d37a174544220e93a0425afce2b1e76b8b29c97ce18588037ae76b45c26d08b8

Analysis

max time kernel
27s
max time network
152s
platform
android_x64
resource
android-x64-arm64-20240221-en
resource tags

androidarch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20240221-enlocale:en-usos:android-11-x64system
submitted
02-05-2024 00:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

86eb8c78cf477ddc6638da4f4271bba7.apk
Size

1.1MB
MD5

86eb8c78cf477ddc6638da4f4271bba7
SHA1

41e25c4c13458e192828b45bd764e3847dbef92a
SHA256

d37a174544220e93a0425afce2b1e76b8b29c97ce18588037ae76b45c26d08b8
SHA512

d67b1afed0897253aa7a91183526de80d28f9e5b4df2408170f7787fd56011655beaafb42c9ac1f62589601db438d93b0603e7e99704bef29cc5760ed7eea4bf
SSDEEP

24576:zD3rm/4IsL8HQfIjPjSv9AzC2M3jXdiV551DOup6U/Ujy1Zg/g56wQ0:nOS8HQfIn1zvM3ZiV/P/L1Zg/50

Score

7^/10

discovery evasion impact persistence

Malware Config

Signatures

Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

Application may abuse the framework's foreground service to continue running in the foreground.

evasion persistence

Foreground Persistence

T1541

description	ioc	Process
Framework service call	android.app.IActivityManager.setServiceForeground	com.yogadisodoxatuse.fapeze

Queries information about running processes on the device 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about running processes on the device.

discovery

Process Discovery

T1424

description	ioc	Process
Framework service call	android.app.IActivityManager.getRunningAppProcesses	com.yogadisodoxatuse.fapeze

Queries the mobile country code (MCC) 1 TTPs 1 IoCs

discovery

System Network Configuration Discovery

T1422

description	ioc	Process
Framework service call	com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone	com.yogadisodoxatuse.fapeze

Queries the phone number (MSISDN for GSM devices) 1 TTPs
discovery

System Network Configuration Discovery
T1422

Requests enabling of the accessibility settings. 1 IoCs

description	ioc	Process
Intent action	android.settings.ACCESSIBILITY_SETTINGS	com.yogadisodoxatuse.fapeze

Acquires the wake lock 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.yogadisodoxatuse.fapeze

Reads information about phone network operator. 1 TTPs
discovery

System Network Configuration Discovery
T1422

Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

impact

Data Encrypted for Impact

T1471

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	com.yogadisodoxatuse.fapeze

com.yogadisodoxatuse.fapeze
1⤵
- Makes use of the framework's foreground persistence service
- Queries information about running processes on the device
- Queries the mobile country code (MCC)
- Requests enabling of the accessibility settings.
- Acquires the wake lock
- Uses Crypto APIs (Might try to encrypt user data)
PID:4565

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Foreground Persistence

T1541

Privilege Escalation

Defense Evasion

Foreground Persistence

T1541

Credential Access

Discovery

Process Discovery

T1424

System Network Configuration Discovery

T1422

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

T1471

Replay Monitor

Loading Replay Monitor...

Downloads

/data/user/0/com.yogadisodoxatuse.fapeze/no_backup/androidx.work.workdb

Filesize
4KB

MD5
7e858c4054eb00fcddc653a04e5cd1c6

SHA1
2e056bf31a8d78df136f02a62afeeca77f4faccf

SHA256
9010186c5c083155a45673017d1e31c2a178e63cc15a57bbffde4d1956a23dad

SHA512
d0c7a120940c8e637d5566ef179d01eff88a2c2650afda69ad2a46aad76533eaace192028bba3d60407b4e34a950e7560f95d9f9b8eebe361ef62897d88b30cb

Download Submit
/data/user/0/com.yogadisodoxatuse.fapeze/no_backup/androidx.work.workdb-journal

Filesize
512B

MD5
09b6441bd800361b4b78bef2d850d453

SHA1
4af329956df3c13621f269585b8124f8c030565c

SHA256
40a3ab2fdd33b8992118e724034317aab6bff83609ea124edd7fb03239cf6d6e

SHA512
d99b815242ed56c933289939b9f646497b83410d815791a000b1d875a507bf22215670b942f8016e2d4b553cd1245fb8f25345b10020248d8269c220fe122348

Download Submit
/data/user/0/com.yogadisodoxatuse.fapeze/no_backup/androidx.work.workdb-shm

Filesize
32KB

MD5
bb7df04e1b0a2570657527a7e108ae23

SHA1
5188431849b4613152fd7bdba6a3ff0a4fd6424b

SHA256
c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479

SHA512
768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

Download Submit
/data/user/0/com.yogadisodoxatuse.fapeze/no_backup/androidx.work.workdb-wal

Filesize
16KB

MD5
c481a0b6efb0b2d5df21d842108adf69

SHA1
b2bc88b03e9d485e9367988d065682f9fd8e2907

SHA256
73d87dd2291a1edc54ab694ccdceb58cdd07fc1669feff164c8f543ebb364d8f

SHA512
4ac2de862c3e97d3fcfdb67349c0554a202ab743c3411cce7ed3261ae8553a1fe57ebe72fc46c23a4c3bd5736c2d236decf95385c1bd4ab83efee66dc9204155

Download Submit
/data/user/0/com.yogadisodoxatuse.fapeze/no_backup/androidx.work.workdb-wal

Filesize
108KB

MD5
ee6e1fb95d9a5993309830c3ce5f0045

SHA1
ea142d84680191739408fcbf077060d5520ba4ef

SHA256
3938cc852d6b30eae0dfbe3e9d742227b9b7e125c4f76255d7bd472d644cfceb

SHA512
aee97476f348869302e15dd73abb144566d6b80807be7b8ac37c2086ece97df4bdb1f51116635cc8f1c2604a2bb0f275dde3e833d920b4b6bd502111a85a3902

Download Submit
/data/user/0/com.yogadisodoxatuse.fapeze/no_backup/androidx.work.workdb-wal

Filesize
173KB

MD5
1b3aec97acafd9172ebde47bca547382

SHA1
7c27516214d4c26d375ac6a2cc582dc0e22dde91

SHA256
5cdd62508805c1e98dcea9ce5583047c4a78c2f4553077d00673b8cd20713bef

SHA512
24feeab8e18c2ea111099ac28b030b299623f61906e5e878f2ad9fde88d5a57de145ea0959a8e8f1ee4f3a20c1c6fc5f0082976e2da0681542bf44c299c828ae

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads