Analysis

  • max time kernel
    150s
  • max time network
    144s
  • platform
    android_x64
  • resource
    android-33-x64-arm64-20240229-en
  • resource tags

    androidarch:arm64arch:x64image:android-33-x64-arm64-20240229-enlocale:en-usos:android-13-x64system
  • submitted
    23-03-2024 00:14

General

  • Target

    ready.apk

  • Size

    8.5MB

  • MD5

    e4c93294218c6dd0305626e435056db3

  • SHA1

    beb3d36eed35190e59958cd6dce590cefa755314

  • SHA256

    ddd54ca52399b5fb85d2e0b16ac434ba3c5bea78aa05558a14ba657869280ac2

  • SHA512

    26c48632e6f87f0def0c0a1c0de175f4054674e4ddb6d65e5d5894c384313ad971245e04cca273da6456881312792b68f0f786d4413dad428081c6a6ffba0390

  • SSDEEP

    98304:htKnX3hRimKAg4h5t4fN+OxksGleLmzvzBHTC0tAu:uRi56SYBlxztBD

Malware Config

Signatures

  • Makes use of the framework's Accessibility service 2 TTPs 3 IoCs

    Retrieves information displayed on the phone screen using AccessibilityService.

  • Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

    Application may abuse the framework's foreground service to continue running in the foreground.

  • Requests enabling of the accessibility settings. 1 IoCs
  • Acquires the wake lock 1 IoCs
  • Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs

Processes

  • automotive.suspension.sept
    1⤵
    • Makes use of the framework's Accessibility service
    • Makes use of the framework's foreground persistence service
    • Requests enabling of the accessibility settings.
    • Acquires the wake lock
    • Requests disabling of battery optimizations (often used to enable hiding in the background).
    PID:4288

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • /storage/emulated/0/Config/sys/apps/log/log-2024-03-23.txt

    Filesize

    37B

    MD5

    9749192580b2ea878f269ff1664b2d65

    SHA1

    1672bf5830064ec049195bc4493d8e77be2cad9d

    SHA256

    db5760c25427f8ca5dd0f92b51c4d5d248621393ea5e33558d44adf8b2066d3b

    SHA512

    353be6a6b7e13b0a7a91161539a0541e0c9a0868c06e5c40f53182deee46363ddcf60a3f0e07191c5f7c83f128c8fcc39c91f3e7ecc32480970b163f892d18bc

  • /storage/emulated/0/Config/sys/apps/log/log-2024-03-23.txt

    Filesize

    21B

    MD5

    9452080241166c15439adab8811c2ec3

    SHA1

    38b9925d443d9eb320da91094288afecfe20bd42

    SHA256

    e2475a3989e6d43990608b8e1bd61fb1965a2f317448e85c13863f052c9c246e

    SHA512

    d1959a5348e15e3a3b3fe9d144a21103a65e00af290c44e406baf06143e04c929979c6bddc62d4e2c1dcd16cea29ae2e3e6d2e2fa79199d7be588d87965c0164

  • /storage/emulated/0/Config/sys/apps/log/log-2024-03-23.txt

    Filesize

    256B

    MD5

    c8873a53fe416ac35ab2fb5f07209e01

    SHA1

    199ef5b3946d7f58b8ce609a4315679dafb3a3bc

    SHA256

    d4df16772ca914d36e94196250df6ae5cefb9ff5fa456bbcf0795cbd622f4545

    SHA512

    9012b2d118cc0a55dbd3cc4281c0c477db25e68e890d8d64ab73cd40c826b5a573b5ff5467b94521d78938eba7f6cbb47fab3aa9cb64d00aaa34137bae43a174