2e60d4ef41b9ae80df7c081dc618d2e0cba8389dc9a94fc5d53bb435c49d3e9a

Resubmissions

29-08-2023 04:54

230829-fjtceada9v 10

13-07-2023 03:45

230713-ea3daafc34 8

Analysis

max time kernel
1067919s
max time network
154s
platform
android_x86
resource
android-x86-arm-20230824-en
resource tags

androidarch:armarch:x86image:android-x86-arm-20230824-enlocale:en-usos:android-9-x86system
submitted
29-08-2023 04:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

maygroups (1).apk
Size

6.2MB
MD5

2d467cc572fd3743b301ba9bd9f51f3c
SHA1

bde9fe3077ea8b300fcde6014e0b7562eefdef64
SHA256

2e60d4ef41b9ae80df7c081dc618d2e0cba8389dc9a94fc5d53bb435c49d3e9a
SHA512

ac81c52847e86bd03adb612cc8a12f77b06184b8d3a3b2198a3f18089f4e93a4026fb5441ec55caf2d720ec3abafcedc1c49a15e2f7eba1b4d329147432e0bd6
SSDEEP

24576:hTlj59FBFmmQ8MhvPiNon1JN9zYCAh0NaE1vL7imHoLXWRJm3h:VljV+mQ/vdrzYSZvRIomx

Score

8^/10

banker evasion

Malware Config

Signatures

Makes use of the framework's Accessibility service. 3 IoCs

Processes:

ham.disclosure.ct

description	ioc	process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByText	ham.disclosure.ct
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId	ham.disclosure.ct
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	ham.disclosure.ct

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps). 1 IoCs
banker

Processes:

ham.disclosure.ct

description ioc process

Framework service call android.content.pm.IPackageManager.getInstalledApplications ham.disclosure.ct
Acquires the wake lock. 1 IoCs

Processes:

ham.disclosure.ct

description ioc process

Framework service call android.os.IPowerManager.acquireWakeLock ham.disclosure.ct
Requests disabling of battery optimizations (often used to enable hiding in the background). 1 IoCs
evasion

Processes:

ham.disclosure.ct

description ioc process

Intent action android.settings.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS ham.disclosure.ct
Removes a system notification. 1 IoCs
evasion

Processes:

ham.disclosure.ct

description ioc process

Framework service call android.app.INotificationManager.cancelNotificationWithTag ham.disclosure.ct

description	ioc	process
Framework service call	android.content.pm.IPackageManager.getInstalledApplications	ham.disclosure.ct

description	ioc	process
Framework service call	android.os.IPowerManager.acquireWakeLock	ham.disclosure.ct

description	ioc	process
Intent action	android.settings.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS	ham.disclosure.ct

description	ioc	process
Framework service call	android.app.INotificationManager.cancelNotificationWithTag	ham.disclosure.ct

ham.disclosure.ct
1⤵
- Makes use of the framework's Accessibility service.
- Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps).
- Acquires the wake lock.
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Removes a system notification.
PID:4188

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

/storage/emulated/0/Config/sys/apps/log/log-2023-08-29.txt

Filesize
25B

MD5
0252723a6b07dcef363d4fe68f3f28bd

SHA1
454a40486142a2fb4c3ea0e9e911ca0358eb521a

SHA256
14346b13e4707ccb1e5aaa7f09267aeb40212168c5ac4ddbb397cac749c6dc2d

SHA512
18653839e3ad7ae212ac377c9719de7463a9eb94388e42c1142c9c4b035ce1d66929cff0fb63055f890d8a48fbbdd54a7fdb768d3482aeac5e7f7c2bf3dc0d3d

Download Submit
/storage/emulated/0/Config/sys/apps/log/log-2023-08-29.txt

Filesize
37B

MD5
5bcaaca2606c9439bbf774a3340f633b

SHA1
c20ef5874ebe35b0e105045361d44dcb0f258754

SHA256
6bb25ef7caa0fdaaff43a3b035369964d55d41864004e341139f3b88e901ba41

SHA512
47be5d2bed111d73402607545573cd82c9c86b4953aaf502336f57434b2c8e8dc2edbd87435c71d194c1a6254e6d88fe7d6c6bfe4715c470b8566c9df2950a29

Download Submit
/storage/emulated/0/Config/sys/apps/log/log-2023-08-29.txt

Filesize
37B

MD5
d69762eb65bd8f859520e749fe980aee

SHA1
e485e623709364fc8affbd9cdd718f1d4d2dccf3

SHA256
6aa983cf28f3a8f12918ac88311259c11122dfc91f20320f5cc33310e2bf5662

SHA512
7134b3b7e878eed8e55cd3e504bfd854f2af089e747d4e07f3bdeb7b8faf5ce431e671e35831e1df2e1f5a2bb46438daf2a86cc8a5d137897401ab08f1c459e1

Download Submit
/storage/emulated/0/Config/sys/apps/log/log-2023-08-29.txt

Filesize
25B

MD5
ba30336bf53d54ed3c0ea69dd545de8c

SHA1
ce99c6724c75b93b7448e2d9fac16ca702a5711f

SHA256
2d6988fb5afdaafc4e33fa1f71d6f10c95ab5a49a8ec820add5b13eef05439af

SHA512
eea34ca526e03349e746d3687ea660b4748f0174fe2ffdb65161e232e08630b345e03329614852ce881a71362ba68575e9dd08fa361a416e5b2fb231e21a0a3e

Download Submit
/storage/emulated/0/Config/sys/apps/log/log-2023-08-29.txt

Filesize
280B

MD5
27ea21b5e3bb0c21679b171ae5accbbf

SHA1
e11e2cd3133f0628b12fb31a15ec9e822be06ae5

SHA256
b7742d2b4922f20ee4e3ebdec5b131e9f9e502bb506add585ab5d931ac1d5294

SHA512
7d22c6551dbbad3e3803db89d7a062bbadf410ab3e85d569c73c649ffbebeb006aed0b9e024730ad8c3102721632f46faa1c1107f07f1f7c34b8eede056ebb7a

Download Submit