Analysis
-
max time kernel
52s -
max time network
155s -
platform
android_x64 -
resource
android-x64-20240221-en -
resource tags
-
submitted
01-05-2024 19:41
General
-
Target
d59a4848b584fdd93eb3d0b554a8df58.apk
-
Size
1.4MB
-
MD5
d59a4848b584fdd93eb3d0b554a8df58
-
SHA1
c60756e85bc596c61fdd4caf3fec9a0d995c4274
-
SHA256
32e4dee58ea17addc5df4ffb862ab3a8df1697598cb6437f92de4075665812c2
-
SHA512
2c34e5cac3ef7063f5ce145975b6fdd025753005b6352d1f2b83aac9c7cfd15f3e065dffb4aab9c1815626277d8c28ade94e5d7ae8803d7349a9f573fe6a0ee8
-
SSDEEP
24576:UsMX7QNP9BBPhW70qVZybbQe7mPbDYxNR18jregpfOV/4zgdfw:UjodEIqqXQe7ag/8regpfWzd4
Malware Config
Signatures
-
Makes use of the framework's Accessibility service 4 TTPs 2 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
-
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
-
Queries the phone number (MSISDN for GSM devices) 1 TTPs
-
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
-
Acquires the wake lock 1 IoCs
-
Reads information about phone network operator. 1 TTPs
-
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
Processes
-
com.gejalevubakupa.sugi1⤵
- Makes use of the framework's Accessibility service
- Makes use of the framework's foreground persistence service
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Acquires the wake lock
- Uses Crypto APIs (Might try to encrypt user data)
Network
MITRE ATT&CK Mobile v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
MD5f2b4b0190b9f384ca885f0c8c9b14700
SHA1934ff2646757b5b6e7f20f6a0aa76c7f995d9361
SHA2560a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514
SHA512ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1
-
Filesize
512B
MD58caa1162aa62bdf95c1f242c07f14f65
SHA11ae240644c6b5161737a7d14774c30ce322fb221
SHA2564e084659fcdadca25ca531847f97222c034c9477dd27bfea41cfcd49a865031e
SHA512d61cd15adf7a60def9371882b17aca8ec28f9a9d069fa5e324be226c86f4ebfe98127a79ac7758eca702f06c1c09221d5d5da6564e34d3de14be36cdc35eccc9
-
Filesize
32KB
MD5bb7df04e1b0a2570657527a7e108ae23
SHA15188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA256c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
SHA512768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012
-
Filesize
16KB
MD5ccff3300d65d912f34cbb18bb8b130f1
SHA12b1b9d58d965de516206afa86af30bfc3496893a
SHA256498bd1bffe34fa07d4ee90bd58735fce52561a24e7c6d2b4c6c784f491fe07c6
SHA5123b19197da5d39fe3d0443dc6a0a3e9f300ab289d6d587057ca17c1111ed84c4e29bbf41fe6cadc3bb3cd6311afc95100910512df80fe689e289816c55fb54b13
-
Filesize
112KB
MD50b3af07d1cc68a98018e90d7a6f48c35
SHA163479a43bbdd39f860048c0f28e70cc24a51b12c
SHA2565885fabf125281640dc76ff0ac531de9040628c4ace17e9bf49719ef45733597
SHA51264af6854e8f0974ccec946ea577b9c153a6b1e2bdad661dff59629cb84556f172407ca3f6349d654bf0aeb72616c968043a5b465ed0d992ba6a07f9a0e601868
-
Filesize
185KB
MD525bafaaba599dfb4eeb5cef1a2faf98a
SHA14aa66d6b5c37b1cef6c836b939a737a69c447dfc
SHA2568067c3f74a67b5bf34c06ac8a20fa959736dd4c9e614871225c197b72974184a
SHA5129cafa708f02fa69b17137af05c24f3538cbc85cf242535e838b4d59726567352da1e20d02d6f963d77b2ed903a5ff85e53ba0bbd2a11ec4101dd8f06edeaf8f4