Analysis
-
max time kernel
149s -
max time network
158s -
platform
android_x64 -
resource
android-x64-20231215-en -
resource tags
androidarch:x64arch:x86image:android-x64-20231215-enlocale:en-usos:android-10-x64system -
submitted
25/01/2024, 22:01
Static task
static1
Behavioral task
behavioral1
Sample
a2569a35f4f8fb0c66d63389a5817d8b47200563e26ee4a5450f60ccd68d200c.apk
Resource
android-x86-arm-20231215-en
Behavioral task
behavioral2
Sample
a2569a35f4f8fb0c66d63389a5817d8b47200563e26ee4a5450f60ccd68d200c.apk
Resource
android-x64-20231215-en
Behavioral task
behavioral3
Sample
a2569a35f4f8fb0c66d63389a5817d8b47200563e26ee4a5450f60ccd68d200c.apk
Resource
android-x64-arm64-20231215-en
Behavioral task
behavioral4
Sample
classes.apk
Resource
android-x86-arm-20231215-en
Behavioral task
behavioral5
Sample
classes.apk
Resource
android-x64-20231215-en
Behavioral task
behavioral6
Sample
classes.apk
Resource
android-x64-arm64-20231215-en
General
-
Target
a2569a35f4f8fb0c66d63389a5817d8b47200563e26ee4a5450f60ccd68d200c.apk
-
Size
78KB
-
MD5
e69db731107b14314e7ff68e8ab04b63
-
SHA1
898b15ae90c5218d4efbacacf18d388812e6f15b
-
SHA256
a2569a35f4f8fb0c66d63389a5817d8b47200563e26ee4a5450f60ccd68d200c
-
SHA512
1cea7921a4f162382f718777326f61625939f7f61ca5b6b7026ff44f3a8dc262aea7a0fd8dbb5130ec322ef47243f50526b14db13df6a59082742b024894e937
-
SSDEEP
1536:ylecx04IxX+MfAnyPKcawpAabiF/ef90r0bLNwjXYU9Sy4ybIp:F0IxOMfC4pAa+wf90r0PNw3ky4U6
Malware Config
Signatures
-
Makes use of the framework's Accessibility service 1 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
description ioc Process Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId ihar.rgzjk.qeru -
Loads dropped Dex/Jar 3 IoCs
Runs executable file dropped to the device during analysis.
ioc pid Process /data/user/0/kedf.moqki.yvkx/[email protected] 4989 ihar.rgzjk.qeru /data/user/0/kedf.moqki.yvkx/files/Factory/Plugins/classes.dex 4989 ihar.rgzjk.qeru /data/user/0/kedf.moqki.yvkx/files/Factory/Plugins/classes.dex 4989 ihar.rgzjk.qeru -
Acquires the wake lock 1 IoCs
description ioc Process Framework service call android.os.IPowerManager.acquireWakeLock ihar.rgzjk.qeru
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
181B
MD566b86c83f10740a2fc8645c8b4b31879
SHA117b17e82080f64513e58cd23452fba8abc5443b5
SHA2569756d0bbb9db2905c999aa0a403cdcd8be4f1ab97ef79d1e2f1c8c87000e331c
SHA5124d684d8283a56d4da00f8b940616ee980b159bb6750df5c6fd1c02fd768548abfa30ebe964d11c254884c244812f2096f7cc6069932addb444b2e5f10fd9a841
-
/data/user/0/kedf.moqki.yvkx/[email protected]
Filesize122KB
MD5119f82bc185c6c33d053a7c3b907abaa
SHA128a12d12592fd2c1601421714df95bf6488fcee4
SHA256b9753e3fc98dd7197669a4d3b814be314c67d1d65a3e3deec440d571014932a5
SHA51212fccf8875ea4047ecbe88cfd1ae90688c6419d07564d41941fc3165e0f49cb0d75e92937529d2e32a86c4a06a2f55431669a5a102f26ff175eb0da3ad48be72