Analysis
-
max time kernel
17s -
max time network
152s -
platform
android-9_x86 -
resource
android-x86-arm-20240910-en -
resource tags
-
submitted
05-12-2024 22:01
General
-
Target
db1dfa862113ee10429d0712b83095c22290c045aeb2454e22c61056f5f61198.apk
-
Size
4.6MB
-
MD5
74aae2d2f140e81c4847f7f2e45cc779
-
SHA1
7788208c082b41f6bcd091892fa34b6533e93eda
-
SHA256
db1dfa862113ee10429d0712b83095c22290c045aeb2454e22c61056f5f61198
-
SHA512
d99aa28715f59c070bf0d1533b346a3ffd0a11dd3c8d43529b165afdfc9691b5f0b6a841ee8f6bc472b9d72fc07904168fc2e37788958e98fd6a5690d910e269
-
SSDEEP
98304:E5in9HfrbmhT+3rYrk/bnI5INKi+8niAptxJi+4yH181OYCmIM0:0o2S2Mgi+8ictxR4yH18AY9o
Malware Config
Signatures
-
Removes its main activity from the application launcher 1 TTPs 1 IoCs
-
Makes use of the framework's Accessibility service 4 TTPs 3 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
-
Queries account information for other applications stored on the device 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect account information stored on the device.
-
Reads the contacts stored on the device. 1 TTPs 1 IoCs
-
Reads the content of the calendar entry data. 1 TTPs 1 IoCs
-
Reads the content of the call log. 1 TTPs 1 IoCs
-
Requests cell location 2 TTPs 1 IoCs
Uses Android APIs to to get current cell location.
-
Acquires the wake lock 1 IoCs
-
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
-
Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.
-
Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
-
Listens for changes in the sensor environment (might be used to detect emulation) 1 TTPs 1 IoCs
-
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
Processes
-
com.tencent.mm1⤵
- Removes its main activity from the application launcher
- Makes use of the framework's Accessibility service
- Queries account information for other applications stored on the device
- Reads the contacts stored on the device.
- Reads the content of the calendar entry data.
- Reads the content of the call log.
- Requests cell location
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Queries information about the current Wi-Fi connection
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Listens for changes in the sensor environment (might be used to detect emulation)
- Registers a broadcast receiver at runtime (usually for listening for system events)
Network
MITRE ATT&CK Mobile v15
Persistence
Event Triggered Execution
1Broadcast Receivers
1Foreground Persistence
1Defense Evasion
Execution Guardrails
1Geofencing
1Foreground Persistence
1Hide Artifacts
3Suppress Application Icon
1User Evasion
2Input Injection
1Discovery
Location Tracking
1Software Discovery
1Security Software Discovery
1System Network Connections Discovery
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
512B
MD58f90e0e2ee965d3dd1e4aff28be7a869
SHA18b45d11be647547142351f46ef4c4ff8bbe5bea2
SHA256cd0670acf2376d69202bff5f0375bf16793bec3904786ec24d7926a8f928b239
SHA512dd5d720d6cb467767ac64b68de0d13342ad51d77d9557c27e20b6fc12d29ccf52736ac61ed6831ca564428857342c6eaf16cb916d29573fe6139d95c15dab5f1
-
Filesize
28KB
MD5cf845a781c107ec1346e849c9dd1b7e8
SHA1b44ccc7f7d519352422e59ee8b0bdbac881768a7
SHA25618619b678a5c207a971a0aa931604f48162e307c57ecdec450d5f095fe9f32c7
SHA5124802861ea06dc7fb85229a3c8f04e707a084f1ba516510c6f269821b33c8ee4ebf495258fe5bee4850668a5aac1a45f0edf51580da13b7ee160a29d067c67612
-
Filesize
60KB
MD5fc4d4979528d9c6b966fad6e933e855e
SHA15a2faf604361c32c9e623bdba231530f14a99bb6
SHA25664cd73cf1369f662d1e0c7207611914265a9ef8ce45724589727afbcddee8880
SHA51208ccd1a2a3be07b09a2e306b13731c2ebcde3f63c5ac092152f2adbe3f4d84ee95e1f80b55560a00b2e84a63621ac49de91427e628382e41726257ea350fd4a5
-
Filesize
4KB
MD5f2b4b0190b9f384ca885f0c8c9b14700
SHA1934ff2646757b5b6e7f20f6a0aa76c7f995d9361
SHA2560a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514
SHA512ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1
-
Filesize
512B
MD5b24094cbf0d45039b14d4125fca5c6df
SHA197a54b2f0ecf064b141314c4af1deef45538a3be
SHA256ba880bc8a0ebf23b18430fcdc802044955044bf78186093d9c8d784d1b4ea164
SHA51244e329bd39e329364a530633cfbca9b12e579e3a81174d09410ede5e0723ec165ce7f9527cabf39fa1dd1a43e1e62868d76f76687889fc86bcff1ddea72bf7b8
-
Filesize
32KB
MD5bb7df04e1b0a2570657527a7e108ae23
SHA15188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA256c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
SHA512768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012
-
Filesize
32KB
MD5c64c13ec953cbb99b8c2a957c8606b79
SHA1d210c380383ec057f2a6cca39796bf1b6a492e98
SHA2564db65f4fc17722d6223a9bf9887424c91fd361c416eaf23ff038b70497a177b9
SHA5124a5fd452edfa2f02733b3dbe38403d15897e08f3b4828ffe5af96a5d85331cd1cd4e2e5caeb4c524e3facd06f2d20b1704299c4341d6b2e65206badf2b0b3af1
-
Filesize
3B
MD558e0494c51d30eb3494f7c9198986bb9
SHA1cd0d4cc32346750408f7d4f5e78ec9a6e5b79a0d
SHA25637517e5f3dc66819f61f5a7bb8ace1921282415f10551d2defa5c3eb0985b570
SHA512b7a9336ed3a424b5d4d59d9b20d0bbc33217207b584db6b758fddb9a70b99e7c8c9f8387ef318a6b2039e62f09a3a2592bf5c76d6947a6ea1d107b924d7461f4
-
Filesize
116B
MD5f4d007ca8d6dedaf902b80481df15c9c
SHA1543baf0e6aab364e08d33fa942c733c683d3edab
SHA256afa613bb045dfdd4489238a4d2576397a7083e42b573db431b43ae00d2323ce5
SHA5127be6bc46789004f8b85c2d1c8e012fd289b7e940822b8508d9b3f4f091c79a994ff552aa340a57db83842654dbfe3aa21bbf1b081824e9f3b85104a2b3d4dba1
-
Filesize
126B
MD5a8bc587f72b6b509e483777bf348166f
SHA1ac7ffa9490af0f70526de5d4943742027f22a9e1
SHA2568702ec6627aece7db9f8038fe5e3f759dfd24544d7c7690e033512c28c544111
SHA512b6748b36ddf395a230db23c6dc634be1776c433f498b3e1bd598f71761f4e7efa7766d062a42776a254992d5e7a3240616ec68334ae3d41736da6ec77a264781
-
Filesize
282B
MD5c4cfeea648acc8c1a62d101e6d4b6a5a
SHA19aa9abb19dc26f2749e9cceafdcd557f3ad35073
SHA256c984a7b823635edfcb37eefce7c9b65a8ac07297dfaffd3ee7db231101cdadd0
SHA512a819b19b1735af6cd1c1a605e6815fb85a3aa73090f2db96f175691c15e988525f9f57dadd632c03f7fce5edb285c68edbd0a9fbe7b9a286657cf3d51467f176
-
Filesize
2B
MD5d751713988987e9331980363e24189ce
SHA197d170e1550eee4afc0af065b78cda302a97674c
SHA2564f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
SHA512b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
-
Filesize
608B
MD536c42b5e9d3ec3404863d226feb1ecd7
SHA165e1ec4939ddee5476726da8f166fd5ce623a2aa
SHA256c6a7fd7b7f03b6883c61ff6ea557d917a83686fdbad6ec2ae7497c01a3f05a06
SHA512be5ed10cce5ea602199424dd0636b651628d4d56e614d7e29923ea18991b7e71ac82500686541188bdf459d60dd78ba88cd874be6a5eb9285ac4dea9be5a30f9
-
Filesize
609B
MD5046df6732838109a3b420565031793fb
SHA1f5a5912be0f5a5610bc00462292c759bdaba48cd
SHA256165397bb6f9d762e7f46e70b2ccb656a769f3f5dc795bbab7346a1ce9ed700b2
SHA512aef8d80c987806d1dd033563bfe2ece0880b9f61a75fba6b9a75a224f9c33c0d1427950b2b5c4d07693e7739d14ee7777178e6411a534745e79eb12edf7d4c59
-
Filesize
5KB
MD59857c0caa99fde5d0bf47c0ee0fd821b
SHA1ef4629899e6ebbdbaf45ca4885f5b960da25538f
SHA256d68311a5561ada62ee327cda3a9b29c41ed0d7bc16586f9af6d5595a96d497a8
SHA512312c11c7b41384fd5a7ef466f06813c09f6c661ade0ed4ffe6e8e88969f2ba31257a90333b13ce8d4b2ab0692318b638f06aecfea11aeb2df3739580e635a148
-
Filesize
267B
MD52fea6fcd7b73787ea80ce21066f22bb5
SHA1c31ad28bebaa4436e3f66b518e708fd60f145164
SHA256917032a07f9e4b0e36b58f89001e310b87d6a3b8ba3b9249014026a0ff8d2113
SHA5129cf2f442ea6a7b6057a7cf51c1546671e873c6c3bcdb5796e35aa66fed2c791de375ceb594abb83620c0c8a98ae5c6cf6d399e0647191aa7ab8a897d0e737af6
-
Filesize
12B
MD5a9256f55737b655c8cff95418411997c
SHA1d81a4e85ecef3a4f08d50da9c75c49a3c64ffe24
SHA256bad705c44807d12463fb587087c4e9eb24769d82981229ac8b74abc9b1a44412
SHA51210d10a6498973ed65d47c74ba6d8831dad94213a5071353dc445de46e021689284fbbf4accf5ba1f97a0675a7652ec069ac70f38d63ba36b8595a8caf8d37574
-
Filesize
12B
MD5e48057c3603c907cacbe1568a7dbfc41
SHA16e100086b53e20e499a9be069aa1b452faf82ba3
SHA2564b36685dbf772b2de007f4c98f824966f4f3a132075692d3d3d8f11e84e5468e
SHA512787e1140832e8c308039f0287ee801c00040544d5241425b0c0c8e8dc19ecf3feefa50706723f7a21be209c13b24ab3dbe0691ec42118fdfe18611b13155fb9a