Analysis
-
max time kernel
143s -
max time network
149s -
platform
android_x64 -
resource
android-33-x64-arm64-20240624-en -
resource tags
-
submitted
06/01/2025, 16:16
General
-
Target
com.tencent.mobileqq.apk
-
Size
2.9MB
-
MD5
cfc62e2d95de52f92299675c70ddc9fc
-
SHA1
d07d2a50b5cc4dd449825b497cec45b3c0c80908
-
SHA256
20a567a487c0f14bef235ee94c363bcdffc79dce6b82e3ed73e0455d2dc51a23
-
SHA512
6a0185e9d4bba7bfe77de6fb2f951d454f89c34a615bcad05a9b297544c2eb071532df7d7eb9d307a65355b8c7c42f148c4f07bd98654fd4569423210b1a7dca
-
SSDEEP
49152:jDxlyUV5Py/PYyg9Kqy6pIBlFROvqYDoQHwuA1UA7vb3+ez9TJVp8gKSlbc:CUV5aNpLyvqYDoQHwXvbuez9l8gKuc
Malware Config
Signatures
-
Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
-
Queries information about running processes on the device 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about running processes on the device.
-
Requests cell location 2 TTPs 1 IoCs
Uses Android APIs to to get current cell location.
-
Acquires the wake lock 1 IoCs
-
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
-
Queries information about active data network 1 TTPs 1 IoCs
-
Reads information about phone network operator. 1 TTPs
-
Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
Processes
-
com.tencent.mobileqq1⤵
- Queries information about running processes on the device
- Requests cell location
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Queries information about active data network
- Requests disabling of battery optimizations (often used to enable hiding in the background).
Network
MITRE ATT&CK Mobile v15
Defense Evasion
Execution Guardrails
1Geofencing
1Foreground Persistence
1Hide Artifacts
1User Evasion
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
40KB
MD5571112758fefc013ca64f73bc959a009
SHA164b3e995d49a74c647cb467f54fc72c28c5af3bf
SHA256632907b2357e6d3e99c86012795c6a2eebd1e8c1ee0a64c64878c5c1201413a2
SHA512ce75b2bf73c4fd98b5391cf39610260fc90a91a7e85388c6074fe7b21f8b54eb88a0d0ce83a3403b496bcaf885deceab36daaae18976dc1f18fa4dd0605e2e34
-
Filesize
512B
MD53d53a842b568fafe702de820a68ae0b9
SHA1fddf99c29012ba61b4f46ba879700372e4c8f6ca
SHA256dd110281ac26efe2917ce9725c98e0c0d63ac46a5063e0d1a01a7e17652a266f
SHA512eb0458648f52d749971258882d85c786ef59baa97a270909fc180906555600dc70cd5af52ece8c641cf180c6a5b7d48ca0f26de0ea947abad9e98d6c73196a3a
-
Filesize
8KB
MD57c948159a07decef91de865bb35bfe02
SHA1e23ec9096390319c3ec113594f7e6b73d028b026
SHA2568e38ebfb2065d921d97353ad56d5bb7940a984dd4621be343253e81fafaa4c93
SHA51249265de95c80e18bb87b3509bce647502964e9a177840c6eb13e7b793ad95d7bb95dd0cbafc90384b0f278983c28ae014adfea11fd385735c954bf9c58619616
-
Filesize
8KB
MD53888137057578ec64332079f243f990f
SHA1a73b6de4e895d02ee85c7bd8e9a0578db2e1e447
SHA25601ec4c64310a9b7dccea0231f7c10823233974a799feec3df1c183aa3182ff2d
SHA512d8b83346194c1f78fde7cf5cf1af6c3d643d415503c5c6af56c844aa321686d477e3debadb6daeebecfd58a8488466f5b80289e41261fc6cb7b4cb3a225adcdc
-
Filesize
90B
MD5c38830166501a3b9a6e4bed7b5f714eb
SHA10a10723757e4795c74d2c117296be08b67b88f93
SHA25681ebdc95a849859b53bb136865d47c87005e7a5ea451f4d4eea0384728ea07c5
SHA5125e761e5b7099686dc068bfac7480b66af49498f5e9817ad3604778f0f7fb0de213ec0d4add8f1b7046768edf67529cc12981d839ca5accd6cf8f19c88213d7d5
-
Filesize
114B
MD5d2438f45df492f8630b5c0aeee57ac4b
SHA189f19fc1a09245494b19347098544559ee91ed3b
SHA256c9d8e5f64cf4d30544790efb888f5c3db979980fb690090cc36456b14c2ee94e
SHA512b470244cbf4c3d672a8a418d4b063e917df41a343c2991928549761715db59c3f3a39b9f0e3b6a92392c91304b41c530a42537275a9fe658709395766b603986