hydra | cf58bfcf15a1131d098549815400715d80698b1c400e6b5073ec8a25ec7eb48c

Analysis

max time kernel
1564136s
max time network
160s
platform
android_x64
resource
android-x64-arm64-20220621-en
resource tags

androidarch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20220621-enlocale:en-usos:android-11-x64system
submitted
02-08-2022 06:19

Target

78wEKB72_mediaplayer_aHR0cDovL2xvYW1obWlpZ2xhNnN6bnRsanduM2Z5dX.apk
Size

1.9MB
MD5

43f848722d0ddb631d88b65b565d6b0d
SHA1

4cc9045d2a9d4252c12d8c973c6d1e8b22c74f35
SHA256

cf58bfcf15a1131d098549815400715d80698b1c400e6b5073ec8a25ec7eb48c
SHA512

eee9d44a6558d594756eaccd26193372d2e12f1273e1b0c7b052c72d95ed1bffc2a1386ea0fe6193e24dcec30a17928eb9ff8d0a9b4b47fb9e97cacfa5626831

Score

10^/10

Makes use of the framework's Accessibility service. 2 IoCs

Processes:

com.sdktools.android

description	ioc	process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	com.sdktools.android
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId	com.sdktools.android

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

com.sdktools.android
1⤵
- Makes use of the framework's Accessibility service.
PID:5064

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Web Service

Impact