8b40f38ef88d8b221638084941c670ca988422d73fe6977fabe7cefc5c3f2bb3

Analysis

max time kernel
1844953s
max time network
158s
platform
android_x86
resource
android-x86-arm-20231215-en
resource tags

androidarch:armarch:x86image:android-x86-arm-20231215-enlocale:en-usos:android-9-x86system
submitted
15-12-2023 14:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

app1702415552369.apk
Size

4.4MB
MD5

5862b0fd34988e9988a53c088efd87d9
SHA1

81b567e2d335b646847a3fd0301c1d9b42b3d5df
SHA256

8b40f38ef88d8b221638084941c670ca988422d73fe6977fabe7cefc5c3f2bb3
SHA512

0d73e1041df6d418890a24acad661a268de24b47e61488cfaa83f9e5e5fa1720a5808b20d5ae5a6158e10082c3f297c39bd9fb1cf94884c197e597babb027d9a
SSDEEP

98304:ss1/Yhh5nq/MUHMDHmTIhbmzzzBoGTg0tcnp/H:f1AT5q/pHChKzamLcd

Score

8^/10

Malware Config

Signatures

Makes use of the framework's Accessibility service 1 IoCs

Retrieves information displayed on the phone screen using AccessibilityService.

Processes:

com.google.ccleaneer

description	ioc	process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	com.google.ccleaneer

Acquires the wake lock 1 IoCs

Processes:

com.google.ccleaneer

description ioc process

Framework service call android.os.IPowerManager.acquireWakeLock com.google.ccleaneer
Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

description	ioc	process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.google.ccleaneer

com.google.ccleaneer
1⤵
- Makes use of the framework's Accessibility service
- Acquires the wake lock
PID:4258

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Web Service

T1102

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

/storage/emulated/0/Config/sys/apps/log/log-2023-12-15.txt
Filesize
13B

MD5
de2c41a51ee9246eb1708f65b511add0

SHA1
2f442d634c8a18760a232c8829d4b5d74a52f074

SHA256
ad2d914ca347cd1930e32f21c6d5448c34104bea181b93abc85ec518985653ab

SHA512
7cdfbd001594503644e9ed80ae852f90ef9e841a8382e2eec6979e149a2c400a3b83055d205b4d1d66e1600e5127482932d5127eb5800d35a4ee5673fe34d84a

Download Submit
/storage/emulated/0/Config/sys/apps/log/log-2023-12-15.txt
Filesize
37B

MD5
84a6562d6485d49f5e6484a9d61d41f2

SHA1
4ca82734512477bd56848261053078005b26d390

SHA256
61db75da7e19be9f3082aed810acbecfd27eda2b4278bc3fab7cb4f493f07bab

SHA512
38a7d916a0223ae3202e72e8eadf055b93e8e7a9dde2c025926731694bc0d70505ce251e41ea8ae209539ad9732b9a6060a3b1f3501f2410f25989bffd64a748

Download Submit
/storage/emulated/0/Config/sys/apps/log/log-2023-12-15.txt
Filesize
37B

MD5
e32f1c7bc0a8a4d2ba1a9228f6adfb4d

SHA1
5a71816db6e84a65149fce7246c80068eb581932

SHA256
e395f518b6a28f4e3fe5d2e4b622720354671c145ec35fbe68fb3d85033a1c7a

SHA512
8fc4da4ef4ef79c891109ee632fa5f5a0fef5555eeed6213aff710f40a353d575c0a3a97e4b0f61b91f8b51f9fce8671ce1d7ccf48fe7c9be7efd08814b667b0

Download Submit
/storage/emulated/0/Config/sys/apps/log/log-2023-12-15.txt
Filesize
45B

MD5
45e2ab16ebb21ad2d1b0562a1437b51f

SHA1
2b43e7f69e20ea5e5b362bd19a5b748fee3c58e3

SHA256
a0fea29f2f19a52e25817127f0e795e7b1aaf09bacc5a4b29b385d41b37ef79d

SHA512
713200e2add7561c6f636de56140499fd52883055b8f0e59a7ba4aa20a302fd991d25dfde4b4448b2dad801b9b2c18a2aa11c42410fa1a36e5293d94fc643fe6

Download Submit