Overview

overview

8

Static

static

6

d8086f67d5...94.apk

android-9-x86

8

d8086f67d5...94.apk

android-10-x64

8

d8086f67d5...94.apk

android-11-x64

8

Analysis

  • max time kernel
    47s
  • max time network
    139s
  • platform
    android_x64
  • resource
    android-x64-arm64-20240514-en
  • resource tags

    androidarch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20240514-enlocale:en-usos:android-11-x64system
  • submitted
    21-05-2024 22:03

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    d8086f67d5e8a6b7746a4426ee1575532a848a6c40496b38014800b9c707b694.apk

  • Size

    637KB

  • MD5

    979662aee27daa88aab13fab18c6b33a

  • SHA1

    f0347b51b69cb833b58e1b16b134ad4fb2b431ca

  • SHA256

    d8086f67d5e8a6b7746a4426ee1575532a848a6c40496b38014800b9c707b694

  • SHA512

    091059696f075e5ae0a6f02972b090cf250299378adcfd7588119ab70fb12d6ca3a382092de9964146a0df594f3da3842eee7190cc959c6b4b7325378569fca4

  • SSDEEP

    12288:W97/BpkcQM1xXa8bBbeQ+uiX0gzCb9N6j2mjm8jEjdUn:W9lpN1xKeBbeQri5z92mjmSEjM

Score
8/10
collectioncredential_accessevasionpersistencestealthtrojan

Malware Config

Signatures

  • Makes use of the framework's Accessibility service 4 TTPs 1 IoCs

    Retrieves information displayed on the phone screen using AccessibilityService.

    collectionevasioncredential_access
  • Prevents application removal 1 TTPs 1 IoCs

    Application may abuse the framework's APIs to prevent removal.

    evasion
  • Removes its main activity from the application launcher 1 TTPs 1 IoCs
    stealthtrojanevasion
  • Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

    Application may abuse the framework's foreground service to continue running in the foreground.

    evasionpersistence
  • Requests enabling of the accessibility settings. 1 IoCs
  • Acquires the wake lock 1 IoCs
  • Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
    evasion

Processes

  • com.ku.falcon
    1⤵
    • Makes use of the framework's Accessibility service
    • Prevents application removal
    • Removes its main activity from the application launcher
    • Makes use of the framework's foreground persistence service
    • Requests enabling of the accessibility settings.
    • Acquires the wake lock
    • Requests disabling of battery optimizations (often used to enable hiding in the background).
    PID:4612

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/data/com.ku.falcon/files/profileinstaller_profileWrittenFor_lastUpdateTime.dat
    Filesize

    8B

    MD5

    d03fca3c97807ed351a6c7c0c45e7651

    SHA1

    542c6686d668b1eeeac4f79b229955746d458071

    SHA256

    7355523bf022217c797783256f1032713a9f2124f3998cff3dae4bd2dfe419b6

    SHA512

    8cdbb44b8a6b610640eab20367956ef6cc04d182812a21bcac69d4628011f1713d2f1527357794532cefe3b6ec85234eefa945cca1bbadf62cfc335164575c99

    Download Submit
  • /data/misc/profiles/cur/0/com.ku.falcon/primary.prof
    Filesize

    623B

    MD5

    215318d70797ff33ec47f5a35322f637

    SHA1

    6e7dafab0291778487354fc7d9d6177150337d18

    SHA256

    4e878748553ce1470397f50cfa2ecb246c7dfc754e1679a0f120f5affd558f3c

    SHA512

    323a6429022864b948241bcceef272b2d830fe8337a2744414c4d7f7cfb6fea7238444aacc583e797da4a8d5af4e1f19f73c43ad024e4e208b3d8722b17ccc4a

    Download Submit
  • /data/misc/profiles/cur/0/com.ku.falcon/primary.prof
    Filesize

    25B

    MD5

    b9d9e0f8902d129e1aeebff0ae7b725b

    SHA1

    cb0d2b4c9dd60a5c1fc6261fb581bcd3416fe781

    SHA256

    25a822139d06016af8be1296c0242b60e35074f94c713e03323636be1162ce91

    SHA512

    f158a9dc753e0cb41f71a98714ff02198c576bacdd792a6153fdaf6f9a7b52d8cfb6d09099a269d0c1b0d31e2ea5a307ea1db85115bdc6797887a6de36d597f6

    Download Submit