2a42a44c6b0365ec61f9bad779498ab4fb8966b926675c375318e5b5917ec4cc

Resubmissions

30-11-2023 18:27

231130-w3vmksga3z 10

30-11-2023 18:24

231130-w16xtsfg85 10

30-11-2023 18:20

231130-wy3sdsfg73 10

Analysis

max time kernel
561561s
max time network
162s
platform
android_x64
resource
android-x64-arm64-20231023-en
resource tags

androidarch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20231023-enlocale:en-usos:android-11-x64system
submitted
30-11-2023 18:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ready.apk
Size

6.2MB
MD5

8f28dd6d20a970276161c01af8e71c3f
SHA1

0860d9daa5e444d98b4fd71e19180aa9dfd509df
SHA256

2a42a44c6b0365ec61f9bad779498ab4fb8966b926675c375318e5b5917ec4cc
SHA512

7110916da8ff62eb143a02e167e48b8ddeaf861c467887dc3b37e062dc790b657591138aa02ae07940e35ae224ef0829982a6252e9545b3c6d981735ca1a919c
SSDEEP

24576:swcNfGM6TzZi7nzUdql6XlQhlOiDvVVVVVVAk3I/sHp9E:swcNfGMU6nz1l6XlelOiDISHE

Score

8^/10

banker evasion

Malware Config

Signatures

Makes use of the framework's Accessibility service. 3 IoCs

Processes:

rick.gay.gay

description	ioc	process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	rick.gay.gay
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByText	rick.gay.gay
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId	rick.gay.gay

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps). 1 IoCs
banker

Processes:

rick.gay.gay

description ioc process

Framework service call android.content.pm.IPackageManager.getInstalledApplications rick.gay.gay
Acquires the wake lock. 1 IoCs

Processes:

rick.gay.gay

description ioc process

Framework service call android.os.IPowerManager.acquireWakeLock rick.gay.gay
Tries to add a device administrator. 1 IoCs

Processes:

rick.gay.gay

description ioc process

Intent action android.app.action.ADD_DEVICE_ADMIN rick.gay.gay
Requests disabling of battery optimizations (often used to enable hiding in the background). 1 IoCs
evasion

Processes:

rick.gay.gay

description ioc process

Intent action android.settings.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS rick.gay.gay
Removes a system notification. 1 IoCs
evasion

Processes:

rick.gay.gay

description ioc process

Framework service call android.app.INotificationManager.cancelNotificationWithTag rick.gay.gay

description	ioc	process
Framework service call	android.content.pm.IPackageManager.getInstalledApplications	rick.gay.gay

description	ioc	process
Framework service call	android.os.IPowerManager.acquireWakeLock	rick.gay.gay

description	ioc	process
Intent action	android.app.action.ADD_DEVICE_ADMIN	rick.gay.gay

description	ioc	process
Intent action	android.settings.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS	rick.gay.gay

description	ioc	process
Framework service call	android.app.INotificationManager.cancelNotificationWithTag	rick.gay.gay

rick.gay.gay
1⤵
- Makes use of the framework's Accessibility service.
- Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps).
- Acquires the wake lock.
- Tries to add a device administrator.
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Removes a system notification.
PID:4428

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

/storage/emulated/0/Config/sys/apps/log/log-2023-11-30.txt
Filesize
25B

MD5
85b4c252809b9899cf6be860fb9a4541

SHA1
c42b6303c084f7b09c5a0317baab6e31809457c8

SHA256
3c1a9da0392a897717cd2c9e434922b3f37aeec6ab72f58c7a88e51c317a5fc5

SHA512
7e936c55c757ae3fab84fed325d3902083825db621a56f16ae64a534b838271259963b69888dceb82b4483dce7e1099271025c69e88f541627a5b917c6a3f1d4

Download Submit
/storage/emulated/0/Config/sys/apps/log/log-2023-11-30.txt
Filesize
25B

MD5
ba30336bf53d54ed3c0ea69dd545de8c

SHA1
ce99c6724c75b93b7448e2d9fac16ca702a5711f

SHA256
2d6988fb5afdaafc4e33fa1f71d6f10c95ab5a49a8ec820add5b13eef05439af

SHA512
eea34ca526e03349e746d3687ea660b4748f0174fe2ffdb65161e232e08630b345e03329614852ce881a71362ba68575e9dd08fa361a416e5b2fb231e21a0a3e

Download Submit
/storage/emulated/0/Config/sys/apps/log/log-2023-11-30.txt
Filesize
41B

MD5
17bb0d2cff90937b4ca49925e634a013

SHA1
d53024904529a3a4696314f2215c507b377de022

SHA256
8a11ed8c82683c013d80564e6ae56fc47510cc7fa953ee42fd46f0d2215cce3e

SHA512
4b76ee0f44f7f6ac4c346f4ef83eaa430c93c227cec9c6a99caa41e4a2fd702120fc73741071d73c84798426aef49133d0de9e238229d7d4ba5e5ebe26c1db74

Download Submit
/storage/emulated/0/Config/sys/apps/log/log-2023-11-30.txt
Filesize
25B

MD5
f5136e39c0df62c9d822f991f54b5f3f

SHA1
e08535252fc82d48b493150f06778ba90dbcff7c

SHA256
93d746f89ad76f413a7e7503a4d744b2e82439a85ca2f159108456da26ae7853

SHA512
31210d52fb1840165da63a033f270e623e0530f626880cc54bae6544556fe3e234826bae19cddc786b2eec5fbfc3b5d7e651ae03bed87ae720308055258bd590

Download Submit
/storage/emulated/0/Config/sys/apps/log/log-2023-11-30.txt
Filesize
280B

MD5
b86781ca4b40ff0b57bd06e218cbfe45

SHA1
7b89acb535f3ac1edbc0c1cb3ff37dd833204166

SHA256
6e6e592782d3a587524e7bed14557af56f737970464aaa33b00a56649b83e941

SHA512
570e0d250bf8973b304cb3c885c18761115c7c2246bf11d9306dffc42858e26d8b51b98717adefccef96fabe59c942bb0af791a44c37f80aaeeaf736c78c96ed

Download Submit