fe1be052250f53b52017499744451c614e4771a392efa37afeb1b4774d861df0

General

Target

ea763f5f92a66c49bf09e411ed56aa91.apk
Size

1.4MB
MD5

ea763f5f92a66c49bf09e411ed56aa91
SHA1

542e42f9c5bb76a52201f8201c9cb74ef42f6ca9
SHA256

fe1be052250f53b52017499744451c614e4771a392efa37afeb1b4774d861df0
SHA512

fdc5aa4c570b0e4af513f7f62d64a420ed42d378a1edc4ddb93aeacdb2216be4ed6e0f907170fb22cab2aced2d065792623f34ee0a38a52ccd7e298fd3a7060c
SSDEEP

24576:6uEHnPqQ7129BgZCl0e0llmRBfaLuUQFsudmNdhJSOfo5BcCdIuKZgpDAg/4zgdY:buPqxAZCOe0llgwBVSO07XKZgpDFzdgv

Score

8^/10

collection credential_access discovery evasion impact persistence stealth trojan

Malware Config

Signatures

Makes use of the framework's Accessibility service 4 TTPs 2 IoCs

Retrieves information displayed on the phone screen using AccessibilityService.

collection evasion credential_access

Input Injection

T1516

Screen Capture

T1513

Keylogging

T1417.001

GUI Input Capture

T1417.002

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	com.dewoleyulucobazu.mowesi
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByText	com.dewoleyulucobazu.mowesi

Removes its main activity from the application launcher 1 TTPs 2 IoCs

stealth trojan evasion

Suppress Application Icon

T1628.001

pid	Process
5052	com.dewoleyulucobazu.mowesi
5052	com.dewoleyulucobazu.mowesi

Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

Application may abuse the framework's foreground service to continue running in the foreground.

evasion persistence

Foreground Persistence

T1541

description	ioc	Process
Framework service call	android.app.IActivityManager.setServiceForeground	com.dewoleyulucobazu.mowesi

Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.wifi.IWifiManager.getConnectionInfo	com.dewoleyulucobazu.mowesi

Queries the mobile country code (MCC) 1 TTPs 1 IoCs

discovery

System Network Configuration Discovery

T1422

description	ioc	Process
Framework service call	com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone	com.dewoleyulucobazu.mowesi

Queries the phone number (MSISDN for GSM devices) 1 TTPs
discovery

System Network Configuration Discovery
T1422

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs

persistence

Broadcast Receivers

T1624.001

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	com.dewoleyulucobazu.mowesi

Acquires the wake lock 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.dewoleyulucobazu.mowesi

Reads information about phone network operator. 1 TTPs
discovery

System Network Configuration Discovery
T1422

Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

impact

Data Encrypted for Impact

T1471

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	com.dewoleyulucobazu.mowesi

com.dewoleyulucobazu.mowesi
1⤵
- Makes use of the framework's Accessibility service
- Removes its main activity from the application launcher
- Makes use of the framework's foreground persistence service
- Queries information about the current Wi-Fi connection
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Acquires the wake lock
- Uses Crypto APIs (Might try to encrypt user data)
PID:5052

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Event Triggered Execution

1

T1624

Broadcast Receivers

1

T1624.001

Foreground Persistence

1

T1541

Privilege Escalation

Defense Evasion

Foreground Persistence

1

T1541

Hide Artifacts

1

T1628

Suppress Application Icon

Input Injection

Credential Access

Input Capture

2

T1417

GUI Input Capture

1

T1417.002

Keylogging

1

T1417.001

Discovery

System Network Configuration Discovery

3

T1422

System Network Connections Discovery

1

T1421

Lateral Movement

Collection

Input Capture

2

T1417

GUI Input Capture

1

T1417.002

Keylogging

Screen Capture

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

Input Injection

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.dewoleyulucobazu.mowesi/no_backup/androidx.work.workdb

Filesize
4KB

MD5
f2b4b0190b9f384ca885f0c8c9b14700

SHA1
934ff2646757b5b6e7f20f6a0aa76c7f995d9361

SHA256
0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514

SHA512
ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1

Download Submit
/data/data/com.dewoleyulucobazu.mowesi/no_backup/androidx.work.workdb-journal

Filesize
512B

MD5
d12a7238448e8980d3f8d0dd11776efe

SHA1
91b3a2d6da3f53fc824b91d4e3f096c583875539

SHA256
32034c7c342ad432fe2f2e2a55b03b35c2eeff45e13a1034e112740636bf0629

SHA512
7716a77a7f766add373b1bef2d470e672866789bde1716045914d59f4d26d5769f64a35af61d12cd4bf8ff05d11e7b9ce2da133bb42efa58e5065b02f14a83d3

Download Submit
/data/data/com.dewoleyulucobazu.mowesi/no_backup/androidx.work.workdb-shm

Filesize
32KB

MD5
bb7df04e1b0a2570657527a7e108ae23

SHA1
5188431849b4613152fd7bdba6a3ff0a4fd6424b

SHA256
c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479

SHA512
768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

Download Submit
/data/data/com.dewoleyulucobazu.mowesi/no_backup/androidx.work.workdb-wal

Filesize
16KB

MD5
599d8cbb3ab253c10b88ea428df7ffea

SHA1
d189b7b40346297e919a83425adf8417600f3bc0

SHA256
fc6c24219faf6387c29e10d954d25727a61f8fd050112876a01e5de97a8e1991

SHA512
27170cc86eb849d12b32d610b13684f1131a66d1a8aa18771d0d008357686cac4ada9686cd7fbe15404bf68f73febcae7d59f23a500d912f182d0b2ecf7c5516

Download Submit
/data/data/com.dewoleyulucobazu.mowesi/no_backup/androidx.work.workdb-wal

Filesize
112KB

MD5
feb0b8392308970b48cde4442952bee5

SHA1
ae29632265c3095da32000fc84060df8c8608774

SHA256
a740efd2048c570793a6d32fb313633fe445d1ad03fe8d4dd92da1840c193ff5

SHA512
208960ff5ad8491e2a4c1f5ea9824b12df2f1edb3fc23aebf1a64f979e8e0797e664aada7a2848bc4c36da2fa057b4f9808d27836e910a7af316971d637b7132

Download Submit
/data/data/com.dewoleyulucobazu.mowesi/no_backup/androidx.work.workdb-wal

Filesize
185KB

MD5
06109bbaa90f4be3acde1afca58dd7a2

SHA1
fd33e97a32ad54ff5e9c047706ecb55b17fafebf

SHA256
45ad01f4e666793d40f66dd838971c9a93926d3810df9d4d042d3fb759f101dd

SHA512
449e9cc521e062f9f512137164cefe9daa1dcadb4695619476b605bd365de6c516cf7af32a7fe7a610f4222e92fbf8eb8a5b10e1d7c26de97e9d2422c60efc8c

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads