Analysis
-
max time kernel
37s -
max time network
152s -
platform
android_x64 -
resource
android-x64-arm64-20240221-en -
resource tags
androidarch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20240221-enlocale:en-usos:android-11-x64system -
submitted
01-05-2024 19:58
Behavioral task
behavioral1
Sample
dbf98b9b54fdd429ceb18b35158e44d4.apk
Resource
android-x86-arm-20240221-en
Behavioral task
behavioral2
Sample
dbf98b9b54fdd429ceb18b35158e44d4.apk
Resource
android-x64-20240221-en
Behavioral task
behavioral3
Sample
dbf98b9b54fdd429ceb18b35158e44d4.apk
Resource
android-x64-arm64-20240221-en
General
-
Target
dbf98b9b54fdd429ceb18b35158e44d4.apk
-
Size
1.4MB
-
MD5
dbf98b9b54fdd429ceb18b35158e44d4
-
SHA1
ae15f0e4c2c299adf52de17b51400fcf25479184
-
SHA256
d5ca7ba75cfb8fd76929c1b8f6547780d8305a6654b6423124d380ff59b0d1c9
-
SHA512
b8e7838627cd0346480aa456be863ecc6c56ce4b43fd408be9e104c1183b3d6c3b6fdc5f329e9f4e4421fec3599232e887803ba01959fe56c6a8b30da4fa1079
-
SSDEEP
24576:My/WPvDL4292BzHVFYixHq9bYHfumO9dRuKKiwBUH27m8AdWeUR1uffgpABG/4zb:F/W3f4292Bz1FYsHq9bYHfumscKKipw6
Malware Config
Signatures
-
Makes use of the framework's Accessibility service 4 TTPs 2 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
Processes:
com.camavoyaxiwokocu.huvusuwidescription ioc process Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByText com.camavoyaxiwokocu.huvusuwi Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId com.camavoyaxiwokocu.huvusuwi -
Loads dropped Dex/Jar 1 TTPs 2 IoCs
Runs executable file dropped to the device during analysis.
Processes:
com.camavoyaxiwokocu.huvusuwiioc pid process /system_ext/framework/androidx.window.sidecar.jar 4481 com.camavoyaxiwokocu.huvusuwi /system_ext/framework/androidx.window.sidecar.jar 4481 com.camavoyaxiwokocu.huvusuwi -
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
Processes:
com.camavoyaxiwokocu.huvusuwidescription ioc process Framework service call android.app.IActivityManager.setServiceForeground com.camavoyaxiwokocu.huvusuwi -
Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.
Processes:
com.camavoyaxiwokocu.huvusuwidescription ioc process Framework service call android.net.wifi.IWifiManager.getConnectionInfo com.camavoyaxiwokocu.huvusuwi -
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
Processes:
com.camavoyaxiwokocu.huvusuwidescription ioc process Framework service call com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone com.camavoyaxiwokocu.huvusuwi -
Queries the phone number (MSISDN for GSM devices) 1 TTPs
-
Requests enabling of the accessibility settings. 1 IoCs
Processes:
com.camavoyaxiwokocu.huvusuwidescription ioc process Intent action android.settings.ACCESSIBILITY_SETTINGS com.camavoyaxiwokocu.huvusuwi -
Acquires the wake lock 1 IoCs
Processes:
com.camavoyaxiwokocu.huvusuwidescription ioc process Framework service call android.os.IPowerManager.acquireWakeLock com.camavoyaxiwokocu.huvusuwi -
Reads information about phone network operator. 1 TTPs
-
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
Processes:
com.camavoyaxiwokocu.huvusuwidescription ioc process Framework API call javax.crypto.Cipher.doFinal com.camavoyaxiwokocu.huvusuwi
Processes
-
com.camavoyaxiwokocu.huvusuwi1⤵
- Makes use of the framework's Accessibility service
- Loads dropped Dex/Jar
- Makes use of the framework's foreground persistence service
- Queries information about the current Wi-Fi connection
- Queries the mobile country code (MCC)
- Requests enabling of the accessibility settings.
- Acquires the wake lock
- Uses Crypto APIs (Might try to encrypt user data)
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
/data/user/0/com.camavoyaxiwokocu.huvusuwi/no_backup/androidx.work.workdbFilesize
4KB
MD57e858c4054eb00fcddc653a04e5cd1c6
SHA12e056bf31a8d78df136f02a62afeeca77f4faccf
SHA2569010186c5c083155a45673017d1e31c2a178e63cc15a57bbffde4d1956a23dad
SHA512d0c7a120940c8e637d5566ef179d01eff88a2c2650afda69ad2a46aad76533eaace192028bba3d60407b4e34a950e7560f95d9f9b8eebe361ef62897d88b30cb
-
/data/user/0/com.camavoyaxiwokocu.huvusuwi/no_backup/androidx.work.workdb-journalFilesize
512B
MD5cdc8da5665c0dfdf272a7751b9a60452
SHA10b6110a620ae381a46bc335c19451cf23b0a3155
SHA256e5655d52bebba32a2eb0c6b2a8875bd8dcf97242df08b32aa46ed8d267088289
SHA5125a93a64cc13f988341a94f1c6be73981cf3a32015f2fe4132dfeb3067229c9f66202c11618e51ae97f53b723da3002b3fdbd673810e6ea4cd16f3290ada4d60c
-
/data/user/0/com.camavoyaxiwokocu.huvusuwi/no_backup/androidx.work.workdb-shmFilesize
32KB
MD5bb7df04e1b0a2570657527a7e108ae23
SHA15188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA256c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
SHA512768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012
-
/data/user/0/com.camavoyaxiwokocu.huvusuwi/no_backup/androidx.work.workdb-walFilesize
16KB
MD56ad42c99f8fe76c2d8e491f2a30e10b2
SHA1036cfa016951ff42b99f5f3dabece6e5c517645b
SHA2562daac197d77a41d321a6b6354ed4c71af5ab6bf10848246deab987f0b5f674c4
SHA51246dd405964e5c9a608d8411fc3ffe0ef2d07d4a574e1cde891c3442ec52180ce7d843ea53b8bd211a4205531118071246c1453a05ac62892cfe77c1ea5b2bb57
-
/data/user/0/com.camavoyaxiwokocu.huvusuwi/no_backup/androidx.work.workdb-walFilesize
112KB
MD5c3ba3d7fd138c886e5640e4369ef8b5f
SHA140b0cfdce51b6d0c0057c7b69b9ae7479ea66310
SHA2568d297a4f22cf0c4440d65902ce0a2864e4feeee3990cd9c4327a5cc5229e6cd1
SHA512210fbaf5d1fe5ae10e48fee873780351eb25d80456ebdc91b313d22a21d262d0ae63b1aa2b1a6abfe2bea5d10ce2888ed5b494461e9887a3f09f776183b21584
-
/data/user/0/com.camavoyaxiwokocu.huvusuwi/no_backup/androidx.work.workdb-walFilesize
177KB
MD59a70689cba277802787102139212a502
SHA1729433ed46d0049800b60fb92ae5c1e61d3927c8
SHA2569b5ea4b437edcbff8669df4e7c4d485db078e0e70971f87fcde5752f1355c049
SHA5122805a7d217623bd43c08135e685df8e044595f4a52d1c0ce5750bf87015e0bb30e28efb1745bb6f9da38057787d153a9f18b2b49d3726d09e7939c605940cc65
-
/system_ext/framework/androidx.window.sidecar.jarFilesize
12KB
MD5bdf3529e80318eb14e53a5bf3720c10d
SHA125c9ace4b1af6e80ebb2572345972c56505969ba
SHA256bbc8300dd1e9cd08de8f66560c1ac2c928615b72b51cef9649f88974f586d64b
SHA51248b9c2d01171bb651b9b54826baa51f4add48431a3efd8ceb5f7cc3bcd6f8f37edf47fabb24349dd15b3a02329cd450f90a8d164bf4f8dfae554bf3b35a8a55b