Analysis
-
max time kernel
1843840s -
max time network
160s -
platform
android_x64 -
resource
android-x64-arm64-20231215-en -
resource tags
androidarch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20231215-enlocale:en-usos:android-11-x64system -
submitted
15-12-2023 14:31
Behavioral task
behavioral1
Sample
app1702415552369.apk
Resource
android-x86-arm-20231215-en
Behavioral task
behavioral2
Sample
app1702415552369.apk
Resource
android-x64-20231215-en
Behavioral task
behavioral3
Sample
app1702415552369.apk
Resource
android-x64-arm64-20231215-en
General
-
Target
app1702415552369.apk
-
Size
4.4MB
-
MD5
5862b0fd34988e9988a53c088efd87d9
-
SHA1
81b567e2d335b646847a3fd0301c1d9b42b3d5df
-
SHA256
8b40f38ef88d8b221638084941c670ca988422d73fe6977fabe7cefc5c3f2bb3
-
SHA512
0d73e1041df6d418890a24acad661a268de24b47e61488cfaa83f9e5e5fa1720a5808b20d5ae5a6158e10082c3f297c39bd9fb1cf94884c197e597babb027d9a
-
SSDEEP
98304:ss1/Yhh5nq/MUHMDHmTIhbmzzzBoGTg0tcnp/H:f1AT5q/pHChKzamLcd
Malware Config
Signatures
-
Makes use of the framework's Accessibility service 1 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
Processes:
com.google.ccleaneerdescription ioc process Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId com.google.ccleaneer -
Acquires the wake lock 1 IoCs
Processes:
com.google.ccleaneerdescription ioc process Framework service call android.os.IPowerManager.acquireWakeLock com.google.ccleaneer -
Legitimate hosting services abused for malware hosting/C2 1 TTPs
Processes
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
/storage/emulated/0/Config/sys/apps/log/log-2023-12-15.txtFilesize
13B
MD5de2c41a51ee9246eb1708f65b511add0
SHA12f442d634c8a18760a232c8829d4b5d74a52f074
SHA256ad2d914ca347cd1930e32f21c6d5448c34104bea181b93abc85ec518985653ab
SHA5127cdfbd001594503644e9ed80ae852f90ef9e841a8382e2eec6979e149a2c400a3b83055d205b4d1d66e1600e5127482932d5127eb5800d35a4ee5673fe34d84a
-
/storage/emulated/0/Config/sys/apps/log/log-2023-12-15.txtFilesize
37B
MD5e32f1c7bc0a8a4d2ba1a9228f6adfb4d
SHA15a71816db6e84a65149fce7246c80068eb581932
SHA256e395f518b6a28f4e3fe5d2e4b622720354671c145ec35fbe68fb3d85033a1c7a
SHA5128fc4da4ef4ef79c891109ee632fa5f5a0fef5555eeed6213aff710f40a353d575c0a3a97e4b0f61b91f8b51f9fce8671ce1d7ccf48fe7c9be7efd08814b667b0
-
/storage/emulated/0/Config/sys/apps/log/log-2023-12-15.txtFilesize
45B
MD545e2ab16ebb21ad2d1b0562a1437b51f
SHA12b43e7f69e20ea5e5b362bd19a5b748fee3c58e3
SHA256a0fea29f2f19a52e25817127f0e795e7b1aaf09bacc5a4b29b385d41b37ef79d
SHA512713200e2add7561c6f636de56140499fd52883055b8f0e59a7ba4aa20a302fd991d25dfde4b4448b2dad801b9b2c18a2aa11c42410fa1a36e5293d94fc643fe6