56837990c541c521c373934e1ea8ad74d6ed3e323bda027ee77c8ea83bfca4f0

Analysis

max time kernel
8s
max time network
153s
platform
android-9_x86
resource
android-x86-arm-20260325-en
resource tags

arch:armarch:x86image:android-x86-arm-20260325-enlocale:en-usos:android-9-x86system
submitted
17/05/2026, 18:12

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
0f6b84e570d6cb19fb1f9ad30b9f590e6d5407526.apk
Size 3.7MB
Sample260517-wtl9vaby8w
SHA256 56837990c541c521c373934e1ea8ad74d6ed3e323bda027ee77c8ea83bfca4f0
MD5 58b615f942bf549b4189ccba0bc8e7ee
SHA1 2acea5f904317f7f2343995a79135e60e73f9d23
SHA512 aa1a71d4694e1e1fd386e575767ca179b903893834bda33248c01ee2d5d8273dfd87fd897bce8638c0178ab44db05bfefe921e95d32ba2ced9715ac8b23f0da3
SSDEEP 98304:XU6qChNp26pZHhfZ7unkiaKMuHVg1Cuuc1gxV8xt4D7gHZlpw0r5aLMAcf1:kQc6HBfi7d1iJuc0s+abpw09aA7
TLSH
T1090623E7D356E862E163C138C3718847FCA90C89564DE126366EF19C8FB7E809189BDD
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery impact persistence

Malware Config

Signatures

Checks if the Android device is rooted. 1 TTPs 4 IoCs

defense_evasion

System Information Discovery

T1426

ioc	Process
/sbin/su	/system/bin/sh -c type su
/system/bin/su	/system/bin/sh -c type su
/system/xbin/su	/system/bin/sh -c type su
/system/app/Superuser.apk	com.just_soft.person_qq_sign

Queries information about active data network 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.just_soft.person_qq_sign

Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.wifi.IWifiManager.getConnectionInfo	com.just_soft.person_qq_sign

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs

persistence

Broadcast Receivers

T1624.001

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	com.just_soft.person_qq_sign

Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

impact

Data Encrypted for Impact

T1471

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	com.just_soft.person_qq_sign

Checks memory information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	com.just_soft.person_qq_sign

com.just_soft.person_qq_sign
1⤵
- Checks if the Android device is rooted.
- Queries information about active data network
- Queries information about the current Wi-Fi connection
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Uses Crypto APIs (Might try to encrypt user data)
- Checks memory information
PID:4289
- /system/bin/sh -c getprop ro.board.platform
  2⤵
  PID:4354
- getprop ro.board.platform
  2⤵
  PID:4354
- /system/bin/sh -c type su
  2⤵
  - Checks if the Android device is rooted.
  PID:4381
- logcat -d -v threadtime
  2⤵
  PID:4406
- logcat -d -v threadtime
  2⤵
  PID:4424
- /system/bin/sh -c getprop ro.miui.ui.version.name
  2⤵
  PID:4447
- getprop ro.miui.ui.version.name
  2⤵
  PID:4447
- /system/bin/sh -c getprop ro.build.version.emui
  2⤵
  PID:4472
- getprop ro.build.version.emui
  2⤵
  PID:4472
- /system/bin/sh -c getprop ro.lenovo.series
  2⤵
  PID:4497
- getprop ro.lenovo.series
  2⤵
  PID:4497
- /system/bin/sh -c getprop ro.build.nubia.rom.name
  2⤵
  PID:4522
- getprop ro.build.nubia.rom.name
  2⤵
  PID:4522
- /system/bin/sh -c getprop ro.meizu.product.model
  2⤵
  PID:4547
- getprop ro.meizu.product.model
  2⤵
  PID:4547
- /system/bin/sh -c getprop ro.build.version.opporom
  2⤵
  PID:4572
- getprop ro.build.version.opporom
  2⤵
  PID:4572
- /system/bin/sh -c getprop ro.vivo.os.build.display.id
  2⤵
  PID:4597
- getprop ro.vivo.os.build.display.id
  2⤵
  PID:4597
- /system/bin/sh -c getprop ro.aa.romver
  2⤵
  PID:4621
- getprop ro.aa.romver
  2⤵
  PID:4621
- /system/bin/sh -c getprop ro.lewa.version
  2⤵
  PID:4648
- getprop ro.lewa.version
  2⤵
  PID:4648
- /system/bin/sh -c getprop ro.gn.gnromvernumber
  2⤵
  PID:4672
- getprop ro.gn.gnromvernumber
  2⤵
  PID:4672
- /system/bin/sh -c getprop ro.build.tyd.kbstyle_version
  2⤵
  PID:4696
- getprop ro.build.tyd.kbstyle_version
  2⤵
  PID:4696
- /system/bin/sh -c getprop ro.build.fingerprint
  2⤵
  PID:4721
- getprop ro.build.fingerprint
  2⤵
  PID:4721
- /system/bin/sh -c getprop ro.build.rom.id
  2⤵
  PID:4746
- getprop ro.build.rom.id
  2⤵
  PID:4746

Network

MITRE ATT&CK Mobile v16

Initial Access

Execution

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Discovery

System Information Discovery

T1426

System Network Connections Discovery

T1421

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

T1471

Replay Monitor

Loading Replay Monitor...

Downloads

bugly_db_legu

Path /data/data/com.just_soft.person_qq_sign/databases/bugly_db_legu
Size 172KB
SHA256 e3cc4dfe32421e6c1b2c82ce7686aab6a6eb10119fe5475cbaed681ee68c646b
MD5 feac8715785c5214ab66b9aa62dc7430
SHA1 10be80f5a01e490a442ebcbe1482b11c92865dc6
SHA512 18f2cae04ea0e6c1ed98a523c97a2b1b3200cdb00d13799f618bcae7bd3e446e1af23e11b7f34ea2615fd9cc16001f1e20ea6110e09e71c095b731e41c2f32d1
SSDEEP 768:BJAYkKlWr6cRfJSXXD3jDKLNcwRkTzryDHKsxxFWFxkjxMOW4NHQLfneeFcFs1gp:XFX7wr8n2s1gRShllX0w/8Xw01gnShlf
TLSH
T12E0402155BF90319F2F79B3AA9F71546993B7CA6EC30DB0C1082160D0A73A45ADA1F3B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bugly_db_legu-journal

Path /data/data/com.just_soft.person_qq_sign/databases/bugly_db_legu-journal
Size 512B
SHA256 9cde34b0448db36b197222a09da1c3d27348bf134e06f90484384e5d344b2451
MD5 0e2c4377d70eeb69cc57d08f0dd81f04
SHA1 f030f07fe1025492bbe6105b9de77d19271c7e34
SHA512 b064991678f8a0fef9b7a9dd83463226544e23c540f4a3da8450c1cbd0a1b5d66e5e8fad488b8b5c12f903778cf75cf6db3776ab5dbd9314a163e38783425439
MD5 SHA1 SHA512

Submit Download

bugly_db_legu-shm

Path /data/data/com.just_soft.person_qq_sign/databases/bugly_db_legu-shm
Size 32KB
SHA256 c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
MD5 bb7df04e1b0a2570657527a7e108ae23
SHA1 5188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA512 768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012
SSDEEP 3::
MD5 SHA1 SHA512 SSDEEP

Submit Download

bugly_db_legu-wal

Path /data/data/com.just_soft.person_qq_sign/databases/bugly_db_legu-wal
Size 446KB
SHA256 3568e50891b8ef86fd638b15ca8240da40a952989798fbf61593642f399b1d77
MD5 efa7cb5a2dabdf3a724dcb91fa89cecd
SHA1 809ac3f8b6bd9445b75534e2ca0609ca8a6cf288
SHA512 fb0fb1a44568967b54a1232a6af273382aa510887e33a551df36b8c8d17c053b3568706d0ffd6dce556085a24d982bc51e1bb30c044bac71987d17a357e03fb9
SSDEEP 3072:YXuwd8a2cgYShlKVXPwb8d7OggShlrGX/wF8V2mgiShloqXPwz8TdOgsShlq:YXuwJg0VXPw3g5GX/wggMqXPwrg4
TLSH
T130A412156BF90319F2F79B3AA9F71546593B7CA6E930DB0C1082160D0A73A45ACA1F3F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v16

Replay Monitor

Loading Replay Monitor...

Downloads