2a42a44c6b0365ec61f9bad779498ab4fb8966b926675c375318e5b5917ec4cc

Resubmissions

30-11-2023 18:27

231130-w3vmksga3z 10

30-11-2023 18:24

231130-w16xtsfg85 10

30-11-2023 18:20

231130-wy3sdsfg73 10

Analysis

max time kernel
561895s
max time network
309s
platform
android_x64
resource
android-x64-20231023.1-en
resource tags

androidarch:x64arch:x86image:android-x64-20231023.1-enlocale:en-usos:android-10-x64system
submitted
30-11-2023 18:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ready.apk
Size

6.2MB
MD5

8f28dd6d20a970276161c01af8e71c3f
SHA1

0860d9daa5e444d98b4fd71e19180aa9dfd509df
SHA256

2a42a44c6b0365ec61f9bad779498ab4fb8966b926675c375318e5b5917ec4cc
SHA512

7110916da8ff62eb143a02e167e48b8ddeaf861c467887dc3b37e062dc790b657591138aa02ae07940e35ae224ef0829982a6252e9545b3c6d981735ca1a919c
SSDEEP

24576:swcNfGM6TzZi7nzUdql6XlQhlOiDvVVVVVVAk3I/sHp9E:swcNfGMU6nz1l6XlelOiDISHE

Score

8^/10

banker evasion

Malware Config

Signatures

Makes use of the framework's Accessibility service. 3 IoCs

Processes:

rick.gay.gay

description	ioc	process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	rick.gay.gay
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByText	rick.gay.gay
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId	rick.gay.gay

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps). 1 IoCs
banker

Processes:

rick.gay.gay

description ioc process

Framework service call android.content.pm.IPackageManager.getInstalledApplications rick.gay.gay
Acquires the wake lock. 1 IoCs

Processes:

rick.gay.gay

description ioc process

Framework service call android.os.IPowerManager.acquireWakeLock rick.gay.gay
Removes a system notification. 1 IoCs
evasion

Processes:

rick.gay.gay

description ioc process

Framework service call android.app.INotificationManager.cancelNotificationWithTag rick.gay.gay

description	ioc	process
Framework service call	android.content.pm.IPackageManager.getInstalledApplications	rick.gay.gay

description	ioc	process
Framework service call	android.os.IPowerManager.acquireWakeLock	rick.gay.gay

description	ioc	process
Framework service call	android.app.INotificationManager.cancelNotificationWithTag	rick.gay.gay

rick.gay.gay
1⤵
- Makes use of the framework's Accessibility service.
- Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps).
- Acquires the wake lock.
- Removes a system notification.
PID:5112

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

/storage/emulated/0/Config/sys/apps/log/log-2023-11-30.txt
Filesize
25B

MD5
85b4c252809b9899cf6be860fb9a4541

SHA1
c42b6303c084f7b09c5a0317baab6e31809457c8

SHA256
3c1a9da0392a897717cd2c9e434922b3f37aeec6ab72f58c7a88e51c317a5fc5

SHA512
7e936c55c757ae3fab84fed325d3902083825db621a56f16ae64a534b838271259963b69888dceb82b4483dce7e1099271025c69e88f541627a5b917c6a3f1d4

Download Submit
/storage/emulated/0/Config/sys/apps/log/log-2023-11-30.txt
Filesize
25B

MD5
ba30336bf53d54ed3c0ea69dd545de8c

SHA1
ce99c6724c75b93b7448e2d9fac16ca702a5711f

SHA256
2d6988fb5afdaafc4e33fa1f71d6f10c95ab5a49a8ec820add5b13eef05439af

SHA512
eea34ca526e03349e746d3687ea660b4748f0174fe2ffdb65161e232e08630b345e03329614852ce881a71362ba68575e9dd08fa361a416e5b2fb231e21a0a3e

Download Submit
/storage/emulated/0/Config/sys/apps/log/log-2023-11-30.txt
Filesize
41B

MD5
17bb0d2cff90937b4ca49925e634a013

SHA1
d53024904529a3a4696314f2215c507b377de022

SHA256
8a11ed8c82683c013d80564e6ae56fc47510cc7fa953ee42fd46f0d2215cce3e

SHA512
4b76ee0f44f7f6ac4c346f4ef83eaa430c93c227cec9c6a99caa41e4a2fd702120fc73741071d73c84798426aef49133d0de9e238229d7d4ba5e5ebe26c1db74

Download Submit
/storage/emulated/0/Config/sys/apps/log/log-2023-11-30.txt
Filesize
25B

MD5
ba30336bf53d54ed3c0ea69dd545de8c

SHA1
ce99c6724c75b93b7448e2d9fac16ca702a5711f

SHA256
2d6988fb5afdaafc4e33fa1f71d6f10c95ab5a49a8ec820add5b13eef05439af

SHA512
eea34ca526e03349e746d3687ea660b4748f0174fe2ffdb65161e232e08630b345e03329614852ce881a71362ba68575e9dd08fa361a416e5b2fb231e21a0a3e

Download Submit
/storage/emulated/0/Config/sys/apps/log/log-2023-11-30.txt
Filesize
280B

MD5
78e7597de3775c41bd4369d6f4a746c1

SHA1
50826a6d730052312e64a96ccbab52c912d2063f

SHA256
3bd0025d02ccf942ab3499ae928e0c1872228e91630ed955df03050084bd6b47

SHA512
41fba5cc5d2b52ed552518ea0a10de0d2199114581a1e340937a1fe1f9f5a8e2be7e71fad1eb936d651058670f38bce02892c2f9db022ff88975e875099b4ccf

Download Submit