Analysis
- max time kernel
150s - max time network
156s - platform
android_x64 - resource
android-x64-20240221-en - resource tags
androidarch:x64arch:x86image:android-x64-20240221-enlocale:en-usos:android-10-x64system - submitted
10/03/2024, 22:08
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
f210fdde10bd399cbc2b57bab77745ceb980dd7c90683a13288198548f1a7ef4.apk
Resource
android-x86-arm-20240221-en
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
f210fdde10bd399cbc2b57bab77745ceb980dd7c90683a13288198548f1a7ef4.apk
Resource
android-x64-20240221-en
5 signatures
150 seconds
Behavioral task
behavioral3
Sample
f210fdde10bd399cbc2b57bab77745ceb980dd7c90683a13288198548f1a7ef4.apk
Resource
android-x64-arm64-20240221-en
6 signatures
150 seconds
General
- Target f210fdde10bd399cbc2b57bab77745ceb980dd7c90683a13288198548f1a7ef4.apk
- Size 24KB
- Sample240310-12ebesdb7v
- SHA256 f210fdde10bd399cbc2b57bab77745ceb980dd7c90683a13288198548f1a7ef4
- MD5 cc6cb4eac85609b17596c18a29dba65c
- SHA1 3fe5114dfcf2a54522be441f40975be22a78cc01
- SHA512 9e1b973e1d31be66614678af757dcbdda1da71aae39aab6f7002486423787f86c17d7b8430d042528ff12b46fa983983bd6bb6a49fe27587d57fabd8e3575fd1
- SSDEEP 384:UrN3bT8/ojjD8ZgV7eDltAPaFW+2QVisfBvr2CECJFjuRDXGgYWEUkpsw7pn1wIo:2N3bQAIZgV72mP/+DiUx4/MMR
- MD5 SHA1 SHA512 SSDEEP
Score
8/10
Malware Config
Signatures
- Makes use of the framework's Accessibility service 2 TTPs 2 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
description ioc Process Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId ru.eliminate.increase Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId ru.eliminate.increase -
pid Process 5031 ru.eliminate.increase - Acquires the wake lock 1 IoCs
description ioc Process Framework service call android.os.IPowerManager.acquireWakeLock ru.eliminate.increase - Reads information about phone network operator. 1 TTPs
- Uses Crypto APIs (Might try to encrypt user data) 1 IoCs
description ioc Process Framework API call javax.crypto.Cipher.doFinal ru.eliminate.increase