Overview

overview

10

Static

static

10

com.tencen...qq.apk

android-13-x64

7

Resubmissions

20/03/2026, 04:35

260320-e7tseahz8110

20/10/2025, 11:54

251020-n3dp3ahq6y10

20/10/2025, 11:54

251020-n22qhavlgy10

22/09/2025, 20:03

250922-ys1f7aal9s10

06/01/2025, 16:16

250106-tqt46s1lcw10

Analysis

  • max time kernel
    141s
  • max time network
    152s
  • platform
    android-13_x64
  • resource
    android-33-x64-arm64-20260306-en
  • resource tags

    arch:arm64arch:x64image:android-33-x64-arm64-20260306-enlocale:en-usos:android-13-x64system
  • submitted
    20/03/2026, 04:35

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    com.tencent.mobileqq.apk
  • Size 2.9MB
  • Sample260320-e7tseahz81
  • SHA256 20a567a487c0f14bef235ee94c363bcdffc79dce6b82e3ed73e0455d2dc51a23
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
bankercollectiondefense_evasiondiscoverypersistence

Malware Config

Signatures

  • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
    bankerdiscovery
  • Queries information about running processes on the device 1 TTPs 1 IoCs

    Application may abuse the framework's APIs to collect information about running processes on the device.

    discovery
  • Requests cell location 2 TTPs 1 IoCs

    Uses Android APIs to to get current cell location.

    collectiondiscoverydefense_evasion
  • Acquires the wake lock 1 IoCs
  • Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

    Application may abuse the framework's foreground service to continue running in the foreground.

    defense_evasionpersistence
  • Queries information about active data network 1 TTPs 1 IoCs
    discovery
  • Reads information about phone network operator. 1 TTPs
    discovery
  • Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
    defense_evasion

Processes

  • com.tencent.mobileqq
    1⤵
    • Queries information about running processes on the device
    • Requests cell location
    • Acquires the wake lock
    • Makes use of the framework's foreground persistence service
    • Queries information about active data network
    • Requests disabling of battery optimizations (often used to enable hiding in the background).
    PID:4239

Network

        MITRE ATT&CK Mobile v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        com.google.android.datatransport.events
        • Path /data/user/0/com.tencent.mobileqq/databases/com.google.android.datatransport.events
        • Size 40KB
        • SHA256 632907b2357e6d3e99c86012795c6a2eebd1e8c1ee0a64c64878c5c1201413a2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        com.google.android.datatransport.events-journal
        • Path /data/user/0/com.tencent.mobileqq/databases/com.google.android.datatransport.events-journal
        • Size 512B
        • SHA256 00f75891eae8c3364f55bd21ebc06c51dd82515a99a1832f5dd89688d5823c70
        • MD5 SHA1 SHA512
        Submit Download

        com.google.android.datatransport.events-journal
        • Path /data/user/0/com.tencent.mobileqq/databases/com.google.android.datatransport.events-journal
        • Size 8KB
        • SHA256 67371aa27fe48dfcdcc0f1151c5600e353f5ce1b707c86a0923f3083d00ab7a1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        com.google.android.datatransport.events-journal
        • Path /data/user/0/com.tencent.mobileqq/databases/com.google.android.datatransport.events-journal
        • Size 8KB
        • SHA256 d13ace4a974fc24e1c068ff17956d7381fef057f733c6b6c672875117f47a774
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        PersistedInstallation4413478471853085556tmp
        • Path /data/user/0/com.tencent.mobileqq/files/PersistedInstallation4413478471853085556tmp
        • Size 114B
        • SHA256 d76047765b5c133abd13da1921b10176cab540963ef746351031e8f46d5d1ff9
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        PersistedInstallation7537712567938915441tmp
        • Path /data/user/0/com.tencent.mobileqq/files/PersistedInstallation7537712567938915441tmp
        • Size 90B
        • SHA256 b99cfd9ff58c0a480f8f1ac20d77f9a5bd494c2f3422056be0d71d87c6a49efc
        • MD5 SHA1 SHA512 TLSH
        Submit Download