Analysis
- max time kernel
126s - max time network
141s - platform
android_x64 - resource
android-x64-arm64-20240514-en - resource tags
androidarch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20240514-enlocale:en-usos:android-11-x64system - submitted
14/05/2024, 22:02
Behavioral task
behavioral1
Sample
e0e5bace7224aff2e742b393b572f6de8c425b7deb2fa6397a7445d1127de1fc.apk
Resource
android-x86-arm-20240514-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
e0e5bace7224aff2e742b393b572f6de8c425b7deb2fa6397a7445d1127de1fc.apk
Resource
android-x64-20240514-en
3 signatures
150 seconds
Behavioral task
behavioral3
Sample
e0e5bace7224aff2e742b393b572f6de8c425b7deb2fa6397a7445d1127de1fc.apk
Resource
android-x64-arm64-20240514-en
4 signatures
150 seconds
General
- Target e0e5bace7224aff2e742b393b572f6de8c425b7deb2fa6397a7445d1127de1fc.apk
- Size 3.7MB
- Sample240514-1yattsbb26
- SHA256 e0e5bace7224aff2e742b393b572f6de8c425b7deb2fa6397a7445d1127de1fc
- MD5 74f63d7c8e51f07b83ddc0c09c009d92
- SHA1 d005c80d45d759e9a550568f04dfb7d0df227627
- SHA512 2c593406dbfb156144cf52db27f63dae48d297a8e010910301e2d3b9c79aa0a3d7df471d8e9130e2046f06bfe4e2710078482d093fb6c5c72c55418c67190402
- SSDEEP 98304:nX65cXbElRY6Kt4EBPosjC/SbXIKekoUSWr:nX6aElRYW+PosjC/S8ITSWr
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Makes use of the framework's Accessibility service 4 TTPs 2 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
description ioc Process Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId com.tasc.brucin Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId com.tasc.brucin - Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
description ioc Process Framework service call android.app.IActivityManager.setServiceForeground com.tasc.brucin - Acquires the wake lock 1 IoCs
description ioc Process Framework service call android.os.IPowerManager.acquireWakeLock com.tasc.brucin - Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
description ioc Process Framework API call javax.crypto.Cipher.doFinal com.tasc.brucin