Analysis
- max time kernel
151s - max time network
159s - platform
android_x64 - resource
android-x64-20240221-en - resource tags
androidarch:x64arch:x86image:android-x64-20240221-enlocale:en-usos:android-10-x64system - submitted
10/03/2024, 22:07
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
bf4b6ccc9d59522afcee57ed94909ce0652370c5d77735b01be9637955dad61d.apk
Resource
android-x86-arm-20240221-en
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
bf4b6ccc9d59522afcee57ed94909ce0652370c5d77735b01be9637955dad61d.apk
Resource
android-x64-20240221-en
4 signatures
150 seconds
Behavioral task
behavioral3
Sample
bf4b6ccc9d59522afcee57ed94909ce0652370c5d77735b01be9637955dad61d.apk
Resource
android-x64-arm64-20240221-en
4 signatures
150 seconds
General
- Target bf4b6ccc9d59522afcee57ed94909ce0652370c5d77735b01be9637955dad61d.apk
- Size 315KB
- Sample240310-1114sscg85
- SHA256 bf4b6ccc9d59522afcee57ed94909ce0652370c5d77735b01be9637955dad61d
- MD5 41afed996705f96135b3ac3fb3040928
- SHA1 d9cb26f7d7b1e283d61458ee2ca6af40a50146b4
- SHA512 d1bf78e363fd2ab0df5345df9bc844f7a1f83dc243cf70bd9e6a7bc8919591348eadccceff764c20abb3d5263606ffaea2ecb0a9771c1a9a402e5b879d4f9783
- SSDEEP 6144:Eh6344V6dQebEflVNxY3RUM3jgWl20uQFa6gFMO1U0h:EI44eYPNGBUUzBa6XcU0h
- MD5 SHA1 SHA512 SSDEEP
Score
8/10
Malware Config
Signatures
- Makes use of the framework's Accessibility service 2 TTPs 2 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
description ioc Process Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId wcqrucdpzh.otstodvvsm.vrbnjqrsrr Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByText wcqrucdpzh.otstodvvsm.vrbnjqrsrr -
pid Process 5086 wcqrucdpzh.otstodvvsm.vrbnjqrsrr - Acquires the wake lock 1 IoCs
description ioc Process Framework service call android.os.IPowerManager.acquireWakeLock wcqrucdpzh.otstodvvsm.vrbnjqrsrr - Uses Crypto APIs (Might try to encrypt user data) 1 IoCs
description ioc Process Framework API call javax.crypto.Cipher.doFinal wcqrucdpzh.otstodvvsm.vrbnjqrsrr