Analysis

  • max time kernel
    88s
  • max time network
    163s
  • platform
    android_x64
  • resource
    android-x64-arm64-20240221-en
  • resource tags

    androidarch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20240221-enlocale:en-usos:android-11-x64system
  • submitted
    10-04-2024 14:03

General

  • Target

    c4cdcfb645cb50451f6a5cf792ef91e07aa1ed166ad99f59358eb8b9a1284440.apk

  • Size

    7.0MB

  • MD5

    241b578fe963ad199fd5bdc0bb50f4ca

  • SHA1

    3a9fe80e346356dd1b7a12765fc941f7d584d943

  • SHA256

    c4cdcfb645cb50451f6a5cf792ef91e07aa1ed166ad99f59358eb8b9a1284440

  • SHA512

    52e6d4a9164480af0f3c3d5e08d85d25054ccb2f6ac57bf7db7ea4f0c8b9a60a2829ac4e7310822e289fa8ee4d25d9b4146014681ef16cb404ed2a03cf2d5e62

  • SSDEEP

    196608:p8/u+xgCR1D6Du6gUxL8wLszeEvf/QuN707b:aG+HD6yJUx9LnG70f

Malware Config

Signatures

  • Makes use of the framework's Accessibility service 2 TTPs 2 IoCs

    Retrieves information displayed on the phone screen using AccessibilityService.

  • Checks memory information 2 TTPs 1 IoCs

    Checks memory information which indicate if the system is an emulator.

  • Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

    Application may abuse the framework's foreground service to continue running in the foreground.

  • Reads the contacts stored on the device. 1 TTPs 1 IoCs
  • Reads the content of the call log. 1 TTPs 1 IoCs
  • Requests enabling of the accessibility settings. 1 IoCs
  • Acquires the wake lock 1 IoCs
  • Checks the presence of a debugger

Processes

  • com.android.systemgui
    1⤵
    • Makes use of the framework's Accessibility service
    • Checks memory information
    • Makes use of the framework's foreground persistence service
    • Reads the contacts stored on the device.
    • Reads the content of the call log.
    • Requests enabling of the accessibility settings.
    • Acquires the wake lock
    PID:4584

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/user/0/com.android.systemgui/databases/com.google.android.datatransport.events
    Filesize

    40KB

    MD5

    1cf3f63c021d755a21623e6d0e86dbc6

    SHA1

    e40e0f1faa61abcca7ba3394c54c92ff7334b49b

    SHA256

    100c67650ba652d547d8a1128edc550a8e95541a1d9268a199d1b924294d0895

    SHA512

    38d72e14f3513ffd26989cbda3df46ed3dd6e731bdfae56440eff6b64760cc13f91014281c9add61e018fe3529e49c63a6892ca22479515816c768b546244466

  • /data/user/0/com.android.systemgui/databases/com.google.android.datatransport.events-journal
    Filesize

    8KB

    MD5

    c6ae0a2208b3baa936b54d0b973f14bd

    SHA1

    b6de90229bef233f156f683b0eb1cb31bf68d4cf

    SHA256

    8b415b34fbe655dd066132eef4f7bbf0a8545cf113c3cf88e47d751599b98432

    SHA512

    9a7a55cefc9310aefbc617239503a7b4b2f435eeb4d6a5e12ba91d3de6e16c72ee5235f5fbd485c63af6a03e586baf6232c955168a82591660801c34d7044f7d

  • /data/user/0/com.android.systemgui/databases/com.google.android.datatransport.events-journal
    Filesize

    512B

    MD5

    03adad4de615bb2db1f615c37cce4ccc

    SHA1

    a511302bf892f341f8b64f1806dc22582c7cef0a

    SHA256

    c3554e76f419dab30c5ded0a92e32a9407dfec607f6c0d43b7914b1f7c2e1876

    SHA512

    deddc25887b661964dc95e752754d63ad57e238f0c8d6113535c458d67b14bb103d131f5c4533bc9765a2e32017c329e56bff71be26b43aa1631056157347e9e

  • /data/user/0/com.android.systemgui/databases/com.google.android.datatransport.events-journal
    Filesize

    8KB

    MD5

    9dc787c6850af59ae0ea794e3cfafee1

    SHA1

    60577add561a8efcba0d08cb608d50fd31782cdf

    SHA256

    c277d0ab0999b50fde1ff93ed0a23ab320851f2ca5bedd0bda66dda8fb0eb423

    SHA512

    50ceacc24786c6cc8990c5e02297f1d8545e286248ee578fdd9b995cf7c92c78136ed66b0483e28fd0c553d059e827f4605598e32a7ccd18e3cef2452f66e73e

  • /data/user/0/com.android.systemgui/databases/google_app_measurement_local.db
    Filesize

    16KB

    MD5

    d9cf75fdd1c2292d986f6c3d5d60f2c8

    SHA1

    07ecb1d3a26d952ae5fecf54f36699ab498510b1

    SHA256

    2d227e9b7a044c8e10294f6a831fb92d81ea9582381796d87f35bd268e37538a

    SHA512

    442c96e4b4c79b8d1c64dd3a6d6088ae1dace441e78d830dfb3190ee1c0fafebc606fb432071b4a1ad1a4ba9b68c7877b0bce520ccc88708feaf82bbc474e0cb

  • /data/user/0/com.android.systemgui/databases/google_app_measurement_local.db
    Filesize

    16KB

    MD5

    1488a102d2f54df3339f67764ec82435

    SHA1

    d911d84b469cd6f23f0a4b37e81b075b907a91d8

    SHA256

    bcf90217672f215c7b3f126c0d4e518ff051ebfbe92c7cfc340c8ea51aecb5df

    SHA512

    e8c14b31821cd99a0d4d36c3672d5ce94e8a73255897fdb4be68e7bfab3d63138ed46870b6498f977ccb2c0e80f12e5baeaa7bd37c1147dfa6e47a08e614ccc8

  • /data/user/0/com.android.systemgui/databases/google_app_measurement_local.db
    Filesize

    16KB

    MD5

    611eb7af88f77b92a6f54c61b7ace38f

    SHA1

    bd43c318d15533577a329fb1378ae4848a5c77fc

    SHA256

    019c4501c3093a759f4c5355593276a0d74a98ff0f6517eee4cfe2c574500ce5

    SHA512

    bd47a6a2123605dc5b016fedee5b2cd81857842316fac601c3c943b36765f3f525580a48d9b6ce85ecaf49a0de0ae0f7efc0ceae1f866d50094917d628672929

  • /data/user/0/com.android.systemgui/databases/google_app_measurement_local.db
    Filesize

    16KB

    MD5

    db18cacdf57645f9816ce9a3529dfb67

    SHA1

    507351bf31620e225bbb1e545b9a1801d28eec31

    SHA256

    abfa84f5cc23d08f96c5d7ffc591a703b16bd400a31c2dbcf4c202466eb1b9ca

    SHA512

    701c69fb5ceeebb8ed4d04ff61db65381e6284c06b10c7131cce7a802e8ef44d0639ba12031769282eb4ea1d96d1de243de80d2a5ae7a5b45aa2ceabcd9ea16e

  • /data/user/0/com.android.systemgui/databases/google_app_measurement_local.db
    Filesize

    16KB

    MD5

    e83dbab6510317ebc7a7495f7a006b30

    SHA1

    d20ee0239066606eb9308c4bb5f9600176a09244

    SHA256

    260cb0ae8a45ba41d4a4fe477ad468202952aa00d6d5f93885f441ee857af34d

    SHA512

    ab1adfc93d06dbe604aa85c01957431e1683ccc5f4393c8e45cea531ffee5a50166871bd0d7638a95f1e6b616d35cf549c859dab72559a20bf2512160a692f5e

  • /data/user/0/com.android.systemgui/databases/google_app_measurement_local.db
    Filesize

    16KB

    MD5

    8b95925bfb9491923ede49d4aeb4a004

    SHA1

    a5cb237c9b6bc562492034bb3abb06cc0dd99631

    SHA256

    1eaf3bf4f629dd64586d6b23f6bc96877b27bf703b18a3dd944105012f0ea44c

    SHA512

    50e224e7c9c5eb36ddf8c7a36553b378d9a332dd5add60151d530533d4d08129db7fc09b7fa508196f9e04e0abcb9ebf26aa3d024fd4ca7c3ab2b335404625e8

  • /data/user/0/com.android.systemgui/databases/google_app_measurement_local.db-journal
    Filesize

    512B

    MD5

    97e1279e08e131757e3e931d3362deac

    SHA1

    75a39ca81e737ca47e7673298900647821af03f8

    SHA256

    8c06b50a8ebf8c5f24322014b35dd6824200389da2913d30f52977b450f27b15

    SHA512

    4ea2011a63debb77ba10b73a320737c64f1e7f1904d2d8ab12a5546ef4e5abb7d00a333a84bbd8902f971f1b028b21cc89317cde8055780755024dde2b7e0bca

  • /data/user/0/com.android.systemgui/databases/google_app_measurement_local.db-journal
    Filesize

    8KB

    MD5

    84be18e94b2c1614431b63129d302af1

    SHA1

    f3e9c58c538ed66b2a80dc04d4f811923fed7867

    SHA256

    e4ab7d1054fce7dc8cf07c7ee9f31be6c3374929cde5580a41ec89a2037f9eb2

    SHA512

    50078fd99b10ea06e11e1eabd1d94fcbd6e82ae8a315460bd31456941885797303917c4067987cff9a51852e18d02478cadfa0c9ddbea11284f97f5cd2945391

  • /data/user/0/com.android.systemgui/databases/google_app_measurement_local.db-journal
    Filesize

    4KB

    MD5

    f09e3369ede6cd64fb38b6e965ccdd5c

    SHA1

    abfe48cea7a0f1fcec3aa84a37b7b5cf77cf7e32

    SHA256

    aa814e6adfdfb2d0f4cb40e5e709d89bf79a39e714ebc8acfd4d17148ddde7f3

    SHA512

    a41420739d1a51775e1517aa19d1069d8936e3f4387eec0aab16bba3745329a1392d9a9438c927ea80e02dc4df2bebd7846896e3705156f317197dc185afac8d

  • /data/user/0/com.android.systemgui/databases/google_app_measurement_local.db-journal
    Filesize

    8KB

    MD5

    7320fa0ad30566215f6f1e19f6f9e6a5

    SHA1

    4ebafd32eef27a6d9d9592ffdf8eff7d75353dd8

    SHA256

    a5fa56fffb6c433e298450086e1f1a7b4d80c6d609cc69e52a2bef76b700e498

    SHA512

    551a26434d4e1afd7ff5d30376bf3a26790122923a91cc06dfb9f2664e1facb8308778c5d22d4bebeaef06182f029d083516cad141f56e99e8c3e937b9e7d933

  • /data/user/0/com.android.systemgui/databases/google_app_measurement_local.db-journal
    Filesize

    8KB

    MD5

    013516c2e5f6d9b06eafb2ea7aea0b54

    SHA1

    177fcc976b7c5d2c22bf299f546511e32ed96b55

    SHA256

    34ff99bf3560068c9ec032216d32c6fe8bd32801b7b57aa48dd9399097264273

    SHA512

    c50db1259c9399393fe15786f067224334b6e9e1f13e426afef0c5f60728b476e6b004b20f601802706c60311f910a14c6aa14d21137a7ad38517a2ade705071

  • /data/user/0/com.android.systemgui/databases/google_app_measurement_local.db-journal
    Filesize

    8KB

    MD5

    89866614e23ef81cead115a038589480

    SHA1

    be8c3a5c825b6f6c24a73998eb083e9cdf68ab28

    SHA256

    542756e754c828384f2a72ef898e2fced385542378f8f6c49bf17c4b0e77602c

    SHA512

    39107109cc9c09348659feed9d8f9ee8106e3d170ebb3c2288419e380989c5b7133cf7d7f8b883ef1fbf8a567809943348c1944f0243403454e98223ca5f7991

  • /data/user/0/com.android.systemgui/databases/prdownloader.db
    Filesize

    16KB

    MD5

    a6b2869dce7d56502e895ac8f6d76ddd

    SHA1

    82d18095bf2617caa8298f9294a2206f6baf6558

    SHA256

    f2a1ff198b082b31f56906b6cd8fba96ad34e26d8f05c656cad5b9fefa3bcc38

    SHA512

    3ebb0248c634497e9428ec2413661236141fb5b5d632008deef15cd5022e73f46a4c01e63bdc0b3eaf69d7fd8a524a6331faf4af408fdb405d8660e3fd3e734b

  • /data/user/0/com.android.systemgui/databases/prdownloader.db-journal
    Filesize

    512B

    MD5

    a3956f2c620473a8c23d6fb919d16947

    SHA1

    3f5634a8ee94c21614a1ef5c12853e1db152b5e5

    SHA256

    ba1c142857ecfe38ae00dbef772a31529fa5b90b57d34094e1abdfae81a21c80

    SHA512

    66de509f4c7f6f3c6f8de4cffba067c394912bc007033c17f4fba5f91ca997cca45dd627cce49a04e66541145841cccfa26e3acc0b66f144e5e3940083923503

  • /data/user/0/com.android.systemgui/databases/prdownloader.db-journal
    Filesize

    8KB

    MD5

    cd5a4694188565c9590f7bb558336b0a

    SHA1

    6c14690f327172f7c5812281d46babc710bf584f

    SHA256

    2ac7912fd316fde3954e0337f52ff478d7e305fcd02dfb6bde3953a25943b484

    SHA512

    c1459fd82b5d3ac6b679e2219ebc579f6370047456343d4179cbf61e1a77534a191cbbf71df43bfebd063a4771ed167949b7aa34f35e003b064753c8cd77520e

  • /data/user/0/com.android.systemgui/databases/prdownloader.db-journal
    Filesize

    8KB

    MD5

    c6be7bf5b84373f013a9a31412b0b1a1

    SHA1

    67b1131519a8d1b1e1d46c17e976e6f30b11a31b

    SHA256

    92a1b036009b2707dd2f2f60f665a64142ab6d72d4740f367139cff1031022ec

    SHA512

    0111a971ea04dd97bb36a7897efbfcd669ce4ec81909294fb68c11b80327e1d02c28056a9a5ab2ee996bd3b6d8e85866191acf5e16044a8c3fa2b31e73dbafa0

  • /data/user/0/com.android.systemgui/databases/user_database-journal
    Filesize

    512B

    MD5

    cc1a62851334bd13ae774043661b0e85

    SHA1

    99b48b94ea46ebb22892af93e56912e4bcbc6ba4

    SHA256

    dde02e280c3edc61e31d2a3891b07e9fc276a483b843644b2b401b63df86a782

    SHA512

    8119b237a7dde54e7c325de19da7ac558a0c2597abda5feba961bc0896d360017874162da2856ba6a9e05d8713aba6ea7b18eb0f842a169ca8a0fd91a22c3c75

  • /data/user/0/com.android.systemgui/databases/user_database-wal
    Filesize

    16KB

    MD5

    fd88b2c956fa92abbcedc4a6152d4e31

    SHA1

    b1108e57870721f2c1740196ebdd295f75aa8433

    SHA256

    9cf797eeef901a160398927f2fb81ec6e44eeb960f4beea9c6846d0e721ecea3

    SHA512

    b96b32012aec46fb87efa73dc3a52e3521ab83a67a29b63e9a4b0eebf7b98db203abc8c5ec87fc882cf83c3b4c74025f3b1f20578ecf18df9e6a8f76bcd8b8d4

  • /data/user/0/com.android.systemgui/databases/user_database-wal
    Filesize

    152KB

    MD5

    e24a35e0bd94dc5b123999cdce9abe71

    SHA1

    27959f5454e201e20cffcf60d61f1f35249da542

    SHA256

    05cea87df24e98b18dc81ca15cd35dafc0f1dcb18bb5fa8fd4e28ee0e5c52606

    SHA512

    1b37b8e96f3bbfa487a03fd8d4c8fc22775f0131c3344a9a085fff95d138458a10c8419c569dea6f533ae7584cfedf4c7a46ef4be750a48f941ee7ed67cc4f90

  • /data/user/0/com.android.systemgui/databases/user_database-wal
    Filesize

    164KB

    MD5

    18931cea910f8f151d2719dc3194635d

    SHA1

    dc9462a1a6e03b1e6e8ec091242f20ba35aa17c0

    SHA256

    fdf3e1e2effafddaa5d99d9d4c176e80eda4a077d930a2ba6154dfc4270531f6

    SHA512

    ed2b4a8c02f12351d2af4dcb872994da09fd200fd4728a5d79905413cb169488bd4a45b01c287771cc23925f9e681bc373324d2b367c1c8ef6b304f822884ebd

  • /data/user/0/com.android.systemgui/files/.com.google.firebase.crashlytics/log-files/crashlytics-userlog-66169C5B016E000111E8B4B4D6D52FD7.temp
    Filesize

    361B

    MD5

    8494ce9d4656641319e403e0b9b5c75a

    SHA1

    617b982bb31fa54dbea3e8a2b8631ef4d7693a2a

    SHA256

    66b62b03c61dfa81efa9220a1d024eedea0c62e7f25c294e1210ccca79ab821a

    SHA512

    0616a167487999f40f09bf7a470fae422f9abd8cdeae0373f72b864822b9c2b313304e49bc1b8a2dc24af6c8db357a2f6af1a7ea58f7d62255d319368aa72015

  • /data/user/0/com.android.systemgui/files/.com.google.firebase.crashlytics/log-files/crashlytics-userlog-66169C5B016E000111E8B4B4D6D52FD7.temp.tmp
    Filesize

    16B

    MD5

    c33583fae4e0b61cde1c5b9227963237

    SHA1

    fe2ebe4d27469af1460f7e852031a04208ef629b

    SHA256

    35c6d6e5b93657e4a741a1cec71c21813fe05aab219909ebbb0f62fb0ae648dc

    SHA512

    fa09047004bec791b23f0dade0b64f8ab9bbd67555505e0d0818f6e89dfe56f474df80db0786d081d36adf23a5bacea40275ba043444a3a85d3d9612575bdd1e

  • /data/user/0/com.android.systemgui/files/.com.google.firebase.crashlytics/report-persistence/sessions/66169C5B016E000111E8B4B4D6D52FD7/report
    Filesize

    739B

    MD5

    f0c0282317bf31797819a1640dddadca

    SHA1

    3667841021618b87fb3cb120606cdb139620e338

    SHA256

    aefc80d345fa2cedc147179ded473bac9bfe8e5813e1ecd47d4c8dd689d76f88

    SHA512

    ae7614f342a1a312eda9667ceeaf217d109196cfaf80c3b5175c9222d0e3e962f06602d87c17094bb58aed4eadbc91a435337d9142dcb61fea7d21d72251e090

  • /data/user/0/com.android.systemgui/files/PersistedInstallation4695013873763499190tmp
    Filesize

    90B

    MD5

    dbd0c66095d9a52e7928d58e75ad9961

    SHA1

    ec20fab2b2220d66f0910dbbea761d7777b78d6f

    SHA256

    84e9c6aea402302a3e7aacc542e4c33cdaf945325bfac723fdbb4d1a20c9b6fc

    SHA512

    e1ffb0be88833abfb0ecc0b899f85ca682d5689a94ddc9801fd7c4b265cb1545286a22a862894e9f0f6a5114f0ca3063c55f8289cf1735402d3244774d826fa3

  • /data/user/0/com.android.systemgui/files/PersistedInstallation7759228245603362021tmp
    Filesize

    114B

    MD5

    72b4ef18289bb6e69fc30ebe14add3b7

    SHA1

    edf0b89aec8cb0aa0c88db7d6b12c7b427db6f2b

    SHA256

    e7bce8ef901d8ed268e2c8bb8b51b53b32c447cd948da8f3171f9312fde476a9

    SHA512

    068433df9e8c790a4b5976fdcd8f8fb17aef11e4804d8b419e9225c772b9957195c997d551ccdda1f0018912701c94d76ddbd283cb1d9ce4a971048fd15a5e3c

  • /data/user/0/com.android.systemgui/no_backup/androidx.work.workdb
    Filesize

    4KB

    MD5

    7e858c4054eb00fcddc653a04e5cd1c6

    SHA1

    2e056bf31a8d78df136f02a62afeeca77f4faccf

    SHA256

    9010186c5c083155a45673017d1e31c2a178e63cc15a57bbffde4d1956a23dad

    SHA512

    d0c7a120940c8e637d5566ef179d01eff88a2c2650afda69ad2a46aad76533eaace192028bba3d60407b4e34a950e7560f95d9f9b8eebe361ef62897d88b30cb

  • /data/user/0/com.android.systemgui/no_backup/androidx.work.workdb-journal
    Filesize

    512B

    MD5

    b03c01b175d12c20fc92215d139ad771

    SHA1

    1f66ba29e75bef980f0035846e88ac53e96deab0

    SHA256

    96b937541dc6f94facad2d1c6e45356d051bab6dc527e24c47af10ef6bcc8bcf

    SHA512

    48753205187082b526f1a239b8668170276fc75cb4f7f6e52c298fe0d9a2b3fc24f45b68522eb311318e1fcd5b89450989aadcb8b37f0215b78185d85eff255f

  • /data/user/0/com.android.systemgui/no_backup/androidx.work.workdb-shm
    Filesize

    32KB

    MD5

    bb7df04e1b0a2570657527a7e108ae23

    SHA1

    5188431849b4613152fd7bdba6a3ff0a4fd6424b

    SHA256

    c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479

    SHA512

    768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

  • /data/user/0/com.android.systemgui/no_backup/androidx.work.workdb-wal
    Filesize

    16KB

    MD5

    a2e10d4db59a22a71ad3b619ff20348d

    SHA1

    58caa69e2c6f037724c967f40adee7f12b947107

    SHA256

    ae4c8a3d7473194aaa7bcbd4644d9aaa19da3ff57f94601efcba8206546c9ab3

    SHA512

    bb9323f3304e24751855630f5be724eab9909aaedbcbd2e3d1a0ae48a6f57f17bbf6968c21638ecfd58d00182189df937c0d881a6611e8fb00bde17ea410fef8

  • /data/user/0/com.android.systemgui/no_backup/androidx.work.workdb-wal
    Filesize

    108KB

    MD5

    1c55523267d31ac66d0122d466d7f39e

    SHA1

    5e032399084a07cc98cf82d521ed738ceabcfd25

    SHA256

    eb51a8930c825b4446427e8720cfe9d5cb2408b7786d605742b3f11c600933dd

    SHA512

    f1f5ec1a9b792a9334af435d13a683575ca5b902429a40dce207a72f3eff2583572a651c008d6a12e9d1914ee32c4f464e93968d40c0aefb0598767f0bbe4252

  • /data/user/0/com.android.systemgui/no_backup/androidx.work.workdb-wal
    Filesize

    229KB

    MD5

    6e6f0d198e255cf1594ca1deb4b717e8

    SHA1

    ecdb2c9eeb97b9706d4e71deee5d441d59d7c632

    SHA256

    51721d738fa9d6b187cb7b4fc16192e1418cfa046566a119615b376c26c30615

    SHA512

    64ac74644fb588cac3208d7e1ab726e6543fa690a472112dfc36abd933a7b53b2f5362cff6ec009e3cb08efad25dae204517f0c9d8d4810904985f831234f373