Analysis
-
max time kernel
1844921s -
max time network
127s -
platform
android_x64 -
resource
android-x64-20231215-en -
resource tags
androidarch:x64arch:x86image:android-x64-20231215-enlocale:en-usos:android-10-x64system -
submitted
15-12-2023 14:50
Behavioral task
behavioral1
Sample
app1702415552369.apk
Resource
android-x86-arm-20231215-en
Behavioral task
behavioral2
Sample
app1702415552369.apk
Resource
android-x64-20231215-en
Behavioral task
behavioral3
Sample
app1702415552369.apk
Resource
android-x64-arm64-20231215-en
General
-
Target
app1702415552369.apk
-
Size
4.4MB
-
MD5
5862b0fd34988e9988a53c088efd87d9
-
SHA1
81b567e2d335b646847a3fd0301c1d9b42b3d5df
-
SHA256
8b40f38ef88d8b221638084941c670ca988422d73fe6977fabe7cefc5c3f2bb3
-
SHA512
0d73e1041df6d418890a24acad661a268de24b47e61488cfaa83f9e5e5fa1720a5808b20d5ae5a6158e10082c3f297c39bd9fb1cf94884c197e597babb027d9a
-
SSDEEP
98304:ss1/Yhh5nq/MUHMDHmTIhbmzzzBoGTg0tcnp/H:f1AT5q/pHChKzamLcd
Malware Config
Signatures
-
Makes use of the framework's Accessibility service 1 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
Processes:
com.google.ccleaneerdescription ioc process Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId com.google.ccleaneer -
Acquires the wake lock 1 IoCs
Processes:
com.google.ccleaneerdescription ioc process Framework service call android.os.IPowerManager.acquireWakeLock com.google.ccleaneer -
Legitimate hosting services abused for malware hosting/C2 1 TTPs
Processes
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
/storage/emulated/0/Config/sys/apps/log/log-2023-12-15.txtFilesize
13B
MD5de2c41a51ee9246eb1708f65b511add0
SHA12f442d634c8a18760a232c8829d4b5d74a52f074
SHA256ad2d914ca347cd1930e32f21c6d5448c34104bea181b93abc85ec518985653ab
SHA5127cdfbd001594503644e9ed80ae852f90ef9e841a8382e2eec6979e149a2c400a3b83055d205b4d1d66e1600e5127482932d5127eb5800d35a4ee5673fe34d84a
-
/storage/emulated/0/Config/sys/apps/log/log-2023-12-15.txtFilesize
37B
MD5e32f1c7bc0a8a4d2ba1a9228f6adfb4d
SHA15a71816db6e84a65149fce7246c80068eb581932
SHA256e395f518b6a28f4e3fe5d2e4b622720354671c145ec35fbe68fb3d85033a1c7a
SHA5128fc4da4ef4ef79c891109ee632fa5f5a0fef5555eeed6213aff710f40a353d575c0a3a97e4b0f61b91f8b51f9fce8671ce1d7ccf48fe7c9be7efd08814b667b0
-
/storage/emulated/0/Config/sys/apps/log/log-2023-12-15.txtFilesize
25B
MD5bdb821a955117250611e94cd23842584
SHA181edcea1b44f94cfc140710c8410d0696b760c67
SHA256076eb89055ff3d929eb732e1002a0105652e628682a741151388ce1df3b6ec9d
SHA512e52ffed4ee84acc414c530c239c8876d9e99c1f2b2c7626c0ed7fbe0c59b9cb8f8a5e9e983541bea3dfdb849dd3b9593df054c2482ed8bcda7c70ebd960ca268