Analysis
-
max time kernel
128s -
max time network
145s -
platform
android_x64 -
resource
android-x64-20240506-en -
resource tags
-
submitted
09-05-2024 22:01
General
-
Target
b6d214c58522d8c2ad5ddc3c496cdbb864794b81b5dc1da10d88929353acd617.apk
-
Size
3.7MB
-
MD5
05781192a3945575577091bdae8821b8
-
SHA1
1326ed12253a5a8cf4a0da8b764be81edae7829c
-
SHA256
b6d214c58522d8c2ad5ddc3c496cdbb864794b81b5dc1da10d88929353acd617
-
SHA512
c0fa2a6829615e12dbb19476ed7b39c4852370ae4386dd3513b0d5ad05515de5ad8b42614dadcc774bd7c83af2422737051ae9a521f4c502b2ad72b10d8e665d
-
SSDEEP
98304:EAmuECVyE78uJDvnrrT6qCYtEXvX7kI9UtsuiD:HWu1r3nCBrk5CuiD
Score
8/10
Malware Config
Signatures
-
Makes use of the framework's Accessibility service 4 TTPs 2 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
-
Acquires the wake lock 1 IoCs
-
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
Processes
-
com.tolstoyan.seismotherapy1⤵
- Makes use of the framework's Accessibility service
- Makes use of the framework's foreground persistence service
- Acquires the wake lock
- Uses Crypto APIs (Might try to encrypt user data)