Analysis
-
max time kernel
3601211s -
max time network
150s -
platform
android_x64 -
resource
android-x64-arm64-20231215-en -
resource tags
androidarch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20231215-enlocale:en-usos:android-11-x64system -
submitted
04/01/2024, 22:41
Static task
static1
Behavioral task
behavioral1
Sample
421854095f7a5fe7ec08ef2d72407817.apk
Resource
android-x86-arm-20231215-en
Behavioral task
behavioral2
Sample
421854095f7a5fe7ec08ef2d72407817.apk
Resource
android-x64-20231215-en
Behavioral task
behavioral3
Sample
421854095f7a5fe7ec08ef2d72407817.apk
Resource
android-x64-arm64-20231215-en
General
-
Target
421854095f7a5fe7ec08ef2d72407817.apk
-
Size
1.4MB
-
MD5
421854095f7a5fe7ec08ef2d72407817
-
SHA1
2d12f8c136a7a335dbed0f45230f72cd530b737a
-
SHA256
2e93c8783b8a635e1ba346a7c952cf13a84b47cd9d9912e45ec1d9b4f61c3cfd
-
SHA512
eca2b4a5560d9874be2b3ca77d43844e67179936a5a3c82f6d4724f065ccbfe8890a55af8e5685f42f35339f9dbae3fed721a114369bc7681338bfd083c27296
-
SSDEEP
24576:6fU9O7jL6q0OzM4XEa/Zmk3VoSaddJF1soIi6dkryyKC3w:6f/7KWAa/ZmkloSYnsoKkgEw
Malware Config
Signatures
-
Makes use of the framework's Accessibility service 3 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
description ioc Process Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId com.jwzxos.zgnqjszl Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId com.jwzxos.zgnqjszl Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByText com.jwzxos.zgnqjszl -
Loads dropped Dex/Jar 1 IoCs
Runs executable file dropped to the device during analysis.
ioc pid Process /data/user/0/com.jwzxos.zgnqjszl/code_cache/secondary-dexes/base.apk.classes1.zip 4602 com.jwzxos.zgnqjszl -
Requests enabling of the accessibility settings. 1 IoCs
description ioc Process Intent action android.settings.ACCESSIBILITY_SETTINGS com.jwzxos.zgnqjszl -
Acquires the wake lock 1 IoCs
description ioc Process Framework service call android.os.IPowerManager.acquireWakeLock com.jwzxos.zgnqjszl -
Requests disabling of battery optimizations (often used to enable hiding in the background). 1 IoCs
description ioc Process Intent action android.settings.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS com.jwzxos.zgnqjszl
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.3MB
MD5a8739a9db2baf2b8fb7ffc2289919970
SHA1912c66cab097790c7aa80253d3da8412a421ec6e
SHA256cd27158d81fa5059ca806fb8ba9fdba34e4e9a578d1f1e22fbb72042442df787
SHA51245771923d82461de61ffc5c1ae7186f2db5e960a062dd12bdc28fb832b0f236da875d9d42fcc86ffb99e2572863cd61d967c12c74aea5da63ff9d7bce8d6703a
-
/data/user/0/com.jwzxos.zgnqjszl/code_cache/secondary-dexes/tmp-base.apk.classes6768524385672361777.zip
Filesize490KB
MD5c660d3d645b1fc6a7c9b54f7a4070f88
SHA1ca7ba90611912a6c7afde677148dac4d8faff04f
SHA256441b3c30bf4447ae7580d39d37309d34645b857be6a3dfcd9462ac621005a645
SHA512ec841c52ff209eb4f844f98d3f4dc295a7e790bb2065f93dfb7f7233b3fc3a06bd00a0c8e104cc4e1d25856dc4eb6412916a64010b63ee920322b35108f0906d