Analysis

  • max time kernel
    763s
  • max time network
    770s
  • platform
    android_x64
  • resource
    android-33-x64-arm64-20240229-en
  • resource tags

    androidarch:arm64arch:x64image:android-33-x64-arm64-20240229-enlocale:en-usos:android-13-x64system
  • submitted
    23-04-2024 18:33

General

  • Target

    Avast.apk

  • Size

    4.5MB

  • MD5

    6103676bd7647fdde675acd3ea9fb92f

  • SHA1

    65ab09fe0354bb9efc68c31fed4f327c6fa0ed25

  • SHA256

    30ef5c7560a5b0db58964bf1cc7ab23ec3ce36b440b0e02fb6a7be43281749bd

  • SHA512

    69a90471a7e1cef99af68cfe85a91b27952f37b5b8b9aebbc339de09590ab311e1ba4aedb40a36b276aa1edd6eeb5250d70ab9dac26565b4c009ba7d00b12abc

  • SSDEEP

    98304:dPPyaxaJRqZ1cQKLbJyjsb+YimzXzB7Tt0t8lFv:oa8OcbJ8YNzti8

Malware Config

Signatures

  • Makes use of the framework's Accessibility service 4 TTPs 1 IoCs

    Retrieves information displayed on the phone screen using AccessibilityService.

  • Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

    Application may abuse the framework's foreground service to continue running in the foreground.

  • Requests enabling of the accessibility settings. 1 IoCs
  • Acquires the wake lock 1 IoCs

Processes

  • amazoncom.continent.white
    1⤵
    • Makes use of the framework's Accessibility service
    • Makes use of the framework's foreground persistence service
    • Requests enabling of the accessibility settings.
    • Acquires the wake lock
    PID:4298

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • /storage/emulated/0/Config/sys/apps/log/log-2024-04-23.txt
    Filesize

    13B

    MD5

    de2c41a51ee9246eb1708f65b511add0

    SHA1

    2f442d634c8a18760a232c8829d4b5d74a52f074

    SHA256

    ad2d914ca347cd1930e32f21c6d5448c34104bea181b93abc85ec518985653ab

    SHA512

    7cdfbd001594503644e9ed80ae852f90ef9e841a8382e2eec6979e149a2c400a3b83055d205b4d1d66e1600e5127482932d5127eb5800d35a4ee5673fe34d84a

  • /storage/emulated/0/Config/sys/apps/log/log-2024-04-23.txt
    Filesize

    21B

    MD5

    345f9660f814730692d30dee69f712c8

    SHA1

    81bf3256a8ba2cdac296e2789365e94e18b61c6b

    SHA256

    54c96885ebff33848ecc702b52183b1e8f104be1d8b53592a0ae3c1b90079414

    SHA512

    13f33200825a2fd55eec13b68e7deb763615675258b1f43149f1881203dde7cc6716fe4ef979d1cd134d622da0c49eb54569b4349f520d5cae149829e3e08e99

  • /storage/emulated/0/Config/sys/apps/log/log-2024-04-23.txt
    Filesize

    37B

    MD5

    9749192580b2ea878f269ff1664b2d65

    SHA1

    1672bf5830064ec049195bc4493d8e77be2cad9d

    SHA256

    db5760c25427f8ca5dd0f92b51c4d5d248621393ea5e33558d44adf8b2066d3b

    SHA512

    353be6a6b7e13b0a7a91161539a0541e0c9a0868c06e5c40f53182deee46363ddcf60a3f0e07191c5f7c83f128c8fcc39c91f3e7ecc32480970b163f892d18bc

  • /storage/emulated/0/Config/sys/apps/log/log-2024-04-23.txt
    Filesize

    57B

    MD5

    fc281aec3f71d1f954d3032743b69a6f

    SHA1

    15338b13c75b5579accff4752166074f9d89b55b

    SHA256

    bd8902c36b7f84382e16fc9803ca4e1d35de18746f14ce60306067737afdda32

    SHA512

    ab73323980dc647d1b8d24540e7fc2b749c99ef4633244387646d17b272c6d2c4f898f23c72ebbd14986bbfb05f81b715b72a1d40f8dfb253568dbda60c3ceac