Analysis

  • max time kernel
    146s
  • max time network
    155s
  • platform
    android-10_x64
  • resource
    android-x64-20240910-en
  • resource tags

    arch:x64arch:x86image:android-x64-20240910-enlocale:en-usos:android-10-x64system
  • submitted
    19-11-2024 22:05

General

  • Target

    9f97fa9cde840c4449c73cb838e0af65fc83097eb086c359ad458716150e6c0b.apk

  • Size

    3.4MB

  • MD5

    b6d1931f0dd6ae1423ad26a933f7f00a

  • SHA1

    468dd981c0616e33b4fc65d282e4cec3c2c107b7

  • SHA256

    9f97fa9cde840c4449c73cb838e0af65fc83097eb086c359ad458716150e6c0b

  • SHA512

    bb114ea2636ac383ecec21178d1a2579a123b84e0dbd28c2231a65287ff157d7ecc8992ba0fc550964b13bc5de95dbd18e61f6be23dab34917532c103c394de6

  • SSDEEP

    49152:7F/aTyaG1tEcXHhoJiMcCol1zmlDxaDFhHM/HkZARR/tT/vlRVlckmI/H9aIiNsx:oTvoCJiJCA1zml0DF9UxVlRVlc8fiZX4

Malware Config

Extracted

Family

hook

C2

https://ws.fasoqloper.shop

AES_key

Signatures

Processes

  • com.tencent.mm
    1⤵
    • Makes use of the framework's Accessibility service
    • Obtains sensitive information copied to the device clipboard
    • Queries information about running processes on the device
    • Acquires the wake lock
    • Makes use of the framework's foreground persistence service
    • Queries information about the current Wi-Fi connection
    • Queries the mobile country code (MCC)
    • Registers a broadcast receiver at runtime (usually for listening for system events)
    • Schedules tasks to execute at a specified time
    • Uses Crypto APIs (Might try to encrypt user data)
    • Checks CPU information
    • Checks memory information
    PID:5072

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/data/com.tencent.mm/no_backup/androidx.work.workdb

    Filesize

    4KB

    MD5

    f2b4b0190b9f384ca885f0c8c9b14700

    SHA1

    934ff2646757b5b6e7f20f6a0aa76c7f995d9361

    SHA256

    0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514

    SHA512

    ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1

  • /data/data/com.tencent.mm/no_backup/androidx.work.workdb-journal

    Filesize

    512B

    MD5

    b2275a7a952f8c360b16831d07bf1a5f

    SHA1

    b277b13d7cc02c2ac9f6e7b7c7480e322d04175a

    SHA256

    b6e49b11d0f4ce0ec1fd27dbde02d5ff5d92290deafbbe39053009f6559d770c

    SHA512

    00ebf43ed08f059fb94b30636d8892d431c3738362106d7900e5b7808204180cc89e3773d9f4bb94c11a595a8eae403fda4502b40c1d54294ed3012291297da6

  • /data/data/com.tencent.mm/no_backup/androidx.work.workdb-shm

    Filesize

    32KB

    MD5

    bb7df04e1b0a2570657527a7e108ae23

    SHA1

    5188431849b4613152fd7bdba6a3ff0a4fd6424b

    SHA256

    c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479

    SHA512

    768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

  • /data/data/com.tencent.mm/no_backup/androidx.work.workdb-wal

    Filesize

    16KB

    MD5

    8b4750edb05390995b5134fb43b43302

    SHA1

    f2a7837cb7e0d66e188789cfeedb0f372bb90ebf

    SHA256

    ffbaed9266ad8e4a79ca924554adebc807fbfa51a79d8de60354128bec565c38

    SHA512

    c8879c9cbab0212273c31326d1b80b816886a4fec308222b48f1559011314999bff7717696c10beb51516dcc03d0a9a3f8a40b19ec3d167c1632a02d3ff54f59

  • /data/data/com.tencent.mm/no_backup/androidx.work.workdb-wal

    Filesize

    108KB

    MD5

    dbf5e93427c9d4e92242b828ce9c8ba4

    SHA1

    9dd232a3990bb6907b48f64bb7acc3adc92ee873

    SHA256

    c2d077ce124996c00dbdacbdf6be51b7e07490a39a836e659e76abc970948d93

    SHA512

    576fd45bf42b72c4a689f1f9b29824a70a0af1e26115a2d6afafdc865a944e17e306142f408f7d65f7220ce4b31d296960e54beb77c77c2130bbf65765ded7af

  • /data/data/com.tencent.mm/no_backup/androidx.work.workdb-wal

    Filesize

    173KB

    MD5

    74b87dd9d0163eb4f5ebcf06bf1688b8

    SHA1

    d4de2aeb93772e03cfe04ffda3719050a9623175

    SHA256

    b8edf2ff4f629ab060ca22c73bf3caa1612379436293e749e969e8ab410bc47e

    SHA512

    72ef790b4b6381f242f390f803a2381dcb01315d744ead28c9ebb68da87d484e6f81979793d277b435c33b498ad97c31bcf667f07c4c95db356001ae3a077ae3