Analysis
-
max time kernel
987529s -
max time network
151s -
platform
android_x86 -
resource
android-x86-arm-20231023-en -
resource tags
androidarch:armarch:x86image:android-x86-arm-20231023-enlocale:en-usos:android-9-x86system -
submitted
05-12-2023 16:40
Behavioral task
behavioral1
Sample
ready.apk
Resource
android-x86-arm-20231023-en
Behavioral task
behavioral2
Sample
ready.apk
Resource
android-x64-20231023.1-en
Behavioral task
behavioral3
Sample
ready.apk
Resource
android-x64-arm64-20231023-en
General
-
Target
ready.apk
-
Size
8.6MB
-
MD5
63e1a96e44c538e64c4101b3efa06def
-
SHA1
a96e35c5c6a11cc74e29af2d2d52438868ab6021
-
SHA256
d6157f0e95d779e71313b68616c0b55330ab639d39e4e142e51ef1cd957fabd9
-
SHA512
b6cace864a2162a94c7229b7bffbe6fd4950f63f58f23978052ed1b96ca1395b8c578e0d4ff76ed877183f68a1fca72201c77a12d42ed429aed13fbf165498f2
-
SSDEEP
98304:wWekjTjdiEunideI1N2mzDzB4TG0tcsfCCB:wWjvFBzeNOCB
Malware Config
Signatures
-
Makes use of the framework's Accessibility service. 1 IoCs
Processes:
diploma.situated.ceilingdescription ioc process Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId diploma.situated.ceiling -
Acquires the wake lock. 1 IoCs
Processes:
diploma.situated.ceilingdescription ioc process Framework service call android.os.IPowerManager.acquireWakeLock diploma.situated.ceiling -
Requests disabling of battery optimizations (often used to enable hiding in the background). 1 IoCs
Processes:
diploma.situated.ceilingdescription ioc process Intent action android.settings.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS diploma.situated.ceiling -
Removes a system notification. 1 IoCs
Processes:
diploma.situated.ceilingdescription ioc process Framework service call android.app.INotificationManager.cancelNotificationWithTag diploma.situated.ceiling
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
/storage/emulated/0/Config/sys/apps/log/log-2023-12-05.txtFilesize
53B
MD53bf7cf538ec7caa655b3867a6cef6af6
SHA1ad8f260e8020a387bae89ff5c5697ee6d9626f28
SHA256f59c01e7c2d80cfbf0258bde1a34c279c6482be670c0966cac098f5f66f844a9
SHA512911ede096265f8feabcf0a76bffb502f95008992b82a2ef0605d47532e37634d6691d22c61ae962ca60bd4210e6e440099678d9f8f1c3b814d24f03bfa2deabc