Analysis
-
max time kernel
14s -
max time network
151s -
platform
android_x64 -
resource
android-x64-arm64-20240221-en -
resource tags
-
submitted
02-05-2024 00:43
General
-
Target
ea763f5f92a66c49bf09e411ed56aa91.apk
-
Size
1.4MB
-
MD5
ea763f5f92a66c49bf09e411ed56aa91
-
SHA1
542e42f9c5bb76a52201f8201c9cb74ef42f6ca9
-
SHA256
fe1be052250f53b52017499744451c614e4771a392efa37afeb1b4774d861df0
-
SHA512
fdc5aa4c570b0e4af513f7f62d64a420ed42d378a1edc4ddb93aeacdb2216be4ed6e0f907170fb22cab2aced2d065792623f34ee0a38a52ccd7e298fd3a7060c
-
SSDEEP
24576:6uEHnPqQ7129BgZCl0e0llmRBfaLuUQFsudmNdhJSOfo5BcCdIuKZgpDAg/4zgdY:buPqxAZCOe0llgwBVSO07XKZgpDFzdgv
Malware Config
Signatures
-
Loads dropped Dex/Jar 1 TTPs 2 IoCs
Runs executable file dropped to the device during analysis.
-
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
-
Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.
-
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
-
Queries the phone number (MSISDN for GSM devices) 1 TTPs
-
Requests enabling of the accessibility settings. 1 IoCs
-
Acquires the wake lock 1 IoCs
-
Reads information about phone network operator. 1 TTPs
-
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
Processes
-
com.dewoleyulucobazu.mowesi1⤵
- Loads dropped Dex/Jar
- Makes use of the framework's foreground persistence service
- Queries information about the current Wi-Fi connection
- Queries the mobile country code (MCC)
- Requests enabling of the accessibility settings.
- Acquires the wake lock
- Uses Crypto APIs (Might try to encrypt user data)
Network
MITRE ATT&CK Mobile v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
MD57e858c4054eb00fcddc653a04e5cd1c6
SHA12e056bf31a8d78df136f02a62afeeca77f4faccf
SHA2569010186c5c083155a45673017d1e31c2a178e63cc15a57bbffde4d1956a23dad
SHA512d0c7a120940c8e637d5566ef179d01eff88a2c2650afda69ad2a46aad76533eaace192028bba3d60407b4e34a950e7560f95d9f9b8eebe361ef62897d88b30cb
-
Filesize
512B
MD5d08162f69bb6930d3b80ead47cc13094
SHA17d69d8bbd68d7cd9f7db0bed9e260883486610df
SHA2569d165ae5cee1e20598e07c70903d7d93f54f2f6d6bbc2faa28d21656384d65bf
SHA5128cc78da9cc39b34e3b4fccfbe7d70ff49e3b3bee91c09c6136567f8b8b835cf57512eb56bbebab82a2a08b9309736b32de3ee1751eea8b06a0820e367c7c0d5f
-
Filesize
32KB
MD5bb7df04e1b0a2570657527a7e108ae23
SHA15188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA256c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
SHA512768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012
-
Filesize
16KB
MD5b836a00e0b36231fa496ab4a31b6f54c
SHA17c7a48d3e3cf9e19d4c0cc426b68aa75e472a1ae
SHA25679bd9948338e79edf6c9693836f71b5e3c53ec33d079309be5d22f181e925921
SHA512c41464347638070bf800c00fa71dba9f0d012cab07b47b46e3fe01c3bb69059ddfaf01fdb9876963b63f7328f64b3ffe41de3013dbd94ba581f00e8846e6cf80
-
Filesize
112KB
MD53901f66eff72cd8ffeeb534e67772f42
SHA125fe47d0d6847665b188f200d47a1e25244233f6
SHA25641a0b32308b528b8f9fbb6a357ef9811c27bca058554906edf41f7faef28cd05
SHA512aed0483f094cced9ef1b7431cda1043d3c01d3fe5a802e93f54337d5e78d1a4cdb2b2463fd3f156306231f5aed58e56be8f9ef6fc2d58c79130c7cefa4cf2f52
-
Filesize
177KB
MD57fcdd704abdc80c9975d3376c16ea5bb
SHA1f91dc158b99474a188338196e31797aa610482db
SHA2569f97205277efe3e6d9202796f9226267f80a7b46b70200b6dd18399854017f67
SHA512c03d3c6f8c030dfaba20b001fd036633a0eec4dc727d3ba9d6aa08c6151536423517c6cec6d753c86a2a342b5e1483f7fb6978cf033d01a9f11c003e205fa670
-
Filesize
12KB
MD5bdf3529e80318eb14e53a5bf3720c10d
SHA125c9ace4b1af6e80ebb2572345972c56505969ba
SHA256bbc8300dd1e9cd08de8f66560c1ac2c928615b72b51cef9649f88974f586d64b
SHA51248b9c2d01171bb651b9b54826baa51f4add48431a3efd8ceb5f7cc3bcd6f8f37edf47fabb24349dd15b3a02329cd450f90a8d164bf4f8dfae554bf3b35a8a55b