Analysis

  • max time kernel
    2989008s
  • max time network
    162s
  • platform
    android_x64
  • resource
    android-x64-arm64-20220823-en
  • resource tags

    androidarch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20220823-enlocale:en-usos:android-11-x64system
  • submitted
    24-04-2023 07:24

General

  • Target

    caixa.apk

  • Size

    1.3MB

  • MD5

    beb22bc3c488093dde4a9128b3f7d505

  • SHA1

    6804420f4722f167db762f06d92813245821d122

  • SHA256

    d4dd905273ddcf887378be462217582d6e78b57e7d105c80abebba43dbcc355b

  • SHA512

    07cd8176eb8ca43c7e78f6b5dd0eefb6c7b14c2560a75ac919fa182c2578474a15f552e563ab81ca5fab9dde77cc8718a8b93a04bbef8169cd2692d7d046f06c

  • SSDEEP

    24576:ZB7YkGNExzVbR06sL4/vtwqIE0QOWh7/9UMW121im5NL:ZB7WEzVbR06s8/vqquQ1JW1k5R

Score
8/10

Malware Config

Signatures

  • Makes use of the framework's Accessibility service. 2 IoCs
  • Acquires the wake lock. 1 IoCs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs
  • Requests disabling of battery optimizations (often used to enable hiding in the background). 1 IoCs
  • Removes a system notification. 1 IoCs

Processes

  • flood.practitioner.blowing
    1⤵
    • Makes use of the framework's Accessibility service.
    • Acquires the wake lock.
    • Requests disabling of battery optimizations (often used to enable hiding in the background).
    • Removes a system notification.
    PID:4523
  • flood.practitioner.blowing:remote
    1⤵
      PID:5032

    Network

    MITRE ATT&CK Enterprise v6

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • /data/user/0/flood.practitioner.blowing/shared_prefs/ProtectedApps.xml

      Filesize

      128B

      MD5

      214fb59450fb63c2eba0eb00cbef71bb

      SHA1

      d55306c66d10c8256ced135b9a245fb3de50b096

      SHA256

      29cd87115f57a3d714e8f666d08c6d1bd53fd644a77b8172dfa29ac2aea1bf46

      SHA512

      83c6d8af079e1224d78056316e5bebc3947871194afe325493599131b82fc6a381cc7c72ab93378ddcca3ab6b5ed9c14c6da2e73086e29d48c6dafa550a1622b

    • /data/user/0/flood.practitioner.blowing/shared_prefs/flood.practitioner.blowing.xml

      Filesize

      146B

      MD5

      e0ae18ee51f8080061f538d00a4a2b1f

      SHA1

      b39e93a0da5a827e9154142070e5eb93eb2a6314

      SHA256

      cb60eb5f68387d91f47eecbf64f465400f1d0dfd29dca34c2f7835a381f2c1ee

      SHA512

      646b099795a1e9232a3548f78cd3e0025695f2cfd002cb9eae73c0ce14c64dc253ad3ceb7dd53e6289b38b5f556ed511c103e99c197c0685f80361aa0d97c96e