Overview

overview

10

Static

static

10

com.tencen...qq.apk

android-9-x86

8

com.tencen...qq.apk

android-13-x64

7

Analysis

  • max time kernel
    144s
  • max time network
    146s
  • platform
    android_x86
  • resource
    android-x86-arm-20240624-en
  • resource tags

    androidarch:armarch:x86image:android-x86-arm-20240624-enlocale:en-usos:android-9-x86system
  • submitted
    06/01/2025, 16:16

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    com.tencent.mobileqq.apk

  • Size

    2.9MB

  • MD5

    cfc62e2d95de52f92299675c70ddc9fc

  • SHA1

    d07d2a50b5cc4dd449825b497cec45b3c0c80908

  • SHA256

    20a567a487c0f14bef235ee94c363bcdffc79dce6b82e3ed73e0455d2dc51a23

  • SHA512

    6a0185e9d4bba7bfe77de6fb2f951d454f89c34a615bcad05a9b297544c2eb071532df7d7eb9d307a65355b8c7c42f148c4f07bd98654fd4569423210b1a7dca

  • SSDEEP

    49152:jDxlyUV5Py/PYyg9Kqy6pIBlFROvqYDoQHwuA1UA7vb3+ez9TJVp8gKSlbc:CUV5aNpLyvqYDoQHwXvbuez9l8gKuc

Score
8/10
bankercollectiondiscoveryevasionpersistencestealthtrojan

Malware Config

Signatures

  • Removes its main activity from the application launcher 1 TTPs 1 IoCs
    stealthtrojanevasion
  • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
    bankerdiscovery
  • Queries information about running processes on the device 1 TTPs 1 IoCs

    Application may abuse the framework's APIs to collect information about running processes on the device.

    discovery
  • Requests cell location 2 TTPs 1 IoCs

    Uses Android APIs to to get current cell location.

    collectiondiscoveryevasion
  • Acquires the wake lock 1 IoCs
  • Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

    Application may abuse the framework's foreground service to continue running in the foreground.

    evasionpersistence
  • Queries information about active data network 1 TTPs 1 IoCs
    discovery
  • Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs

    Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.

    discovery
  • Reads information about phone network operator. 1 TTPs
    discovery
  • Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
    evasion
  • Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
    persistence

Processes

  • com.tencent.mobileqq
    1⤵
    • Removes its main activity from the application launcher
    • Queries information about running processes on the device
    • Requests cell location
    • Acquires the wake lock
    • Makes use of the framework's foreground persistence service
    • Queries information about active data network
    • Queries information about the current Wi-Fi connection
    • Requests disabling of battery optimizations (often used to enable hiding in the background).
    • Registers a broadcast receiver at runtime (usually for listening for system events)
    PID:4258

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/data/com.tencent.mobileqq/databases/com.google.android.datatransport.events
    Filesize

    4KB

    MD5

    f2b4b0190b9f384ca885f0c8c9b14700

    SHA1

    934ff2646757b5b6e7f20f6a0aa76c7f995d9361

    SHA256

    0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514

    SHA512

    ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1

    Download Submit

  • /data/data/com.tencent.mobileqq/databases/com.google.android.datatransport.events-journal
    Filesize

    512B

    MD5

    819830004f227fe9c265cdf2f00bfda6

    SHA1

    2c6c6f52bbbc2fd2cfa14283be59d3b8c4642843

    SHA256

    307ae08188b57e83e281dcd5f7e13e938708c64acec7d9f3ff381c10b13bd94f

    SHA512

    e157db5972cabed08cbd556399659937a49b2ab24a0a0f90df598bc737dc97e77e7e8995fce94abcd094ff9286ba093ae376a4a508d6b34efd878c46e9d28fc5

    Download Submit

  • /data/data/com.tencent.mobileqq/databases/com.google.android.datatransport.events-shm
    Filesize

    32KB

    MD5

    bb7df04e1b0a2570657527a7e108ae23

    SHA1

    5188431849b4613152fd7bdba6a3ff0a4fd6424b

    SHA256

    c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479

    SHA512

    768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

    Download Submit

  • /data/data/com.tencent.mobileqq/databases/com.google.android.datatransport.events-wal
    Filesize

    52KB

    MD5

    5d53de76137340c713bca7cc5b347326

    SHA1

    00bdf60997917adc96935e979bda254344f11ae6

    SHA256

    0d9a80974d1fb13098fd68c470e811c64b4ee822f7c1af8ab6e694bfdd8d782d

    SHA512

    e1a7f4fb4ed44c0778a2e3e2a9a74067e5cee022972473e2eeb6d20ad2902f9452a20991563b5c4517e258ce7dac43aa042bcd8c746657118a7e872396f5d9d5

    Download Submit

  • /data/data/com.tencent.mobileqq/files/PersistedInstallation1992242363096584020tmp
    Filesize

    90B

    MD5

    01c95331654772b04e354045e61542b1

    SHA1

    ce70e413caf7ae4d9e8f1a6d96b17a7561e8a49e

    SHA256

    44f13939ba82af0264ba24b06d354d45acc1163242992589c6ba478521ede0cd

    SHA512

    9f061780314811aa7231ff2e0b350d1635690c2ea37143ea46a0454e6ef6cd1668300e11e0329480d83c924f8196d7506031ef8b2de5edf9a108d561d4590128

    Download Submit

  • /data/data/com.tencent.mobileqq/files/PersistedInstallation7937602295611419298tmp
    Filesize

    114B

    MD5

    8b957e3d3544426e315263027a32142e

    SHA1

    bcb67f3f1396745e7d51b97d9566a7bb7e17cec0

    SHA256

    4117a6ca2cb26c9217f9eb49c89199057be2f64414146bb440a383e46bed1ea5

    SHA512

    6615db46ce5af8dd57a16c5c34ace02f5b864a2ed417c4793283fbda60b6c466b72f932645ccd240658f670b68dc4f8ce4690745996070ee2c143e6652a9c7be

    Download Submit