4d62ca98c43bd111d0c0d484a636f72df985b2aee0f0f8c8f40c704fb6e9a81d

General

Target
SafeX云助理聊天.apk
Size 7.3MB
Sample260826-k964eabl7w
SHA256 4d62ca98c43bd111d0c0d484a636f72df985b2aee0f0f8c8f40c704fb6e9a81d
MD5 69e1563018e8ef0aa255ecad9d58c6be
SHA1 6b7846cfea805339a7b92b807e910cffb62d9049
SHA512 466a31206c1390f1391737a50076d71f85e693668e2b11a757b5a614ff6531265258f6a3cd8bea31b6b75030704ebc629732b73b548c329853d417eb129e79fa
SSDEEP 98304:EY4r+8geKlwZ9BZce+tscAx+eaA30iTN7uvKwtKuc68f7gHvoxVjXFl1VTYtnp:EY4r+60wP8e+qoG3nwtxcp7gKF1lT8f
TLSH
T13E761241FBE95E2ECC7740360F0A96361549AE27C343C347D9783A1C69BB6E44E897E8
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

collection credential_access discovery impact persistence

Malware Config

Signatures

Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs

Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.

collection credential_access impact

Clipboard Data

T1414

Transmitted Data Manipulation

T1641.001

description	ioc	Process
Framework service call	android.content.IClipboard.addPrimaryClipChangedListener	com.zw.allinwl

Queries the mobile country code (MCC) 1 TTPs 1 IoCs

discovery

System Network Configuration Discovery

T1422

description	ioc	Process
Framework service call	com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone	com.zw.allinwl

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs

persistence

Broadcast Receivers

T1624.001

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	com.zw.allinwl

Checks CPU information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	com.zw.allinwl

Checks memory information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	com.zw.allinwl

com.zw.allinwl
1⤵
- Obtains sensitive information copied to the device clipboard
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Checks CPU information
- Checks memory information
PID:5054

Network

MITRE ATT&CK Mobile v16

Initial Access

Execution

Persistence

Event Triggered Execution

1

T1624

Broadcast Receivers

1

T1624.001

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

2

T1633

System Checks

2

T1633.001

Credential Access

Clipboard Data

1

T1414

Discovery

System Information Discovery

2

T1426

System Network Configuration Discovery

1

T1422

Lateral Movement

Collection

Clipboard Data

1

T1414

Command and Control

Exfiltration

Impact

Data Manipulation

1

T1641

Transmitted Data Manipulation

1

T1641.001

Replay Monitor

Loading Replay Monitor...

Downloads

740b77ae5df722c697332a4bc9188b58.0.tmp

Path /data/data/com.zw.allinwl/cache/web_cache/740b77ae5df722c697332a4bc9188b58.0.tmp
Size 7KB
SHA256 80a4e9e77310b2e9355ae50e43eee47f50fdda608e89db9bf3f59b99af8b4d0d
MD5 daa982ee21751953e61862a4179b09e6
SHA1 4e9d225841f19ea62e005149e1c90c29efc29875
SHA512 456cf112298645f6d61997fcf2d241470123a1d9eecfff2a032cd96ba36389faeb2bfdcc4f484711a99cd2354059c8cba6564932f3e8cabb2ffb95a9277ad93d
SSDEEP 192:419dQEx3vkY15ElEp8DH55DFIgOwpeX4FHcp7T7Uy+WO0RX:O9uY3v51uCunFIcMXhp7vwWO0F
TLSH
T104E16DCB1B30755F7C53ECC2C1EDA72E366BAB05A9D9207C960CBA450204E8B3E6D5D6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

740b77ae5df722c697332a4bc9188b58.1.tmp

Path /data/data/com.zw.allinwl/cache/web_cache/740b77ae5df722c697332a4bc9188b58.1.tmp
Size 39B
SHA256 b100eefdb1296e9834e2889544c1b3ff98614311a945b6567bf9dd779e75f936
MD5 35ee7d74c8cece0e36217d7b284993a8
SHA1 c37b873eda346bfe9d82f377b068bc15922c4a2e
SHA512 9d40f1613238368ba90d60fcb37293bc03a35bf8d5fae089c7570a7dae86b1f58190b57648c7d70eac2cf6d0c0d9fda72cbd9cf1b0531d23ff80665b9c3ba1b5
MD5 SHA1 SHA512

Submit Download

journal

Path /data/data/com.zw.allinwl/cache/web_cache/journal
Size 122B
SHA256 64791452cf171833be794b75a534029535dc299fb5340a548bda56cd95bc4b0f
MD5 2c408acfb55efda717505f696a721cf3
SHA1 f8bd501470e423b8b487dab546c450c1855e153f
SHA512 973146f032ad24ba44a9a129eff70a544a8c6a282fa6ba7e25aebaf59313d74c7ae10d00be1432e78e07266c20bc199bad6429e849048b97d6c053d53449b635
TLSH
T152B012E0741CB031D13431B3308F43531C1880D9E00982C683D356A4C352104B40112C
MD5 SHA1 SHA512 TLSH

Submit Download

journal.tmp

Path /data/data/com.zw.allinwl/cache/web_cache/journal.tmp
Size 36B
SHA256 7080cb592d5149c858b206d3fd0d5e3e7d601f120af00b2616bee928ee1291ca
MD5 37e8e716e0e2f4a0b05cd9571d95b84d
SHA1 f8d068f6931707bddb8cd69f706f2224ad1fea3c
SHA512 e62b850901835fdb73fa6224618422f721dd765861d42f6bc2dd013413e96bd910ac5313afd9b4f63da74beb12a15fac81b5157456c9caa3031862dab84423f6
MD5 SHA1 SHA512

Submit Download

profileInstalled

Path /data/data/com.zw.allinwl/files/profileInstalled
Size 24B
SHA256 0269751bbff7eac45a61605e7bf6a990a83d802734c06f21d703743d5bc9a640
MD5 7ec0e27526e562218182bf402a6d524c
SHA1 0010c0cfeed6744027e88611ee9d8ea76b3f916a
SHA512 1b82af7e5b8bc498aff060161958aad5ae03951831186e783e94c588e6a5ca08a65a88882fd6a9409a7a7c6d8e55a86e36c7a88d55c9a3aeac945217bd832d0f
MD5 SHA1 SHA512

Submit Download

profileinstaller_profileWrittenFor_lastUpdateTime.dat

Path /data/data/com.zw.allinwl/files/profileinstaller_profileWrittenFor_lastUpdateTime.dat
Size 8B
SHA256 991ded32578c4bed67e5395a1d4183e5bb1bccacf048166b7ab4ee1c95d9278a
MD5 ca410ff2e8f8f544843c41560481b1d9
SHA1 1ea0f0e61e75f0369172c935fcc3d543e238f295
SHA512 c51975591edbc092ed38b7df92cc90cccd7c0c8199bafa0d7a23863459ca879909b44e62be26e2e739b80677fc48cc41e8dfdb0d22f879c90c4f1e0b55fd4911
MD5 SHA1 SHA512

Submit Download

primary.prof

Path /data/misc/profiles/cur/0/com.zw.allinwl/primary.prof
Size 8KB
SHA256 c15e385f2a36dc9bf786e8fc9acbf76014262ff56d2767b3055f4ad669ad7cfb
MD5 5e2bb367e2a68de685be40a60bd914ba
SHA1 f17f6dae151d8ca6482a77ad34ff043574526bae
SHA512 d49168f8a45246068bc149eee7c141c5c9d82eebfd20b85b4badf39dc312a43a13d9f62f637dd4d341081cf5b8a0c3841738d42aa33ec80f3e80727c153ddf3a
SSDEEP 192:3Jzra0mx7kVOMIFGiqWvjFcXFnr+srR3C96wNWkqlEnFBna/JJ:5ceHIFzqW7FcXBrc6NLOBnaRJ
TLSH
T1F5026B40AB953A9B09F511F17022B1AB8381A6C6EEFDD219D6DEC1D3492EC7FDCC401A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

primary.prof

Path /data/misc/profiles/cur/0/com.zw.allinwl/primary.prof
Size 11KB
SHA256 1d2cc839d12833d3a8726e09f4fdb24b30618a10d09d2a224ebb54c31874ecdd
MD5 69d4fe931d6c3287aaaa3d2b0e58b24a
SHA1 765c19bec2f56152091d44048c48d8b5f746d885
SHA512 f548f970bac6d03633c7dba8f003eeda0e075746c450cfb2f5687ed3b34a96933efcd67e36cad15dc97c09d05255bee3ebdd4b132b01d7a0409ee3f69c53efcb
SSDEEP 192:Chg93wbIbvNfAWioXOQjNLgjxdLXYEiBt6xd5vkF4+AVwe:ChwAwNfPdX/jNMj/LpiBtsdGY
TLSH
T187429E88427611C1DCF7ED820203C92AFA56112276957ADBCD3249DEF1F3A4D983B7DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v16

Replay Monitor

Loading Replay Monitor...

Downloads