Analysis
-
max time kernel
3252059s -
max time network
135s -
platform
android_x86 -
resource
android-x86-arm-20220823-en -
resource tags
androidarch:armarch:x86image:android-x86-arm-20220823-enlocale:en-usos:android-9-x86system -
submitted
27-04-2023 08:28
Behavioral task
behavioral1
Sample
36163bdac9b43d6521603b64bf766fe20c0877e11f004e1d4a887ca7722267a0.apk
Resource
android-x86-arm-20220823-en
Behavioral task
behavioral2
Sample
36163bdac9b43d6521603b64bf766fe20c0877e11f004e1d4a887ca7722267a0.apk
Resource
android-x64-20220823-en
Behavioral task
behavioral3
Sample
36163bdac9b43d6521603b64bf766fe20c0877e11f004e1d4a887ca7722267a0.apk
Resource
android-x64-arm64-20220823-en
General
-
Target
36163bdac9b43d6521603b64bf766fe20c0877e11f004e1d4a887ca7722267a0.apk
-
Size
3.1MB
-
MD5
2eae007c0609ebcd31b85755bb3e29b3
-
SHA1
3d54d2b2e65c3d2ba77f29d3d0a0911479d084ad
-
SHA256
36163bdac9b43d6521603b64bf766fe20c0877e11f004e1d4a887ca7722267a0
-
SHA512
1173842d45bd306a35523ec35edaefdef5503a0086934e624dd6512c2e93f1df05ef2a4e84059663e80bfca956bb0defd780bd4fdd49a3cc496432fcddf88c3f
-
SSDEEP
49152:DHkIDR8XLj0uegq/BoQU3wV/u+b1ECq/SsrNW+avt/yNi9vhzfrDzQLu:DHvR8bdq3UexLyn8yOzfrDzQK
Malware Config
Signatures
-
Makes use of the framework's Accessibility service. 3 IoCs
Processes:
com.shortform.appdescription ioc process Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId com.shortform.app Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId com.shortform.app Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByText com.shortform.app -
Acquires the wake lock. 1 IoCs
Processes:
com.shortform.appdescription ioc process Framework service call android.os.IPowerManager.acquireWakeLock com.shortform.app -
Requests enabling of the accessibility settings. 1 IoCs
Processes:
com.shortform.appdescription ioc process Intent action android.settings.ACCESSIBILITY_SETTINGS com.shortform.app -
Requests disabling of battery optimizations (often used to enable hiding in the background). 1 IoCs
Processes:
com.shortform.appdescription ioc process Intent action android.settings.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS com.shortform.app -
Uses Crypto APIs (Might try to encrypt user data). 1 IoCs
Processes:
com.shortform.appdescription ioc process Framework API call javax.crypto.Cipher.doFinal com.shortform.app
Processes
-
com.shortform.app1⤵
- Makes use of the framework's Accessibility service.
- Acquires the wake lock.
- Requests enabling of the accessibility settings.
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Uses Crypto APIs (Might try to encrypt user data).
PID:4002