97bf3ce8c71eac529f7326a2256f85e1b178521ca76bc1ecf42fdf7a6193d065

Analysis

max time kernel
2171027s
max time network
154s
platform
android_x64
resource
android-x64-arm64-20230831-en
resource tags

androidarch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20230831-enlocale:en-usos:android-11-x64system
submitted
10-09-2023 23:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ready.apk
Size

6.2MB
MD5

190da6bcb3b92d402840488c00f562d1
SHA1

3bf373a4cf808ed00ef5c41e2ceefde7e65ead55
SHA256

97bf3ce8c71eac529f7326a2256f85e1b178521ca76bc1ecf42fdf7a6193d065
SHA512

24a7908e24f1be4c8b9eb63893d504e9a1d8ead6dfd183a7fbc1199acf75709de41831d6f08bad014bff9ac7621fcdef580f01c7fa994a6f51251c5d7e331913
SSDEEP

12288:I+kwIeyyGYivT8OW3m8TQprx0qf53ececMMuUzXj7RgwaBKO3GYzWK+pm+XHA0dG:IXwPyZ558EPLMMlXjN/nO/+pLXZdG

Score

8^/10

banker evasion

Malware Config

Signatures

Makes use of the framework's Accessibility service. 3 IoCs

Processes:

cure.corresponding.leo

description	ioc	process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByText	cure.corresponding.leo
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId	cure.corresponding.leo
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	cure.corresponding.leo

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps). 1 IoCs
banker

Processes:

cure.corresponding.leo

description ioc process

Framework service call android.content.pm.IPackageManager.getInstalledApplications cure.corresponding.leo
Acquires the wake lock. 1 IoCs

Processes:

cure.corresponding.leo

description ioc process

Framework service call android.os.IPowerManager.acquireWakeLock cure.corresponding.leo
Tries to add a device administrator. 1 IoCs

Processes:

cure.corresponding.leo

description ioc process

Intent action android.app.action.ADD_DEVICE_ADMIN cure.corresponding.leo
Requests disabling of battery optimizations (often used to enable hiding in the background). 1 IoCs
evasion

Processes:

cure.corresponding.leo

description ioc process

Intent action android.settings.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS cure.corresponding.leo
Removes a system notification. 1 IoCs
evasion

Processes:

cure.corresponding.leo

description ioc process

Framework service call android.app.INotificationManager.cancelNotificationWithTag cure.corresponding.leo

description	ioc	process
Framework service call	android.content.pm.IPackageManager.getInstalledApplications	cure.corresponding.leo

description	ioc	process
Framework service call	android.os.IPowerManager.acquireWakeLock	cure.corresponding.leo

description	ioc	process
Intent action	android.app.action.ADD_DEVICE_ADMIN	cure.corresponding.leo

description	ioc	process
Intent action	android.settings.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS	cure.corresponding.leo

description	ioc	process
Framework service call	android.app.INotificationManager.cancelNotificationWithTag	cure.corresponding.leo

cure.corresponding.leo
1⤵
- Makes use of the framework's Accessibility service.
- Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps).
- Acquires the wake lock.
- Tries to add a device administrator.
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Removes a system notification.
PID:4541

getprop ro.miui.ui.version.name
2⤵
PID:4751

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

/storage/emulated/0/Config/sys/apps/log/log-2023-09-10.txt
Filesize
21B

MD5
75e272e8487f7a450be1094e3db31ba1

SHA1
e134d640d7a9cdbb7855c7a901e7f5bc55867d50

SHA256
f115d546e4cfdeecaec7cc494c0404b095cfa09c7e00f3d83b8305e1bb0f6474

SHA512
24dac9c7c7fe7c4ba62fd274cf99bab45f572e495ed01d8eb0fba2e31f90e494ed93349e5cd64db4fbe3c7ab3e7354c9dc10dbb9293d7a11f5ad5be8968840cd

Download Submit
/storage/emulated/0/Config/sys/apps/log/log-2023-09-10.txt
Filesize
29B

MD5
45a285a5bd29a4008b27af24a4919b38

SHA1
0e518bc8bed9d0e9c0fb89ab7a9bc703d939b556

SHA256
e28801f237a2442f2709cb31d879c9615cea0968adc99c89598d86b133c591b1

SHA512
328ec462a7e0556f09fe48a33dbe87519ed9482c1efde2b36045f03e239060eb8b8a30bce8f5eda4f54ce4c69129be262538f2606f7f1050c1cdb2dda39645f5

Download Submit
/storage/emulated/0/Config/sys/apps/log/log-2023-09-10.txt
Filesize
21B

MD5
7d387073b297d63997ab2390e9dabd36

SHA1
e7075ec4bf25d31e33510a9b1aad963c9e292d44

SHA256
69315b352d0cb43451ffc6956cc7f3b4065a783dc85b8edeb4d0c0549bdf0eda

SHA512
87789a6ea23b37766bf37059ce3a4f83bd05d184d226119e5c363b1bc14c2d6ec8d9e919ea2c7d85ffbd5f0bf834ba697853a9171a9b54d37f5b1b8e58d25949

Download Submit
/storage/emulated/0/Config/sys/apps/log/log-2023-09-10.txt
Filesize
25B

MD5
ba30336bf53d54ed3c0ea69dd545de8c

SHA1
ce99c6724c75b93b7448e2d9fac16ca702a5711f

SHA256
2d6988fb5afdaafc4e33fa1f71d6f10c95ab5a49a8ec820add5b13eef05439af

SHA512
eea34ca526e03349e746d3687ea660b4748f0174fe2ffdb65161e232e08630b345e03329614852ce881a71362ba68575e9dd08fa361a416e5b2fb231e21a0a3e

Download Submit
/storage/emulated/0/Config/sys/apps/log/log-2023-09-10.txt
Filesize
276B

MD5
a6d94e941987a655619b695a3cc24583

SHA1
ed1a6fa728b985a82a616c37d0ca98b208bfc885

SHA256
f1321201c4f9b329e36bfd4ac79cb3ae0b568a59e48d72a3eef51ff9215cb204

SHA512
bfb9643fb24db903e7c8c366994ea1031e54625a2f3f179bcbe92cb730ea1b3cc871fe5fe477972ce2337a4896e608ff74c0dd0853b3b07882c39169500a9db8

Download Submit