91fda73902e1a2a76b999df11caa4532c9c440d6f3da63dc03e0a78109d7583a

Analysis

max time kernel
149s
max time network
153s
platform
android_x86
resource
android-x86-arm-20240221-en
resource tags

androidarch:armarch:x86image:android-x86-arm-20240221-enlocale:en-usos:android-9-x86system
submitted
17-04-2024 22:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

91fda73902e1a2a76b999df11caa4532c9c440d6f3da63dc03e0a78109d7583a.apk
Size

4.6MB
MD5

b3f067b4dfea589351b3f5f25dfb1b3c
SHA1

4982a6e134a829373ac75c988b8f1717bb0782ef
SHA256

91fda73902e1a2a76b999df11caa4532c9c440d6f3da63dc03e0a78109d7583a
SHA512

14190a172461475458621a483e9b47cd6d8b0dee138e7d07cc8ac3e1ffbbf4d910ea61fb86ae5a80a5f88e1b4de4a5a90f18bf7d37f3996529d5e8d1bedae30a
SSDEEP

98304:x9hinlhin6Vhinahinx1hin6hinshinUhinyPSw9UwwriyP1qwgOBpOeaD18E/p:xbCzC6DC8CxjCcCyCKCy9UwwrtgfOBps

Score

8^/10

collection discovery evasion persistence

Malware Config

Signatures

Makes use of the framework's Accessibility service 2 TTPs 2 IoCs

Retrieves information displayed on the phone screen using AccessibilityService.

collection evasion

Input Injection

T1516

Screen Capture

T1513

Processes:

com.andamago.newicon

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	com.andamago.newicon
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId	com.andamago.newicon

Checks CPU information 2 TTPs 1 IoCs

Checks CPU information which indicate if the system is an emulator.

evasion discovery

System Checks

T1633.001

System Information Discovery

T1426

Processes:

com.andamago.newicon

description	ioc	Process
File opened for read	/proc/cpuinfo	com.andamago.newicon

Checks memory information 2 TTPs 1 IoCs

Checks memory information which indicate if the system is an emulator.

evasion discovery

System Checks

T1633.001

System Information Discovery

T1426

Processes:

com.andamago.newicon

description	ioc	Process
File opened for read	/proc/meminfo	com.andamago.newicon

Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

Application may abuse the framework's foreground service to continue running in the foreground.

evasion persistence

Foreground Persistence

T1541

Processes:

com.andamago.newicon

description	ioc	Process
Framework service call	android.app.IActivityManager.setServiceForeground	com.andamago.newicon

Acquires the wake lock 1 IoCs

Processes:

com.andamago.newicon

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.andamago.newicon

com.andamago.newicon
1⤵
- Makes use of the framework's Accessibility service
- Checks CPU information
- Checks memory information
- Makes use of the framework's foreground persistence service
- Acquires the wake lock
PID:4273

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Foreground Persistence

T1541

Privilege Escalation

Defense Evasion

Foreground Persistence

T1541

Input Injection

T1516

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Discovery

System Information Discovery

T1426

Lateral Movement

Collection

Screen Capture

T1513

Command and Control

Exfiltration

Impact

Input Injection

T1516

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.andamago.newicon/files/db.db

Filesize
44KB

MD5
d5d190e1180c5e6858c40a93f7526f12

SHA1
0d054f2e34776c8d5bcfd54d743831b9919618fe

SHA256
274fe3e82fc2630d99809afd6a1c64768a77ed69c04b33e0df6a292a5a042203

SHA512
0d58df37359d6e35f02ef95e4edcfb05fac6c3bc57d1c3e56e49fa7b6c66aef3f99b383cb14dc5a01b52bc6a0d4685f275fb30279aa26e8339a5e0b8416ba85e

Download Submit
/data/data/com.andamago.newicon/files/db.db

Filesize
4KB

MD5
2c6fe773f7cc42d162630d93a98fa91f

SHA1
a0d76f9403df661aea3017a0d912de03c415e3a9

SHA256
3855acc95e1e3648649a16c91abdcb1e2eb81826ae6171a0ab25c5b74452f186

SHA512
20436ab982d11ec32d69267c93c378e4ad92d8f840f5b412984af5aa0240f0eb8df757fdfde5ab95a2649c6f9862d9b633cd8dfcab5c07c1a4533072600c39a6

Download Submit
/data/data/com.andamago.newicon/files/db.db-journal

Filesize
4KB

MD5
3bc8b946e18721e29ed09e69657bcb14

SHA1
154bcfa0f275794e681e153a6605150b3fa616a3

SHA256
9c16fac55f547266328ab25f6ab5d4af3cc5f727ece5aed8247d35b4dd2ea802

SHA512
17917fc834254f6e8314f82912b1601c0b7dd605c7be162f65eafc7ab9d62d0e237fb6f0780360ba95c146549e324c86b1b714dea1e3dc8fb0e652bff7a9d34f

Download Submit
/data/data/com.andamago.newicon/files/db.db-shm

Filesize
32KB

MD5
bb7df04e1b0a2570657527a7e108ae23

SHA1
5188431849b4613152fd7bdba6a3ff0a4fd6424b

SHA256
c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479

SHA512
768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

Download Submit
/data/data/com.andamago.newicon/files/loading.gif

Filesize
121KB

MD5
7b38720a0352dffa26411726c72dd2b0

SHA1
b15e687f42abcdc12427f146a3115ef2259211f8

SHA256
2013f490d45638cada331b3474ed65b9a43cec60da773accc98332e58c06336d

SHA512
0df28f87da4f9beb3ca8c108f54021a2a1a1434771abbb5ba67a2736097f2287b05e5220a33e92c42ee13ecae1144714a422b986763712794f69e65bc44c83e3

Download Submit
/data/data/com.andamago.newicon/files/txtscreensize.txt

Filesize
11B

MD5
1b65c10c6215685f9d621d797f911373

SHA1
cc50aaed5cd521a62ec8cf9fe0413153ec90f265

SHA256
2230c2b2787663a054c47450ecd1718f0296853ad768b8e5d306ecb912685e89

SHA512
5a9139f295dbe384b1584eff5c11f3f86759232f7b661b75f27fe92b996b4cdc0552e315f79b26f5f2c1f91756d9ae04cf0c3675b6172e91a3d373b9b314496f

Download Submit