Analysis
-
max time kernel
150s -
max time network
157s -
platform
android_x64 -
resource
android-x64-20240221-en -
resource tags
-
submitted
05-03-2024 20:56
General
-
Target
godfather.apk
-
Size
7.2MB
-
MD5
ec9f857999b4fc3dd007fdb786b7a8d1
-
SHA1
3fa48a36d22d848ad111b246ca94fa58088dbb7a
-
SHA256
0b72c22517fdefd4cf0466d8d4c634ca73b7667d378be688efe131af4ac3aed8
-
SHA512
51d9965e08fa3f5cd8850df3f2dd8503c47ce9f3668b2ae90d3560cc16acd0d4d1b3bbed651d957bc41ea7595a527a00b9c600b3726faa6095af380019e3d1e0
-
SSDEEP
98304:vDdInEpAOdLl2DfGjOmP34z09nmw3xAZMV8JiDQeZgUGdh0fr33dmh++0oEHi6Pz:5gE7tf3u09nmiOZmDid9h+CFZMXmwfXR
Score
8/10
Malware Config
Signatures
-
Makes use of the framework's Accessibility service 2 TTPs 3 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs 1 IoCs
-
Acquires the wake lock 1 IoCs
-
Reads information about phone network operator. 1 TTPs
-
Uses Crypto APIs (Might try to encrypt user data) 1 IoCs
Processes
-
com.rduzmauwns.jieliysagr1⤵
- Makes use of the framework's Accessibility service
- Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)
- Acquires the wake lock
- Uses Crypto APIs (Might try to encrypt user data)
-
com.rduzmauwns.jieliysagr:remote1⤵