Analysis
-
max time kernel
1018437s -
max time network
150s -
platform
android_x86 -
resource
android-x86-arm-20230831-en -
resource tags
androidarch:armarch:x86image:android-x86-arm-20230831-enlocale:en-usos:android-9-x86system -
submitted
12-10-2023 17:12
Behavioral task
behavioral1
Sample
Youtube Lite-Ram.apk
Resource
android-x86-arm-20230831-en
Behavioral task
behavioral2
Sample
Youtube Lite-Ram.apk
Resource
android-x64-20230831-en
Behavioral task
behavioral3
Sample
Youtube Lite-Ram.apk
Resource
android-x64-arm64-20230831-en
General
-
Target
Youtube Lite-Ram.apk
-
Size
3.8MB
-
MD5
68ab0212440ed170cf6ed462d83f795d
-
SHA1
82c2024a4e060f809efc6a1d69b7897df2453842
-
SHA256
d17a51d95be00032e75f0cf5d8f847dc5713508ae21d362be55e4d738338bc70
-
SHA512
4caf67735ef515f27941313918b4f452aaf23caa9e94896900d26bda4baef54d5a4e00a42f7c967d6905ae29fd31dfb396d08a4973585227ae704d0c2c97dffd
-
SSDEEP
98304:XzlsXqJpFphK/V9K2cKmzTzBFTW0tMrbC:Dlwq1fK/Glz3dZ
Malware Config
Signatures
-
Makes use of the framework's Accessibility service. 1 IoCs
Processes:
enhancements.fiji.evansdescription ioc process Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId enhancements.fiji.evans -
Acquires the wake lock. 1 IoCs
Processes:
enhancements.fiji.evansdescription ioc process Framework service call android.os.IPowerManager.acquireWakeLock enhancements.fiji.evans -
Requests disabling of battery optimizations (often used to enable hiding in the background). 1 IoCs
Processes:
enhancements.fiji.evansdescription ioc process Intent action android.settings.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS enhancements.fiji.evans -
Removes a system notification. 1 IoCs
Processes:
enhancements.fiji.evansdescription ioc process Framework service call android.app.INotificationManager.cancelNotificationWithTag enhancements.fiji.evans
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
/storage/emulated/0/Config/sys/apps/log/log-2023-10-17.txtFilesize
29B
MD5ece45f8623243feea4df6c2fe45b36e1
SHA1ef24e005271d92ed255e24a40a15d94b0d5f6bd3
SHA256e011b2d4119782d41972729f76497925f6f503f6b87dbf8363a50d5134ff39a2
SHA51286e5a142bb1c4607af14414558fca4711e9a043842aef5add7229d2b49a640d43d62383729edd60869f26e2ad28218d48228303e358b56038267d8bdaf6353da