7978ef1f9d2c0fdcf9dab2ed56976e5a926c384c99f3dd48250a34b2a402379a

Analysis

max time kernel
6s
max time network
144s
platform
android-9_x86
resource
android-x86-arm-20240910-en
resource tags

arch:armarch:x86image:android-x86-arm-20240910-enlocale:en-usos:android-9-x86system
submitted
20-11-2024 22:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7978ef1f9d2c0fdcf9dab2ed56976e5a926c384c99f3dd48250a34b2a402379a.apk
Size

3.5MB
MD5

58d91834a5e9b84300d94eb218aebe2d
SHA1

dee0a096d251bb21091f13cfff105f047349cc11
SHA256

7978ef1f9d2c0fdcf9dab2ed56976e5a926c384c99f3dd48250a34b2a402379a
SHA512

fabf5db512b175e619185053dbc5a49bbed4b7f2c1bf74250ce006c1f288debede133fa677fc1f24b20f0fa12324d207ef0d55e861df97e8d272e6b1f36af32e
SSDEEP

98304:zrYhi7UkHvaV4TNtKIGgh8tuY0BhHNPpSi:fYheUkHvaV4TNtYpcBJp

Score

6^/10

discovery evasion persistence

Malware Config

Signatures

Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
evasion persistence

Foreground Persistence
T1541

Processes:

com.myunion.service

description ioc process

Framework service call android.app.IActivityManager.setServiceForeground com.myunion.service
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
discovery

System Network Configuration Discovery
T1422

Processes:

com.myunion.service

description ioc process

Framework service call com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone com.myunion.service
Checks the presence of a debugger
evasion
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
persistence

Broadcast Receivers
T1624.001

Processes:

com.myunion.service

description ioc process

Framework service call android.app.IActivityManager.registerReceiver com.myunion.service
Checks CPU information 2 TTPs 1 IoCs

System Checks
T1633.001

System Information Discovery
T1426

Processes:

com.myunion.service

description ioc process

File opened for read /proc/cpuinfo com.myunion.service
Checks memory information 2 TTPs 1 IoCs

System Checks
T1633.001

System Information Discovery
T1426

Processes:

com.myunion.service

description ioc process

File opened for read /proc/meminfo com.myunion.service

description	ioc	process
Framework service call	android.app.IActivityManager.setServiceForeground	com.myunion.service

description	ioc	process
Framework service call	com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone	com.myunion.service

description	ioc	process
Framework service call	android.app.IActivityManager.registerReceiver	com.myunion.service

description	ioc	process
File opened for read	/proc/cpuinfo	com.myunion.service

description	ioc	process
File opened for read	/proc/meminfo	com.myunion.service

com.myunion.service
1⤵
- Makes use of the framework's foreground persistence service
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Checks CPU information
- Checks memory information
PID:4378

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Foreground Persistence

T1541

Privilege Escalation

Defense Evasion

Foreground Persistence

T1541

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Discovery

System Information Discovery

T1426

System Network Configuration Discovery

T1422

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.myunion.service/files/profileInstalled

Filesize
24B

MD5
4ddc20c775b7e03335cc948bd0402524

SHA1
b89270d3416f8012fc5f203359b98316e43f24d6

SHA256
8e372e0f6e10e3e9f0f2a79b969e14785998b8115b540fb0d6250eb23a02b275

SHA512
e279f53d801a9b83726fb76d59c90e0fe4cfee4835c085daafdc5e0da6534467b23c29ece65bb05dab6ccdb868134e9d30b0bebcc7ff38c823f5f530a60befe2

Download Submit
/data/data/com.myunion.service/files/profileinstaller_profileWrittenFor_lastUpdateTime.dat

Filesize
8B

MD5
893458d595fc75246851942a6482285b

SHA1
501a8ae177e77df88f386e70cc28e512eb74e92d

SHA256
5a1cb401408bc6ed0707a7bf0e7af66b4918be65447f07aebabd0606d7fb7353

SHA512
555716b98d34540f43738c6916aa1042e1bbf60882296ef0aa9dcb79662be5770c34103f516c128e9e7aa29f4bab28c82a84b16b9108e5bfcf5816e864971da7

Download Submit
/data/misc/profiles/cur/0/com.myunion.service/primary.prof

Filesize
1KB

MD5
20b313e35f7e795e3b0db952f3a8f480

SHA1
d576d4836fc6787e263dd2a1c12730e77fb5a50e

SHA256
c9c81a7cdab7f38b403280d4ff23c44f494635db03b30de0eb74049888854604

SHA512
2bf95171265e22e65884ba89c9cdc81b910dbf1cf2ed67d315d9f3859cc393ebf778d266b305d03273645c5362f7ed662d1808868b67b87ee2b83bb5a4eff1ae

Download Submit