Analysis
-
max time kernel
2249473s -
max time network
169s -
platform
android_x64 -
resource
android-x64-arm64-20230831-en -
resource tags
androidarch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20230831-enlocale:en-usos:android-11-x64system -
submitted
11-09-2023 21:07
General
-
Target
ready.apk
-
Size
10.7MB
-
MD5
a486ca3f722b1cff608c2c71ce78ab13
-
SHA1
930affb485ed640adae66e61f8f71c00c79d9aca
-
SHA256
d5223c601db560dd767fce18f791cbe67b8cbf832039c531411041caf598137f
-
SHA512
c3f243694516a4158483e396c7c6138a27196738cfb4ff77b53aeab80b1eaf8f6e7d3f5ecb5a6825797ba295fa13af7aa575657781d8ea1ddc9e0a73e37df4e7
-
SSDEEP
12288:9KWDfK0+VuOD1MNuCz33NsyaGpcahVN9nunH:RDSOcyNt3NsYcAN9EH
Malware Config
Signatures
-
Makes use of the framework's Accessibility service. 2 IoCs
Processes:
disco.herald.evendescription ioc process Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId disco.herald.even Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId disco.herald.even -
Processes:
disco.herald.evenpid process 4632 disco.herald.even -
Acquires the wake lock. 1 IoCs
Processes:
disco.herald.evendescription ioc process Framework service call android.os.IPowerManager.acquireWakeLock disco.herald.even -
Requests disabling of battery optimizations (often used to enable hiding in the background). 1 IoCs
Processes:
disco.herald.evendescription ioc process Intent action android.settings.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS disco.herald.even -
Removes a system notification. 1 IoCs
Processes:
disco.herald.evendescription ioc process Framework service call android.app.INotificationManager.cancelNotificationWithTag disco.herald.even
Processes
-
disco.herald.even1⤵
- Makes use of the framework's Accessibility service.
- Removes its main activity from the application launcher
- Acquires the wake lock.
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Removes a system notification.
-
disco.herald.even:remote1⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
/storage/emulated/0/Config/sys/apps/log/log-2023-09-11.txtFilesize
25B
MD5a9148d406d2aa27774f728eac988cdd3
SHA168c1e93debcda4b97e06720a3b93a434e0f0c4e5
SHA256bd8740f21d0f44f343afebfd133a234fa5210d5f4f79f2d826980a4a1bf07a38
SHA512f6f089bbf90a16061e1af9dc677451ce729fcc908218f60977862beb3f370ff69948eace2a4c995a0d65a96efc5263da307d77f514ec3a16f02133d7d9cc2215
-
/storage/emulated/0/Config/sys/apps/log/log-2023-09-11.txtFilesize
37B
MD58ff31bd87f525742d1693a62d99dd4d6
SHA141eb9344509dc310898211a6ca6a2d32ce42923e
SHA2564083c1d7859c738c9ac2d623a97f3a5abee21df619cdd78da2690793b60bedca
SHA5122978ac96f893e3a465406e22a2f6ca89c78ca212f691f868f751c3ce5d2bcc3b975f28dadeb86bf2bf9e8c7332c7481a9734e6a9bdd36d474250313ee7fc90e7
-
/storage/emulated/0/Config/sys/apps/log/log-2023-09-11.txtFilesize
25B
MD5a9148d406d2aa27774f728eac988cdd3
SHA168c1e93debcda4b97e06720a3b93a434e0f0c4e5
SHA256bd8740f21d0f44f343afebfd133a234fa5210d5f4f79f2d826980a4a1bf07a38
SHA512f6f089bbf90a16061e1af9dc677451ce729fcc908218f60977862beb3f370ff69948eace2a4c995a0d65a96efc5263da307d77f514ec3a16f02133d7d9cc2215
-
/storage/emulated/0/Config/sys/apps/log/log-2023-09-11.txtFilesize
25B
MD5a9148d406d2aa27774f728eac988cdd3
SHA168c1e93debcda4b97e06720a3b93a434e0f0c4e5
SHA256bd8740f21d0f44f343afebfd133a234fa5210d5f4f79f2d826980a4a1bf07a38
SHA512f6f089bbf90a16061e1af9dc677451ce729fcc908218f60977862beb3f370ff69948eace2a4c995a0d65a96efc5263da307d77f514ec3a16f02133d7d9cc2215
-
/storage/emulated/0/Config/sys/apps/log/log-2023-09-11.txtFilesize
394B
MD50a6818a4001231c3ecee8fb6b0ec8f97
SHA123b23a8450e993f15b2aed930576d90b883db9ac
SHA25635bbbaae88e6ec6334048d3c4d5c4cf66dc1dc920ad09dac8906fe446cd55581
SHA512cafddd06831c6bc26f83fc23d91ab957240d371cc9a1b77c4324d037712871dff0a3dce85dac5e43d0a33ede2d222091b681b956958da2cc0e93375536c06f2d