Analysis
-
max time kernel
150s -
max time network
144s -
platform
android_x64 -
resource
android-33-x64-arm64-20240229-en -
resource tags
androidarch:arm64arch:x64image:android-33-x64-arm64-20240229-enlocale:en-usos:android-13-x64system -
submitted
23-03-2024 00:14
Behavioral task
behavioral1
Sample
ready.apk
Resource
android-33-x64-arm64-20240229-en
General
-
Target
ready.apk
-
Size
8.5MB
-
MD5
e4c93294218c6dd0305626e435056db3
-
SHA1
beb3d36eed35190e59958cd6dce590cefa755314
-
SHA256
ddd54ca52399b5fb85d2e0b16ac434ba3c5bea78aa05558a14ba657869280ac2
-
SHA512
26c48632e6f87f0def0c0a1c0de175f4054674e4ddb6d65e5d5894c384313ad971245e04cca273da6456881312792b68f0f786d4413dad428081c6a6ffba0390
-
SSDEEP
98304:htKnX3hRimKAg4h5t4fN+OxksGleLmzvzBHTC0tAu:uRi56SYBlxztBD
Malware Config
Signatures
-
Makes use of the framework's Accessibility service 2 TTPs 3 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
Processes:
automotive.suspension.septdescription ioc process Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId automotive.suspension.sept Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByText automotive.suspension.sept Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId automotive.suspension.sept -
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
Processes:
automotive.suspension.septdescription ioc process Framework service call android.app.IActivityManager.setServiceForeground automotive.suspension.sept -
Requests enabling of the accessibility settings. 1 IoCs
Processes:
automotive.suspension.septdescription ioc process Intent action android.settings.ACCESSIBILITY_SETTINGS automotive.suspension.sept -
Acquires the wake lock 1 IoCs
Processes:
automotive.suspension.septdescription ioc process Framework service call android.os.IPowerManager.acquireWakeLock automotive.suspension.sept -
Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
Processes:
automotive.suspension.septdescription ioc process Intent action android.settings.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS automotive.suspension.sept
Processes
-
automotive.suspension.sept1⤵
- Makes use of the framework's Accessibility service
- Makes use of the framework's foreground persistence service
- Requests enabling of the accessibility settings.
- Acquires the wake lock
- Requests disabling of battery optimizations (often used to enable hiding in the background).
PID:4288
Network
MITRE ATT&CK Mobile v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
37B
MD59749192580b2ea878f269ff1664b2d65
SHA11672bf5830064ec049195bc4493d8e77be2cad9d
SHA256db5760c25427f8ca5dd0f92b51c4d5d248621393ea5e33558d44adf8b2066d3b
SHA512353be6a6b7e13b0a7a91161539a0541e0c9a0868c06e5c40f53182deee46363ddcf60a3f0e07191c5f7c83f128c8fcc39c91f3e7ecc32480970b163f892d18bc
-
Filesize
21B
MD59452080241166c15439adab8811c2ec3
SHA138b9925d443d9eb320da91094288afecfe20bd42
SHA256e2475a3989e6d43990608b8e1bd61fb1965a2f317448e85c13863f052c9c246e
SHA512d1959a5348e15e3a3b3fe9d144a21103a65e00af290c44e406baf06143e04c929979c6bddc62d4e2c1dcd16cea29ae2e3e6d2e2fa79199d7be588d87965c0164
-
Filesize
256B
MD5c8873a53fe416ac35ab2fb5f07209e01
SHA1199ef5b3946d7f58b8ce609a4315679dafb3a3bc
SHA256d4df16772ca914d36e94196250df6ae5cefb9ff5fa456bbcf0795cbd622f4545
SHA5129012b2d118cc0a55dbd3cc4281c0c477db25e68e890d8d64ab73cd40c826b5a573b5ff5467b94521d78938eba7f6cbb47fab3aa9cb64d00aaa34137bae43a174