08d589322bf236d7d9e7abf392c15d7625e36047ea35d669323612ef15942eea

Analysis

max time kernel
149s
max time network
156s
platform
android_x86
resource
android-x86-arm-20240221-en
resource tags

androidarch:armarch:x86image:android-x86-arm-20240221-enlocale:en-usos:android-9-x86system
submitted
02-04-2024 10:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7fa3d58a0056e8492a84894a6fd3b3d0d87ff1f9656f5e54b10580b9a4a4fd6a.apk
Size

4.5MB
MD5

4f007c674721466ff8af2d6b8b0e6040
SHA1

0694c99741258c9609771c544a647f6641caa138
SHA256

7fa3d58a0056e8492a84894a6fd3b3d0d87ff1f9656f5e54b10580b9a4a4fd6a
SHA512

3372612e6ad916538bb4c41914f30be9e910370e66d91ccacbc3968ae433b83f2e9140c0d3c0d978787b726197057d1ddf74caffc68bca55527b3d44fa46658f
SSDEEP

98304:L9hinlhin6Vhinahinx1hin6hinshinUhinWUlbqT0+L1ePKRMpxYw7:LbCzC6DC8CxjCcCyCKCWhwA1wKRa2k

Score

8^/10

collection evasion persistence

Malware Config

Signatures

Makes use of the framework's Accessibility service 2 TTPs 2 IoCs

Retrieves information displayed on the phone screen using AccessibilityService.

collection evasion

Input Injection

T1516

Screen Capture

T1513

Processes:

com.caixkdopro.app

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	com.caixkdopro.app
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId	com.caixkdopro.app

Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

Application may abuse the framework's foreground service to continue running in the foreground.

evasion persistence

Foreground Persistence

T1541

Processes:

com.caixkdopro.app

description	ioc	Process
Framework service call	android.app.IActivityManager.setServiceForeground	com.caixkdopro.app

Acquires the wake lock 1 IoCs

Processes:

com.caixkdopro.app

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.caixkdopro.app

com.caixkdopro.app
1⤵
- Makes use of the framework's Accessibility service
- Makes use of the framework's foreground persistence service
- Acquires the wake lock
PID:4285

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Foreground Persistence

T1541

Privilege Escalation

Defense Evasion

Foreground Persistence

T1541

Input Injection

T1516

Credential Access

Discovery

Lateral Movement

Collection

Screen Capture

T1513

Command and Control

Exfiltration

Impact

Input Injection

T1516

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.caixkdopro.app/files/db.db

Filesize
40KB

MD5
0f846d61a922fcd3852c7241f99dc9bc

SHA1
2198433f3a500dcf88048096d0dbdb9f26b7ce47

SHA256
39ced8a590d3e71780b7d787db9b98065d9cd7a9f987dda085fb837a012cff8d

SHA512
d2380af9ad7c68ffdca1745f6dc3f747cc5ff5622ad1c6a1b1af79267c8d3d1f28fe6e01c435797a77309ec31ce085a3c6866503b01bc9850f679ffb34ea3c08

Download Submit
/data/data/com.caixkdopro.app/files/db.db

Filesize
4KB

MD5
32d50418eb9cc48b26054a251a525252

SHA1
312ecef70715199403f3064a023bc5096e91e7af

SHA256
997ea84efb161887ea79b89a23a421bf2be0b3eae61c3c0e273cc5be4c8482e4

SHA512
e5ebdf900167404a1e742db16df6323858139eda2ebf02cb7927941ab82167e3a44ec02022161ba517d4a8fc71bc54c0c4618cb9ae517763e9f3ab8e343bd41e

Download Submit
/data/data/com.caixkdopro.app/files/db.db-journal

Filesize
4KB

MD5
8c0d41f70461a7cdb46797d7e1b837d3

SHA1
d64418e60820021a538fcef603a6a400248f1c32

SHA256
87103f6b1fa83188d424e8bbfd7fb93e6b19209276cb6dce5ea337a0117ff919

SHA512
c0ee1138608c043f1ed5db65059341d7f22e4dde5d6ae644060bb716cf67a141d8e6fb9e00f3887bb363f01cc6fddc660a3650df4bca72d2ad0ac5e1f4ee83d9

Download Submit
/data/data/com.caixkdopro.app/files/db.db-shm

Filesize
32KB

MD5
bb7df04e1b0a2570657527a7e108ae23

SHA1
5188431849b4613152fd7bdba6a3ff0a4fd6424b

SHA256
c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479

SHA512
768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

Download Submit
/data/data/com.caixkdopro.app/files/loading.gif

Filesize
121KB

MD5
7b38720a0352dffa26411726c72dd2b0

SHA1
b15e687f42abcdc12427f146a3115ef2259211f8

SHA256
2013f490d45638cada331b3474ed65b9a43cec60da773accc98332e58c06336d

SHA512
0df28f87da4f9beb3ca8c108f54021a2a1a1434771abbb5ba67a2736097f2287b05e5220a33e92c42ee13ecae1144714a422b986763712794f69e65bc44c83e3

Download Submit
/data/data/com.caixkdopro.app/files/txtscreensize.txt

Filesize
11B

MD5
1b65c10c6215685f9d621d797f911373

SHA1
cc50aaed5cd521a62ec8cf9fe0413153ec90f265

SHA256
2230c2b2787663a054c47450ecd1718f0296853ad768b8e5d306ecb912685e89

SHA512
5a9139f295dbe384b1584eff5c11f3f86759232f7b661b75f27fe92b996b4cdc0552e315f79b26f5f2c1f91756d9ae04cf0c3675b6172e91a3d373b9b314496f

Download Submit