Analysis

  • max time kernel
    149s
  • max time network
    158s
  • platform
    android_x64
  • resource
    android-x64-20231215-en
  • resource tags

    androidarch:x64arch:x86image:android-x64-20231215-enlocale:en-usos:android-10-x64system
  • submitted
    25/01/2024, 22:01

General

  • Target

    a2569a35f4f8fb0c66d63389a5817d8b47200563e26ee4a5450f60ccd68d200c.apk

  • Size

    78KB

  • MD5

    e69db731107b14314e7ff68e8ab04b63

  • SHA1

    898b15ae90c5218d4efbacacf18d388812e6f15b

  • SHA256

    a2569a35f4f8fb0c66d63389a5817d8b47200563e26ee4a5450f60ccd68d200c

  • SHA512

    1cea7921a4f162382f718777326f61625939f7f61ca5b6b7026ff44f3a8dc262aea7a0fd8dbb5130ec322ef47243f50526b14db13df6a59082742b024894e937

  • SSDEEP

    1536:ylecx04IxX+MfAnyPKcawpAabiF/ef90r0bLNwjXYU9Sy4ybIp:F0IxOMfC4pAa+wf90r0PNw3ky4U6

Score
8/10

Malware Config

Signatures

  • Makes use of the framework's Accessibility service 1 IoCs

    Retrieves information displayed on the phone screen using AccessibilityService.

  • Loads dropped Dex/Jar 3 IoCs

    Runs executable file dropped to the device during analysis.

  • Acquires the wake lock 1 IoCs

Processes

  • ihar.rgzjk.qeru
    1⤵
    • Makes use of the framework's Accessibility service
    • Loads dropped Dex/Jar
    • Acquires the wake lock
    PID:4989

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/data/kedf.moqki.yvkx/files/Factory/Plugins/oat/classes.dex.cur.prof

    Filesize

    181B

    MD5

    66b86c83f10740a2fc8645c8b4b31879

    SHA1

    17b17e82080f64513e58cd23452fba8abc5443b5

    SHA256

    9756d0bbb9db2905c999aa0a403cdcd8be4f1ab97ef79d1e2f1c8c87000e331c

    SHA512

    4d684d8283a56d4da00f8b940616ee980b159bb6750df5c6fd1c02fd768548abfa30ebe964d11c254884c244812f2096f7cc6069932addb444b2e5f10fd9a841

  • /data/user/0/kedf.moqki.yvkx/[email protected]

    Filesize

    122KB

    MD5

    119f82bc185c6c33d053a7c3b907abaa

    SHA1

    28a12d12592fd2c1601421714df95bf6488fcee4

    SHA256

    b9753e3fc98dd7197669a4d3b814be314c67d1d65a3e3deec440d571014932a5

    SHA512

    12fccf8875ea4047ecbe88cfd1ae90688c6419d07564d41941fc3165e0f49cb0d75e92937529d2e32a86c4a06a2f55431669a5a102f26ff175eb0da3ad48be72