHA512 SSDEEP

Submit Download

TDtcagent.db-journal

Path /data/data/com.lion.market/files/TDtcagent.db-journal
Size 512B
SHA256 66d902cc1e206e7d7f87149ef725f98caf98032d499d78de5128e657ae107cd7
MD5 149c301b4ab622fcf49975c7d7e048d8
SHA1 c7664496ee48ccbb314415d557e9d7230615997f
SHA512 9ecd0006894525903efbfe9e3e968daffb96bf82f69216f69b353f7b853fd2cbe306ee3ea64936f7c9d3060d7ba33edfa752fbf7bb5d0f54f0b7f34205c28236
MD5 SHA1 SHA512

Submit Download

TDtcagent.db-journal

Path /data/data/com.lion.market/files/TDtcagent.db-journal
Size 8KB
SHA256 14ff259cffa8c3a46db8465fd1ba58d00499b33939775b91dd3ffc4e848d70db
MD5 7dbf0bc3de9e4fbd8d36e962ac916ee2
SHA1 bb11791a492abadf3978a5d8ce37a485c99cb635
SHA512 bbefad41ae6c6eae15467faea895c9bcab3cd803fdd3532ebff9f6cd6c52cfa0104da92398a41228b3fcd9ed45c7c13bd5830832f0560cd1f81e7780a38482f4
SSDEEP 6:7+/l9Yn1Hg9bNFlEuWdOlOERX4PBX4ogLugMBX4suuK/g:7+tYqLiuWdwRmBEyPbeg
MD5 SHA1 SHA512 SSDEEP

Submit Download

TDtcagent.db-journal

Path /data/data/com.lion.market/files/TDtcagent.db-journal
Size 4KB
SHA256 32e57b659d1358100e54dda9fdd889973ed2b362c999f909834b7cf48ce1888b
MD5 c7a79cce5953ee4910c163bbe4b26630
SHA1 2d29567406018b65df422e18e224d0d288dd259d
SHA512 f0da4e6ee6685d495eb2e47decd865f4ace6d6cea8f3916395c8c8849c6c7143deca0c31901d738dd839374d034b4e9164401244c04d264806b39b471918b606
SSDEEP 6:7+/lmGPg9bNFlLdrlOERX4PBX4ogLugMBX4suuKSv:7+tJqLJdTRmBEyPbd
MD5 SHA1 SHA512 SSDEEP

Submit Download

TDtcagent.db-journal

Path /data/data/com.lion.market/files/TDtcagent.db-journal
Size 8KB
SHA256 464f6c29ab5a4e0e1ab41887523cba026149a634be3aa883cc61b90e950aa4a1
MD5 1ed0ad6e37a3e59de6080059ba65ed21
SHA1 f7ee14cc301d4bda71da99f0e42f9ef945cc33ee
SHA512 e46dc6bca147b625fa4a3d5f4a734da7c351fdc58afb5c3b6f7b21c9139f0a9dcccec8eae70b848d61384bbe01e5f5c1648018bc156bed37be8256847216b6b2
SSDEEP 6:7+/l9nlgPg9bNFlqhKtwlOERX4PBX4ogLugMBX4suuKWts//3:7+tUqLmVRmBEyPbBKX3
MD5 SHA1 SHA512 SSDEEP

Submit Download

TDtcagent.db-journal

Path /data/data/com.lion.market/files/TDtcagent.db-journal
Size 8KB
SHA256 5c38746ff6e22ea2beddf28dea0ecdb52d64a2e304f6b9bc98e5f3c370a38a24
MD5 d5c26c412e2c360ea38be760dd0151ff
SHA1 f24e8d8ca93b73b345004f55eb2aea0ae2d0f3d5
SHA512 3acf3cca7ae5a7cbc4673ef0debbec489360e349732b37781c53e5ff4f889916b972a7c7bcfbd97eba1ff25556d38f6e0d57ae21b31b156390723b178a128371
SSDEEP 12:7+tcinqLyxqQyNTSFby/8UxF9/gpvRmBEyPb4u:7+ttqLyxQl8Uxz/gpEGS9
MD5 SHA1 SHA512 SSDEEP

Submit Download

TDtcagent.db-journal

Path /data/data/com.lion.market/files/TDtcagent.db-journal
Size 12KB
SHA256 2b1515a536f70e4296a4797a82a11b86ef1d6b4bbe1cafdfcefc05574abfae05
MD5 636a8032902f0e35d0bf5ae695bbe640
SHA1 594fed7ddafd63eba00af90346303a8b588575df
SHA512 916e2823a18943f3ad3815f0ed4967203af7cbc7d6dbbff90cdca80d53db2e7c162da5958649f7e69fcdb3ef42bf02f2d507e6e153dd4b1be9114acbd58cc50b
SSDEEP 96:7u7Vkf+dSHeCjIEaWhmRtg8ql8Ud/gpW5:7u7amdSCI8q/Be6
MD5 SHA1 SHA512 SSDEEP

Submit Download

jpush_stat_cache.json

Path /data/data/com.lion.market/files/jpush_stat_cache.json
Size 132B
SHA256 8e4455f63a482ea8ed843c823f4a958ff8a715837c4265e722bb6d19bf63c480
MD5 a883dbeaaecd7b52283cea30030ed9e8
SHA1 4447a0ef4591ff1d0b103c112245f70a21aad426
SHA512 46c2a71f422261a2c044e53d72e1b6cf1812d8c69e431c020666f531f471ab49d08e2d8f68fbface738c693d3d9988f772470864f640b06738225217481471c1
MD5 SHA1 SHA512

Submit Download

.ccplay_com.lion.market

Path /storage/emulated/0/.ccplay_com.lion.market
Size 15B
SHA256 baa85729341f5406aec42acf003c8cc4a9146302ffc15b9e125f0807729c9ea8
MD5 85149e3d4642d9fda925337c417bc877
SHA1 7f89de427719e887c28072e7ccbb24085f1515ff
SHA512 b4acb2fb0731360c2c87c62ba5463bea63ff0e48f9bc7d1282d751b78982d1e7069384dec92e7999477852b638029da062d101af17e8cd6c4d540d410039ada2
MD5 SHA1 SHA512

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads