f2acb6740791e15b8086de7c0bb6ee90f2e00bab5bed6dc82b81684b40b83deb

Analysis

max time kernel
621285s
max time network
163s
platform
android_x64
resource
android-x64-20231023.1-en
resource tags

androidarch:x64arch:x86image:android-x64-20231023.1-enlocale:en-usos:android-10-x64system
submitted
01-12-2023 10:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ready-2.apk
Size

2.7MB
MD5

6dde5d8fa11308ceef69e4fb2a2309ae
SHA1

da48756f5b41c954e9532e4a8c99091b65ac83fc
SHA256

f2acb6740791e15b8086de7c0bb6ee90f2e00bab5bed6dc82b81684b40b83deb
SHA512

371843d98087e938745b3ea9a50bd21b590c3737c98d55c17315e96bf16140a4bad487426b30154cf5b8a5539525517366b929fe9fd24f4574ed40f5849f9c60
SSDEEP

49152:ebF1MIp8lMlTRaJdSIjAfZOb29BKN9dALbQ7R4ChN/3IKadGGD4aIzkq8Deix9n:ebF7p86lNauU6ZOb290GLbdChVGD4aIM

Score

8^/10

discovery evasion

Malware Config

Signatures

Makes use of the framework's Accessibility service. 2 IoCs

Processes:

heel.hamburg.garbage

description	ioc	process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	heel.hamburg.garbage
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId	heel.hamburg.garbage

Acquires the wake lock. 1 IoCs

Processes:

heel.hamburg.garbage

description ioc process

Framework service call android.os.IPowerManager.acquireWakeLock heel.hamburg.garbage
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046
Removes a system notification. 1 IoCs
evasion

Processes:

heel.hamburg.garbage

description ioc process

Framework service call android.app.INotificationManager.cancelNotificationWithTag heel.hamburg.garbage

description	ioc	process
Framework service call	android.os.IPowerManager.acquireWakeLock	heel.hamburg.garbage

description	ioc	process
Framework service call	android.app.INotificationManager.cancelNotificationWithTag	heel.hamburg.garbage

heel.hamburg.garbage
1⤵
- Makes use of the framework's Accessibility service.
- Acquires the wake lock.
- Removes a system notification.
PID:5047

heel.hamburg.garbage:remote
1⤵
PID:5452

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Service Discovery

T1046

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

/storage/emulated/0/Config/sys/apps/log/log-2023-12-01.txt
Filesize
21B

MD5
506a7cef3439687f2492547ae9796d21

SHA1
92efec9c6046e13eba06c1f3e04307df74252c38

SHA256
56e86e5c9709e621f73c7edc225f8ad49b80ef8e6043f1b9da672824bb07de6f

SHA512
4a2458ee608c4f4aaeb1e2f05188ffc8c9be470962e5e072dff596bfb2d8c2011115aca8af0e64e2e9ae56d056b814d856374504d283aaf6b8a9506cfc818d6b

Download Submit
/storage/emulated/0/Config/sys/apps/log/log-2023-12-01.txt
Filesize
21B

MD5
544c05cc3a9c078e78461aefaee235d6

SHA1
decb925c99afd185d8f28e251b48f121a2766163

SHA256
1aecbd0b366377ea3f52377762e4683938b011f31398b31ca0325e20133189fd

SHA512
ad869ed7967d93c0d5bc313d5f7079af5fc2e167e1e17d6a840d11c53a7fc54458e54a82cb3943cb1de3c5ead4d6b1be4645baee80a7e1d8d72def909977facb

Download Submit
/storage/emulated/0/Config/sys/apps/log/log-2023-12-01.txt
Filesize
57B

MD5
a9ec0c42a43c72d73c499e5c17ccbb8b

SHA1
731652fbfe61eac3fdb4b9d3e2eaa010848a0906

SHA256
6c5309ce3f31c9af3288b0de3305b7f5ddee97be60ca4ac1184f3c334480c05b

SHA512
5f8ed24a51f68cfa0627aceb9190d3a7febaee61bd5a89898ab113ddaa7ce2a41f129a28c4e200d5e5e4ddff7a483abc0393dc38e870782caf1c46d2ec0df2e3

Download Submit
/storage/emulated/0/Config/sys/apps/log/log-2023-12-01.txt
Filesize
33B

MD5
365f074d64faad2f0f0c7784608e5b57

SHA1
2105b80d01621cbd370bec93f73709a7b67d565b

SHA256
0c4662ed55fc03738e7903864ed0249c921b8f2d858531577eebd53501237cc4

SHA512
d29b5c16d10a78b386ba1f4882f7e80bc6d41887671abe6a36c746b015ea280d4a26f3d2af323b4ad755c256e5851a5b95d0bda8882c6c0a2c125bc748fab47a

Download Submit
/storage/emulated/0/Config/sys/apps/log/log-2023-12-01.txt
Filesize
276B

MD5
a6f4e8ce4a3f8cb838b5e47cffaebd9a

SHA1
3c89701a52942636f2bb8d1a2b341690eaddfc05

SHA256
66161df8e01c3be39ca41d395366bd8ca3ae4040cfbdaab17ac6b17aaa829a2c

SHA512
4b4f40368982484d6bd68d3712454904c6ed9b884916a1f44a74850a1b4e98b28b9dd233eefae2f310c61ebfbcddaaf9e055746d1414bf869d96bd93c12b836b

Download Submit