8b40f38ef88d8b221638084941c670ca988422d73fe6977fabe7cefc5c3f2bb3

Analysis

max time kernel
1843842s
max time network
161s
platform
android_x64
resource
android-x64-20231215-en
resource tags

androidarch:x64arch:x86image:android-x64-20231215-enlocale:en-usos:android-10-x64system
submitted
15-12-2023 14:31

Target

app1702415552369.apk
Size

4.4MB
MD5

5862b0fd34988e9988a53c088efd87d9
SHA1

81b567e2d335b646847a3fd0301c1d9b42b3d5df
SHA256

8b40f38ef88d8b221638084941c670ca988422d73fe6977fabe7cefc5c3f2bb3
SHA512

0d73e1041df6d418890a24acad661a268de24b47e61488cfaa83f9e5e5fa1720a5808b20d5ae5a6158e10082c3f297c39bd9fb1cf94884c197e597babb027d9a
SSDEEP

98304:ss1/Yhh5nq/MUHMDHmTIhbmzzzBoGTg0tcnp/H:f1AT5q/pHChKzamLcd

Score

8^/10

Makes use of the framework's Accessibility service 1 IoCs

Retrieves information displayed on the phone screen using AccessibilityService.

Processes:

com.google.ccleaneer

description	ioc	process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	com.google.ccleaneer

Acquires the wake lock 1 IoCs

Processes:

com.google.ccleaneer

description ioc process

Framework service call android.os.IPowerManager.acquireWakeLock com.google.ccleaneer
Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

description	ioc	process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.google.ccleaneer

com.google.ccleaneer
1⤵
- Makes use of the framework's Accessibility service
- Acquires the wake lock
PID:5079

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Web Service

Impact

Resource Development

Reconnaissance

/storage/emulated/0/Config/sys/apps/log/log-2023-12-15.txt
Filesize
13B

MD5
de2c41a51ee9246eb1708f65b511add0

SHA1
2f442d634c8a18760a232c8829d4b5d74a52f074

SHA256
ad2d914ca347cd1930e32f21c6d5448c34104bea181b93abc85ec518985653ab

SHA512
7cdfbd001594503644e9ed80ae852f90ef9e841a8382e2eec6979e149a2c400a3b83055d205b4d1d66e1600e5127482932d5127eb5800d35a4ee5673fe34d84a

Download Submit
/storage/emulated/0/Config/sys/apps/log/log-2023-12-15.txt
Filesize
37B

MD5
e32f1c7bc0a8a4d2ba1a9228f6adfb4d

SHA1
5a71816db6e84a65149fce7246c80068eb581932

SHA256
e395f518b6a28f4e3fe5d2e4b622720354671c145ec35fbe68fb3d85033a1c7a

SHA512
8fc4da4ef4ef79c891109ee632fa5f5a0fef5555eeed6213aff710f40a353d575c0a3a97e4b0f61b91f8b51f9fce8671ce1d7ccf48fe7c9be7efd08814b667b0

Download Submit
/storage/emulated/0/Config/sys/apps/log/log-2023-12-15.txt
Filesize
25B

MD5
bdb821a955117250611e94cd23842584

SHA1
81edcea1b44f94cfc140710c8410d0696b760c67

SHA256
076eb89055ff3d929eb732e1002a0105652e628682a741151388ce1df3b6ec9d

SHA512
e52ffed4ee84acc414c530c239c8876d9e99c1f2b2c7626c0ed7fbe0c59b9cb8f8a5e9e983541bea3dfdb849dd3b9593df054c2482ed8bcda7c70ebd960ca268

Download Submit