Resubmissions
01-11-2023 01:32
231101-bye14sgf6y 10Analysis
-
max time kernel
2290339s -
max time network
162s -
platform
android_x64 -
resource
android-x64-20231023.1-en -
resource tags
androidarch:x64arch:x86image:android-x64-20231023.1-enlocale:en-usos:android-10-x64system -
submitted
01-11-2023 01:32
Behavioral task
behavioral1
Sample
Grab And GO v1.73.apk
Resource
android-x86-arm-20231023-en
Behavioral task
behavioral2
Sample
Grab And GO v1.73.apk
Resource
android-x64-20231023.1-en
General
-
Target
Grab And GO v1.73.apk
-
Size
7.9MB
-
MD5
ac34306769579abd4e586879c10cba4f
-
SHA1
de091cd542c59ea8fb663aaa74c5605055c8abfc
-
SHA256
5643dc5315cced7c71ddd3451763cefb829d786246d3cb2bfbed2d4ddb39bcf8
-
SHA512
82fb1148173cfcbae669cae3fdc9266d5322b792e7ae80bc04fe0eafd521d8e085e959f29f3c746ea767a6f84d6106db33ed7faa4a9cc75f38314043e6facf02
-
SSDEEP
12288:DNe5uBN2jzdpR/v+2I2uHq++JKDG2cnYzQeBol+GbDrbBOalGpJ2lkU9qzYCEg:6uuzdpR/I2yq+aKDG2yYz/SfXB4cCEg
Malware Config
Signatures
-
Makes use of the framework's Accessibility service. 2 IoCs
Processes:
glasses.sexo.wowdescription ioc process Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId glasses.sexo.wow Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId glasses.sexo.wow -
Processes:
glasses.sexo.wowpid process 5092 glasses.sexo.wow -
Acquires the wake lock. 1 IoCs
Processes:
glasses.sexo.wowdescription ioc process Framework service call android.os.IPowerManager.acquireWakeLock glasses.sexo.wow -
Removes a system notification. 1 IoCs
Processes:
glasses.sexo.wowdescription ioc process Framework service call android.app.INotificationManager.cancelNotificationWithTag glasses.sexo.wow
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
/storage/emulated/0/Config/sys/apps/log/log-2023-11-01.txtFilesize
37B
MD5fcc732da81309213510bf5124aa19aae
SHA1fb555d66bb100814544f7be8e0188bd5bac00b5a
SHA256a21d70b4c6433cb16b162d10d269a686db2c73b8092c857adb651723eb1079ae
SHA51267e8bb420057bfe7b25d47fd11ca799e1569464c7db15ba1e5d697b4b41f2bee4bde2b3da912ad52f3bcb1d3578a904176d0b12f7d5cf70ed79bb11e0ef37beb
-
/storage/emulated/0/Config/sys/apps/log/log-2023-11-01.txtFilesize
37B
MD5fcc732da81309213510bf5124aa19aae
SHA1fb555d66bb100814544f7be8e0188bd5bac00b5a
SHA256a21d70b4c6433cb16b162d10d269a686db2c73b8092c857adb651723eb1079ae
SHA51267e8bb420057bfe7b25d47fd11ca799e1569464c7db15ba1e5d697b4b41f2bee4bde2b3da912ad52f3bcb1d3578a904176d0b12f7d5cf70ed79bb11e0ef37beb
-
/storage/emulated/0/Config/sys/apps/log/log-2023-11-01.txtFilesize
37B
MD5fcc732da81309213510bf5124aa19aae
SHA1fb555d66bb100814544f7be8e0188bd5bac00b5a
SHA256a21d70b4c6433cb16b162d10d269a686db2c73b8092c857adb651723eb1079ae
SHA51267e8bb420057bfe7b25d47fd11ca799e1569464c7db15ba1e5d697b4b41f2bee4bde2b3da912ad52f3bcb1d3578a904176d0b12f7d5cf70ed79bb11e0ef37beb
-
/storage/emulated/0/Config/sys/apps/log/log-2023-11-01.txtFilesize
25B
MD5ba30336bf53d54ed3c0ea69dd545de8c
SHA1ce99c6724c75b93b7448e2d9fac16ca702a5711f
SHA2562d6988fb5afdaafc4e33fa1f71d6f10c95ab5a49a8ec820add5b13eef05439af
SHA512eea34ca526e03349e746d3687ea660b4748f0174fe2ffdb65161e232e08630b345e03329614852ce881a71362ba68575e9dd08fa361a416e5b2fb231e21a0a3e
-
/storage/emulated/0/Config/sys/apps/log/log-2023-11-01.txtFilesize
288B
MD551e9a0026c40452e6ab151434c49dcac
SHA1bbd94a69f871fac4ad723a5e6c2edbb7896f3fc5
SHA25644c93731066fe11d9fdcfe69c51534cdc1ec6db658cd3f02cb7be372f8136011
SHA512c4f9acb26d540b6e61fdff9cb945ce620adb1865e006c24583b7dab2dad9b57f9ace592b7ab65866e7e3b25df1ce8fae9bac40f1c47ba72c4cae40a5b2bd6fb8