Analysis
- max time kernel
156s - max time network
163s - platform
android_x64 - resource
android-x64-20240221-en - resource tags
androidarch:x64arch:x86image:android-x64-20240221-enlocale:en-usos:android-10-x64system - submitted
10/03/2024, 22:08
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
758977ae3a50290902ff6c1f6477e4e0a98dadbf15b5385e80185136ad9b5d1b.apk
Resource
android-x86-arm-20240221-en
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
758977ae3a50290902ff6c1f6477e4e0a98dadbf15b5385e80185136ad9b5d1b.apk
Resource
android-x64-20240221-en
5 signatures
150 seconds
Behavioral task
behavioral3
Sample
758977ae3a50290902ff6c1f6477e4e0a98dadbf15b5385e80185136ad9b5d1b.apk
Resource
android-x64-arm64-20240221-en
6 signatures
150 seconds
General
- Target 758977ae3a50290902ff6c1f6477e4e0a98dadbf15b5385e80185136ad9b5d1b.apk
- Size 24KB
- Sample240310-12dpwsch26
- SHA256 758977ae3a50290902ff6c1f6477e4e0a98dadbf15b5385e80185136ad9b5d1b
- MD5 9e1c1bd86ca54a3d965dc1cb257409f5
- SHA1 e11de24a68b9f82fe44c3b2b6f8656df4b8ef0a3
- SHA512 30869763d1ece7f959dc1cf34a96aeaec87fc8bf25c0a9a076c1d8eb8183a2f02a94c060295bdac2b9279493c96b7f0a633b3d83981f467e94cf08fa8bcd5bf5
- SSDEEP 384:dVFrqdr9UJlydHS/JYMGeR7UabKo7pPM0bBYhV7krQhklCWN+tXHurSGgYFpMMp6:dfgeJlyIBTpRpBbB2+Q7x+S/f
- MD5 SHA1 SHA512 SSDEEP
Score
8/10
Malware Config
Signatures
- Makes use of the framework's Accessibility service 2 TTPs 2 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
description ioc Process Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId com.program.coal Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId com.program.coal -
pid Process 5037 com.program.coal - Acquires the wake lock 1 IoCs
description ioc Process Framework service call android.os.IPowerManager.acquireWakeLock com.program.coal - Reads information about phone network operator. 1 TTPs
- Uses Crypto APIs (Might try to encrypt user data) 1 IoCs
description ioc Process Framework API call javax.crypto.Cipher.doFinal com.program.coal