Analysis
-
max time kernel
1844952s -
max time network
159s -
platform
android_x64 -
resource
android-x64-arm64-20231215-en -
resource tags
androidarch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20231215-enlocale:en-usos:android-11-x64system -
submitted
15-12-2023 14:50
Behavioral task
behavioral1
Sample
app1702415552369.apk
Resource
android-x86-arm-20231215-en
Behavioral task
behavioral2
Sample
app1702415552369.apk
Resource
android-x64-20231215-en
Behavioral task
behavioral3
Sample
app1702415552369.apk
Resource
android-x64-arm64-20231215-en
General
-
Target
app1702415552369.apk
-
Size
4.4MB
-
MD5
5862b0fd34988e9988a53c088efd87d9
-
SHA1
81b567e2d335b646847a3fd0301c1d9b42b3d5df
-
SHA256
8b40f38ef88d8b221638084941c670ca988422d73fe6977fabe7cefc5c3f2bb3
-
SHA512
0d73e1041df6d418890a24acad661a268de24b47e61488cfaa83f9e5e5fa1720a5808b20d5ae5a6158e10082c3f297c39bd9fb1cf94884c197e597babb027d9a
-
SSDEEP
98304:ss1/Yhh5nq/MUHMDHmTIhbmzzzBoGTg0tcnp/H:f1AT5q/pHChKzamLcd
Malware Config
Signatures
-
Makes use of the framework's Accessibility service 1 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
Processes:
com.google.ccleaneerdescription ioc process Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId com.google.ccleaneer -
Acquires the wake lock 1 IoCs
Processes:
com.google.ccleaneerdescription ioc process Framework service call android.os.IPowerManager.acquireWakeLock com.google.ccleaneer -
Legitimate hosting services abused for malware hosting/C2 1 TTPs
Processes
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
/storage/emulated/0/Config/sys/apps/log/log-2023-12-15.txtFilesize
13B
MD5de2c41a51ee9246eb1708f65b511add0
SHA12f442d634c8a18760a232c8829d4b5d74a52f074
SHA256ad2d914ca347cd1930e32f21c6d5448c34104bea181b93abc85ec518985653ab
SHA5127cdfbd001594503644e9ed80ae852f90ef9e841a8382e2eec6979e149a2c400a3b83055d205b4d1d66e1600e5127482932d5127eb5800d35a4ee5673fe34d84a
-
/storage/emulated/0/Config/sys/apps/log/log-2023-12-15.txtFilesize
37B
MD584a6562d6485d49f5e6484a9d61d41f2
SHA14ca82734512477bd56848261053078005b26d390
SHA25661db75da7e19be9f3082aed810acbecfd27eda2b4278bc3fab7cb4f493f07bab
SHA51238a7d916a0223ae3202e72e8eadf055b93e8e7a9dde2c025926731694bc0d70505ce251e41ea8ae209539ad9732b9a6060a3b1f3501f2410f25989bffd64a748
-
/storage/emulated/0/Config/sys/apps/log/log-2023-12-15.txtFilesize
37B
MD5e32f1c7bc0a8a4d2ba1a9228f6adfb4d
SHA15a71816db6e84a65149fce7246c80068eb581932
SHA256e395f518b6a28f4e3fe5d2e4b622720354671c145ec35fbe68fb3d85033a1c7a
SHA5128fc4da4ef4ef79c891109ee632fa5f5a0fef5555eeed6213aff710f40a353d575c0a3a97e4b0f61b91f8b51f9fce8671ce1d7ccf48fe7c9be7efd08814b667b0