Analysis
-
max time kernel
147s -
max time network
156s -
platform
android_x64 -
resource
android-x64-20231215-en -
resource tags
-
submitted
08-02-2024 22:09
General
-
Target
bad130c229078f0770b1f958467700438fabe5f9a08f443b8c40ee2ddec96e90.apk
-
Size
1.9MB
-
MD5
a028bf4b01db506f72b580866408e3ee
-
SHA1
45bdcbbde5b7f78e572592e8f3ae7805890ef7e7
-
SHA256
bad130c229078f0770b1f958467700438fabe5f9a08f443b8c40ee2ddec96e90
-
SHA512
767b74acf154033e86896fe27d4ced3414859aaed14da6b6a6aabaa83a8eb7a9784a5e58a4c2cd6718b03881fd53a6c956cd706c7f506d14a03caf2318c6a57c
-
SSDEEP
49152:yCTtPdNQnI/kwszd/TNangK7Ct8Y5rDwzeDJPH:XRCIvsBTNagMC2YhDwzeJPH
Malware Config
Signatures
-
Makes use of the framework's Accessibility service 1 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 IoCs
-
Removes its main activity from the application launcher 1 IoCs
-
Loads dropped Dex/Jar 4 IoCs
Runs executable file dropped to the device during analysis.
-
Acquires the wake lock 1 IoCs
-
Uses Crypto APIs (Might try to encrypt user data) 1 IoCs
Processes
-
ezmjhdiumgiyhfjdp.bjucshsqxhkigwyqqma.gqncehdcknrtcekingi1⤵
- Makes use of the framework's Accessibility service
- Removes its main activity from the application launcher
- Loads dropped Dex/Jar
- Acquires the wake lock
-
ezmjhdiumgiyhfjdp.bjucshsqxhkigwyqqma.gqncehdcknrtcekingi:cproc1⤵
- Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)
- Loads dropped Dex/Jar
- Uses Crypto APIs (Might try to encrypt user data)
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
/data/data/ezmjhdiumgiyhfjdp.bjucshsqxhkigwyqqma.gqncehdcknrtcekingi/app_DynamicOptDex/DCK.jsonFilesize
541KB
MD5bb76f8c4737dd53297bb1ae45544a4cc
SHA11d7b1f323c4f991bcc4333ce60f4feb9d599d866
SHA256ff93d86e094f424de4788a7af379353cfb41beacf3c7213795d17064e0ffc6a4
SHA512c4a4da1b2461edf57b9b8584088fe3a90e260e5f3efc3d8e2774fc9b1975cdf07e858df835d48dd4e49306847e20735319bd540c9cabe481e73cf53feb1b8037
-
/data/data/ezmjhdiumgiyhfjdp.bjucshsqxhkigwyqqma.gqncehdcknrtcekingi/app_DynamicOptDex/DCK.jsonFilesize
541KB
MD5999bc64ddb8466436ac709364f7c7a1b
SHA1da94e605da0f1292c86e5834de7e21b60c2ce47c
SHA256dbe96617fdc88b3fc1fe4af43c38a5613c307e9b60a3355c008b105f2e8a1020
SHA5125a1637130e2e99cc7c6a135db653f04b67fcb6d6986db0b74b7f04aeacee981e9d962fdb87f1b3f0ebd13d053c8893c381723e3dedb90a594c64e3595a01ce34