30ef5c7560a5b0db58964bf1cc7ab23ec3ce36b440b0e02fb6a7be43281749bd

Analysis

max time kernel
763s
max time network
770s
platform
android_x64
resource
android-33-x64-arm64-20240229-en
resource tags

androidarch:arm64arch:x64image:android-33-x64-arm64-20240229-enlocale:en-usos:android-13-x64system
submitted
23-04-2024 18:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Avast.apk
Size

4.5MB
MD5

6103676bd7647fdde675acd3ea9fb92f
SHA1

65ab09fe0354bb9efc68c31fed4f327c6fa0ed25
SHA256

30ef5c7560a5b0db58964bf1cc7ab23ec3ce36b440b0e02fb6a7be43281749bd
SHA512

69a90471a7e1cef99af68cfe85a91b27952f37b5b8b9aebbc339de09590ab311e1ba4aedb40a36b276aa1edd6eeb5250d70ab9dac26565b4c009ba7d00b12abc
SSDEEP

98304:dPPyaxaJRqZ1cQKLbJyjsb+YimzXzB7Tt0t8lFv:oa8OcbJ8YNzti8

Score

8^/10

collection credential_access evasion persistence

Malware Config

Signatures

Makes use of the framework's Accessibility service 4 TTPs 1 IoCs

Retrieves information displayed on the phone screen using AccessibilityService.

collection evasion credential_access

T1516

T1513

T1417.001

T1417.002

Processes:

amazoncom.continent.white

description	ioc	process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	amazoncom.continent.white

Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
evasion persistence

T1541

Processes:

amazoncom.continent.white

description ioc process

Framework service call android.app.IActivityManager.setServiceForeground amazoncom.continent.white
Requests enabling of the accessibility settings. 1 IoCs

Processes:

amazoncom.continent.white

description ioc process

Intent action android.settings.ACCESSIBILITY_SETTINGS amazoncom.continent.white
Acquires the wake lock 1 IoCs

Processes:

amazoncom.continent.white

description ioc process

Framework service call android.os.IPowerManager.acquireWakeLock amazoncom.continent.white

description	ioc	process
Framework service call	android.app.IActivityManager.setServiceForeground	amazoncom.continent.white

description	ioc	process
Intent action	android.settings.ACCESSIBILITY_SETTINGS	amazoncom.continent.white

description	ioc	process
Framework service call	android.os.IPowerManager.acquireWakeLock	amazoncom.continent.white

amazoncom.continent.white
1⤵
- Makes use of the framework's Accessibility service
- Makes use of the framework's foreground persistence service
- Requests enabling of the accessibility settings.
- Acquires the wake lock
PID:4298

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

/storage/emulated/0/Config/sys/apps/log/log-2024-04-23.txt
Filesize
13B

MD5
de2c41a51ee9246eb1708f65b511add0

SHA1
2f442d634c8a18760a232c8829d4b5d74a52f074

SHA256
ad2d914ca347cd1930e32f21c6d5448c34104bea181b93abc85ec518985653ab

SHA512
7cdfbd001594503644e9ed80ae852f90ef9e841a8382e2eec6979e149a2c400a3b83055d205b4d1d66e1600e5127482932d5127eb5800d35a4ee5673fe34d84a

Download Submit
/storage/emulated/0/Config/sys/apps/log/log-2024-04-23.txt
Filesize
21B

MD5
345f9660f814730692d30dee69f712c8

SHA1
81bf3256a8ba2cdac296e2789365e94e18b61c6b

SHA256
54c96885ebff33848ecc702b52183b1e8f104be1d8b53592a0ae3c1b90079414

SHA512
13f33200825a2fd55eec13b68e7deb763615675258b1f43149f1881203dde7cc6716fe4ef979d1cd134d622da0c49eb54569b4349f520d5cae149829e3e08e99

Download Submit
/storage/emulated/0/Config/sys/apps/log/log-2024-04-23.txt
Filesize
37B

MD5
9749192580b2ea878f269ff1664b2d65

SHA1
1672bf5830064ec049195bc4493d8e77be2cad9d

SHA256
db5760c25427f8ca5dd0f92b51c4d5d248621393ea5e33558d44adf8b2066d3b

SHA512
353be6a6b7e13b0a7a91161539a0541e0c9a0868c06e5c40f53182deee46363ddcf60a3f0e07191c5f7c83f128c8fcc39c91f3e7ecc32480970b163f892d18bc

Download Submit
/storage/emulated/0/Config/sys/apps/log/log-2024-04-23.txt
Filesize
57B

MD5
fc281aec3f71d1f954d3032743b69a6f

SHA1
15338b13c75b5579accff4752166074f9d89b55b

SHA256
bd8902c36b7f84382e16fc9803ca4e1d35de18746f14ce60306067737afdda32

SHA512
ab73323980dc647d1b8d24540e7fc2b749c99ef4633244387646d17b272c6d2c4f898f23c72ebbd14986bbfb05f81b715b72a1d40f8dfb253568dbda60c3ceac

Download Submit