Analysis
-
max time kernel
125s -
max time network
130s -
platform
android_x64 -
resource
android-x64-arm64-20240514-en -
resource tags
androidarch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20240514-enlocale:en-usos:android-11-x64system -
submitted
19-05-2024 22:02
Behavioral task
behavioral1
Sample
bc381d12a5c8ca86d373772da6bfa58eafa5e30bb23bd952b31e26d4822618c1.apk
Resource
android-x86-arm-20240514-en
Behavioral task
behavioral2
Sample
bc381d12a5c8ca86d373772da6bfa58eafa5e30bb23bd952b31e26d4822618c1.apk
Resource
android-x64-20240514-en
Behavioral task
behavioral3
Sample
bc381d12a5c8ca86d373772da6bfa58eafa5e30bb23bd952b31e26d4822618c1.apk
Resource
android-x64-arm64-20240514-en
Behavioral task
behavioral4
Sample
i.apk
Resource
android-x86-arm-20240514-en
Behavioral task
behavioral5
Sample
i.apk
Resource
android-x64-20240514-en
Behavioral task
behavioral6
Sample
i.apk
Resource
android-x64-arm64-20240514-en
General
-
Target
i.apk
-
Size
3.9MB
-
MD5
fb4c92934dbb3c8b06893a391cfcc593
-
SHA1
ee4aef0276ca2060c316a51e284bccfdcd0236fa
-
SHA256
6fccf43370d620708259e3dd5046bad4b40f0711a1709f37f01fac66338e03c4
-
SHA512
8be46c9bb5787d068a653aaa901794a54e0b99a72dcd3153fc093475bde4f8e6b3b6acf91929af6265c8975c3f83d6509e4b6dc36490c2492b5c45e372c9d540
-
SSDEEP
98304:b4rXoGtpHajJeWisENxYO00wZ/Z4lNWmu4n:a3yeWixxY/PZ424n
Malware Config
Signatures
-
Prevents application removal 1 TTPs 1 IoCs
Application may abuse the framework's APIs to prevent removal.
Processes:
com.hobits.euphoriasdescription ioc process Framework service call android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction com.hobits.euphorias -
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
Processes:
com.hobits.euphoriasdescription ioc process Framework service call android.app.IActivityManager.setServiceForeground com.hobits.euphorias -
Acquires the wake lock 1 IoCs
Processes:
com.hobits.euphoriasdescription ioc process Framework service call android.os.IPowerManager.acquireWakeLock com.hobits.euphorias -
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
Processes:
com.hobits.euphoriasdescription ioc process Framework API call javax.crypto.Cipher.doFinal com.hobits.euphorias