Analysis

  • max time kernel
    3601211s
  • max time network
    150s
  • platform
    android_x64
  • resource
    android-x64-arm64-20231215-en
  • resource tags

    androidarch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20231215-enlocale:en-usos:android-11-x64system
  • submitted
    04/01/2024, 22:41

General

  • Target

    421854095f7a5fe7ec08ef2d72407817.apk

  • Size

    1.4MB

  • MD5

    421854095f7a5fe7ec08ef2d72407817

  • SHA1

    2d12f8c136a7a335dbed0f45230f72cd530b737a

  • SHA256

    2e93c8783b8a635e1ba346a7c952cf13a84b47cd9d9912e45ec1d9b4f61c3cfd

  • SHA512

    eca2b4a5560d9874be2b3ca77d43844e67179936a5a3c82f6d4724f065ccbfe8890a55af8e5685f42f35339f9dbae3fed721a114369bc7681338bfd083c27296

  • SSDEEP

    24576:6fU9O7jL6q0OzM4XEa/Zmk3VoSaddJF1soIi6dkryyKC3w:6f/7KWAa/ZmkloSYnsoKkgEw

Score
8/10

Malware Config

Signatures

  • Makes use of the framework's Accessibility service 3 IoCs

    Retrieves information displayed on the phone screen using AccessibilityService.

  • Loads dropped Dex/Jar 1 IoCs

    Runs executable file dropped to the device during analysis.

  • Requests enabling of the accessibility settings. 1 IoCs
  • Acquires the wake lock 1 IoCs
  • Requests disabling of battery optimizations (often used to enable hiding in the background). 1 IoCs

Processes

  • com.jwzxos.zgnqjszl
    1⤵
    • Makes use of the framework's Accessibility service
    • Loads dropped Dex/Jar
    • Requests enabling of the accessibility settings.
    • Acquires the wake lock
    • Requests disabling of battery optimizations (often used to enable hiding in the background).
    PID:4602

Network

        MITRE ATT&CK Matrix

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • /data/user/0/com.jwzxos.zgnqjszl/code_cache/secondary-dexes/base.apk.classes1.zip

          Filesize

          1.3MB

          MD5

          a8739a9db2baf2b8fb7ffc2289919970

          SHA1

          912c66cab097790c7aa80253d3da8412a421ec6e

          SHA256

          cd27158d81fa5059ca806fb8ba9fdba34e4e9a578d1f1e22fbb72042442df787

          SHA512

          45771923d82461de61ffc5c1ae7186f2db5e960a062dd12bdc28fb832b0f236da875d9d42fcc86ffb99e2572863cd61d967c12c74aea5da63ff9d7bce8d6703a

        • /data/user/0/com.jwzxos.zgnqjszl/code_cache/secondary-dexes/tmp-base.apk.classes6768524385672361777.zip

          Filesize

          490KB

          MD5

          c660d3d645b1fc6a7c9b54f7a4070f88

          SHA1

          ca7ba90611912a6c7afde677148dac4d8faff04f

          SHA256

          441b3c30bf4447ae7580d39d37309d34645b857be6a3dfcd9462ac621005a645

          SHA512

          ec841c52ff209eb4f844f98d3f4dc295a7e790bb2065f93dfb7f7233b3fc3a06bd00a0c8e104cc4e1d25856dc4eb6412916a64010b63ee920322b35108f0906d