Analysis
-
max time kernel
148s -
max time network
130s -
platform
android_x86 -
resource
android-x86-arm-20240221-en -
resource tags
androidarch:armarch:x86image:android-x86-arm-20240221-enlocale:en-usos:android-9-x86system -
submitted
07-04-2024 22:01
Behavioral task
behavioral1
Sample
55325199311b4c12b5fda133c7b2186eab289ba1062a96b079ef6efa11cb8071.apk
Resource
android-x86-arm-20240221-en
Behavioral task
behavioral2
Sample
55325199311b4c12b5fda133c7b2186eab289ba1062a96b079ef6efa11cb8071.apk
Resource
android-x64-20240221-en
Behavioral task
behavioral3
Sample
55325199311b4c12b5fda133c7b2186eab289ba1062a96b079ef6efa11cb8071.apk
Resource
android-x64-arm64-20240221-en
General
-
Target
55325199311b4c12b5fda133c7b2186eab289ba1062a96b079ef6efa11cb8071.apk
-
Size
739KB
-
MD5
d66ccb14faa1455980611e3fc467f6ed
-
SHA1
6b4d0ca1075d3f60dfd7ae89a5148947359b9293
-
SHA256
55325199311b4c12b5fda133c7b2186eab289ba1062a96b079ef6efa11cb8071
-
SHA512
d5bcce1e478bd3e901649efdbabdaa49d91f0aae75a3f24e121634871e17307b0d1a79ece79f8639516ab65279245084aac216269e0b0cbb65ef97f36a706f67
-
SSDEEP
12288:yWlJ6sgRALz4I2sVrE5WmpYshXZPbGwidNpgV:yqJ6s7Lz4nsVrE5WmD9idNpa
Malware Config
Signatures
-
Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs 1 IoCs
Processes:
cmf0.c3b5bm90zq.patchdescription ioc process Framework service call android.content.pm.IPackageManager.getInstalledApplications cmf0.c3b5bm90zq.patch -
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
Processes:
cmf0.c3b5bm90zq.patchdescription ioc process Framework service call android.app.IActivityManager.setServiceForeground cmf0.c3b5bm90zq.patch -
Requests enabling of the accessibility settings. 1 IoCs
Processes:
cmf0.c3b5bm90zq.patchdescription ioc process Intent action android.settings.ACCESSIBILITY_SETTINGS cmf0.c3b5bm90zq.patch -
Tries to add a device administrator. 1 TTPs 1 IoCs
Processes:
cmf0.c3b5bm90zq.patchdescription ioc process Intent action android.app.action.ADD_DEVICE_ADMIN cmf0.c3b5bm90zq.patch
Processes
-
cmf0.c3b5bm90zq.patch1⤵
- Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)
- Makes use of the framework's foreground persistence service
- Requests enabling of the accessibility settings.
- Tries to add a device administrator.
-
su2⤵
-
su2⤵