ddd54ca52399b5fb85d2e0b16ac434ba3c5bea78aa05558a14ba657869280ac2

Analysis

max time kernel
150s
max time network
144s
platform
android_x64
resource
android-33-x64-arm64-20240229-en
resource tags

androidarch:arm64arch:x64image:android-33-x64-arm64-20240229-enlocale:en-usos:android-13-x64system
submitted
23-03-2024 00:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ready.apk
Size

8.5MB
MD5

e4c93294218c6dd0305626e435056db3
SHA1

beb3d36eed35190e59958cd6dce590cefa755314
SHA256

ddd54ca52399b5fb85d2e0b16ac434ba3c5bea78aa05558a14ba657869280ac2
SHA512

26c48632e6f87f0def0c0a1c0de175f4054674e4ddb6d65e5d5894c384313ad971245e04cca273da6456881312792b68f0f786d4413dad428081c6a6ffba0390
SSDEEP

98304:htKnX3hRimKAg4h5t4fN+OxksGleLmzvzBHTC0tAu:uRi56SYBlxztBD

Score

8^/10

collection evasion persistence

Malware Config

Signatures

Makes use of the framework's Accessibility service 2 TTPs 3 IoCs

Retrieves information displayed on the phone screen using AccessibilityService.

collection evasion

Input Injection

T1516

Screen Capture

T1513

Processes:

automotive.suspension.sept

description	ioc	process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	automotive.suspension.sept
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByText	automotive.suspension.sept
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId	automotive.suspension.sept

Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
evasion persistence

Foreground Persistence
T1541

Processes:

automotive.suspension.sept

description ioc process

Framework service call android.app.IActivityManager.setServiceForeground automotive.suspension.sept
Requests enabling of the accessibility settings. 1 IoCs

Processes:

automotive.suspension.sept

description ioc process

Intent action android.settings.ACCESSIBILITY_SETTINGS automotive.suspension.sept
Acquires the wake lock 1 IoCs

Processes:

automotive.suspension.sept

description ioc process

Framework service call android.os.IPowerManager.acquireWakeLock automotive.suspension.sept
Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
evasion

User Evasion
T1628.002

Processes:

automotive.suspension.sept

description ioc process

Intent action android.settings.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS automotive.suspension.sept

description	ioc	process
Framework service call	android.app.IActivityManager.setServiceForeground	automotive.suspension.sept

description	ioc	process
Intent action	android.settings.ACCESSIBILITY_SETTINGS	automotive.suspension.sept

description	ioc	process
Framework service call	android.os.IPowerManager.acquireWakeLock	automotive.suspension.sept

description	ioc	process
Intent action	android.settings.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS	automotive.suspension.sept

automotive.suspension.sept
1⤵
- Makes use of the framework's Accessibility service
- Makes use of the framework's foreground persistence service
- Requests enabling of the accessibility settings.
- Acquires the wake lock
- Requests disabling of battery optimizations (often used to enable hiding in the background).
PID:4288

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Foreground Persistence

T1541

Privilege Escalation

Defense Evasion

Foreground Persistence

T1541

Hide Artifacts

T1628

User Evasion

T1628.002

Input Injection

T1516

Credential Access

Discovery

Lateral Movement

Collection

Screen Capture

T1513

Command and Control

Exfiltration

Impact

Input Injection

T1516

Replay Monitor

Loading Replay Monitor...

Downloads

/storage/emulated/0/Config/sys/apps/log/log-2024-03-23.txt
Filesize
37B

MD5
9749192580b2ea878f269ff1664b2d65

SHA1
1672bf5830064ec049195bc4493d8e77be2cad9d

SHA256
db5760c25427f8ca5dd0f92b51c4d5d248621393ea5e33558d44adf8b2066d3b

SHA512
353be6a6b7e13b0a7a91161539a0541e0c9a0868c06e5c40f53182deee46363ddcf60a3f0e07191c5f7c83f128c8fcc39c91f3e7ecc32480970b163f892d18bc

Download Submit
/storage/emulated/0/Config/sys/apps/log/log-2024-03-23.txt
Filesize
21B

MD5
9452080241166c15439adab8811c2ec3

SHA1
38b9925d443d9eb320da91094288afecfe20bd42

SHA256
e2475a3989e6d43990608b8e1bd61fb1965a2f317448e85c13863f052c9c246e

SHA512
d1959a5348e15e3a3b3fe9d144a21103a65e00af290c44e406baf06143e04c929979c6bddc62d4e2c1dcd16cea29ae2e3e6d2e2fa79199d7be588d87965c0164

Download Submit
/storage/emulated/0/Config/sys/apps/log/log-2024-03-23.txt
Filesize
256B

MD5
c8873a53fe416ac35ab2fb5f07209e01

SHA1
199ef5b3946d7f58b8ce609a4315679dafb3a3bc

SHA256
d4df16772ca914d36e94196250df6ae5cefb9ff5fa456bbcf0795cbd622f4545

SHA512
9012b2d118cc0a55dbd3cc4281c0c477db25e68e890d8d64ab73cd40c826b5a573b5ff5467b94521d78938eba7f6cbb47fab3aa9cb64d00aaa34137bae43a174

Download Submit