f5d84a3bd44d1511e00a67ae1c79f2076dc8972dc11c616d6130dc4eba0e3555

General

Target

ready.apk
Size

53.6MB
MD5

e29997bcbd59a9299134bb762959fa4c
SHA1

2b27ce92fe1c8baf7332805bcb2cf923b491cac2
SHA256

f5d84a3bd44d1511e00a67ae1c79f2076dc8972dc11c616d6130dc4eba0e3555
SHA512

70df8550eedf6bfbb35a038f87fa2fa3837f8789d3b7384c2320f823e58fee8e5d84fb28839645d81c078dd64bf67d6c10a06df9d80d9b74430cfa481fd56ae4
SSDEEP

1572864:NmKR/R2InCUVZbWEB7e0Uyxr8a3MAPfSbJ77m6xu:1R2jU36DRyJOLbp7m6o

Score

8^/10

collection evasion persistence

Malware Config

Signatures

Makes use of the framework's Accessibility service 2 TTPs 1 IoCs

Retrieves information displayed on the phone screen using AccessibilityService.

collection evasion

T1516

T1513

Processes:

splash.app.main

description	ioc	process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	splash.app.main

Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
evasion persistence

T1541

Processes:

splash.app.main

description ioc process

Framework service call android.app.IActivityManager.setServiceForeground splash.app.main

description	ioc	process
Framework service call	android.app.IActivityManager.setServiceForeground	splash.app.main

Declares services with permission to bind to the system 2 IoCs

Processes:

description	ioc
Required by remote views services to bind with the system. Allows apps to share and display views across different processes.	android.permission.BIND_REMOTEVIEWS
Required by telecom connection services to bind with the system. Allows apps to manage phone call aspects such as call setup and notifications.	android.permission.BIND_TELECOM_CONNECTION_SERVICE

Requests dangerous framework permissions 20 IoCs

Processes:

description	ioc
Allows an application to access any geographic locations persisted in the user's shared collection.	android.permission.ACCESS_MEDIA_LOCATION
Allows an application to read image or video files from external storage that a user has selected via the permission prompt photo picker.	android.permission.READ_MEDIA_VISUAL_USER_SELECTED
Allows an application to read video files from external storage.	android.permission.READ_MEDIA_VIDEO
Allows an application to read image files from external storage.	android.permission.READ_MEDIA_IMAGES
Allows an app to access approximate location.	android.permission.ACCESS_COARSE_LOCATION
Allows an application to read the user's contacts data.	android.permission.READ_CONTACTS
Allows an application to write the user's contacts data.	android.permission.WRITE_CONTACTS
Allows access to the list of accounts in the Accounts Service.	android.permission.GET_ACCOUNTS
Allows an app to access precise location.	android.permission.ACCESS_FINE_LOCATION
Allows an application to access any geographic locations persisted in the user's shared collection.	android.permission.ACCESS_MEDIA_LOCATION
Required to be able to access the camera device.	android.permission.CAMERA
Allows an app to post notifications.	android.permission.POST_NOTIFICATIONS
Allows an application to record audio.	android.permission.RECORD_AUDIO
Allows an application to write to external storage.	android.permission.WRITE_EXTERNAL_STORAGE
Allows read only access to phone state, including the current cellular network information, the status of any ongoing calls, and a list of any PhoneAccounts registered on the device.	android.permission.READ_PHONE_STATE
Allows an application to read the user's calendar data.	android.permission.READ_CALENDAR
Allows an application to write the user's calendar data.	android.permission.WRITE_CALENDAR
Allows an app to create windows using the type LayoutParams.TYPE_APPLICATION_OVERLAY, shown on top of all other apps.	android.permission.SYSTEM_ALERT_WINDOW
Required to be able to connect to paired Bluetooth devices.	android.permission.BLUETOOTH_CONNECT
Allows an application to read from external storage.	android.permission.READ_EXTERNAL_STORAGE

splash.app.main
1⤵
- Makes use of the framework's Accessibility service
- Makes use of the framework's foreground persistence service
PID:5092

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

/storage/emulated/0/.base.apk
Filesize
56.8MB

MD5
8c5a8a5543509a20f79de96ac53fe4e5

SHA1
6a58abfecf85940811517d6b44a2abeb4b4514dc

SHA256
eb19c045b8a70e71e69c8773a96656ed17f6ff4ab8fd3d1e2d4f3cbc0ccc4b54

SHA512
523bc59e9acea6907fc57ab26b019b9fbd9e138f708aabc8fd4d5585f24e0a45ae7a877dadc22c51e24a863a849f4f4d29e4b8f36a9ee6eb22e2a852117dbdcf

Download Submit
/storage/emulated/0/Config/sys/apps/log/log-MjAyNC0wMy0zMQ== .txt
Filesize
32B

MD5
6a98507dc1c0cbea05e87ca99fb1812b

SHA1
397835cc53bdd5103aa960ffb8c9be8f5da2d231

SHA256
65d5b84d9221bf950f3618cc329414eed3ebb75bd4da6b8402fdc794ca32eca8

SHA512
b50439e84849c2faeb8ae50aeff702e279c30c0ef9b58d140275c4704b3e09c1a035d3ef500f513991703932f29de21ff4be65b4567cab66196207da64fae87c

Download Submit
/storage/emulated/0/Config/sys/apps/log/log-MjAyNC0wMy0zMQ== .txt
Filesize
36B

MD5
2c4f8abe2dfd2f2e33ed0528665794dd

SHA1
5c9c068f805d55ea7b13c021f54dfbe71e07454b

SHA256
ea2dff6d7036d8ed0f98f8a85b0bf377df05ca058a4e1b061007f36ed7122da3

SHA512
6d4659a8cc48d4444b42b3a812392971e80409ac35032aaf1ee2e14bff82b6034c75eb364798aa1a56d961816038f7b615aaebb851643c50dcb79e157a645f54

Download Submit
/storage/emulated/0/Config/sys/apps/log/log-MjAyNC0wMy0zMQ== .txt
Filesize
56B

MD5
316dba1ca8bb834a1f4869849d51445e

SHA1
7cf6e17d1b14cbd00dbebc419be81184ed218bbc

SHA256
7b93d3e18618d5840e68083c3faf5f9f526fc44ea63269df9d1a873c435a7ae0

SHA512
ad1dd3001a84f252e9b1166c331656dc2b6d043a1ac1baa47e6e6eca75fd4c32254e8f590dd625de44303015bf59e4fb808346e32912603c0d843d971fa25801

Download Submit
/storage/emulated/0/Config/sys/apps/log/log-MjAyNC0wMy0zMQ== .txt
Filesize
20B

MD5
6517749f1bbb71259067623498b5b282

SHA1
a6d9677172333f7ec67d2ea8173b7b9b4959a3d4

SHA256
c20b6a646d477001d042d80b3bf8fb66674dd2bbdd9ccbcbb6681502bfcf1bc2

SHA512
37e556e90d4671eb629ab7c20a88a6c830da485d4087ec97cdf09fa827718550cdb0b8ca11bdac4585442a44586a82b338ecd6ee0f1178ce70a06a2cd2415cf2

Download Submit
/storage/emulated/0/Config/sys/apps/log/log-MjAyNC0wMy0zMQ== .txt
Filesize
125B

MD5
91c003fc02b21f73ab443b76b3f3056e

SHA1
567acc2d0c1b408183b93e83de7acd08c30350a3

SHA256
561276c13dc742251e637c6d9ec3555ca0f1dd56205d1fa3a1d819ba6602011b

SHA512
267f4d06069f5dfdd38147feb210d5e5577169f08879755303e31f2772855316394d9af1bed1386a41648ea3d61ba2de20c71e7b53a824c4a75c596dacb9ebe6

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads