fc2cbc8d925ee585cdc02e99bd467c8f943f891f377d3605a1e1329d33c7178b

Analysis

max time kernel
174s
max time network
131s
platform
android_x86
resource
android-x86-arm-20240514-en
resource tags

androidarch:armarch:x86image:android-x86-arm-20240514-enlocale:en-usos:android-9-x86system
submitted
21-05-2024 06:20

Target

fc2cbc8d925ee585cdc02e99bd467c8f943f891f377d3605a1e1329d33c7178b.apk
Size

631KB
MD5

77e3e03ba74747b0cbb3b2d72fa5dc8e
SHA1

6cf91fc0ca7b06a408fa40c55c43b8f3ee1c5983
SHA256

fc2cbc8d925ee585cdc02e99bd467c8f943f891f377d3605a1e1329d33c7178b
SHA512

faaaf30db4bedf9b63f036657530ab3031380e147ea38d1ecbafaa2785b91291c6f6e5112b8b9cc28f715eb577592130e1c56418a9069181c26e45ff9b80b35c
SSDEEP

12288:b9m4/lrMU5qnDfctsWfm9edzP5BTO/H+8X6F8oTD:b9dMbnzwdfm9ShFO/HfoTD

Score

7^/10

Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

Application may abuse the framework's foreground service to continue running in the foreground.

Foreground Persistence

Processes:

BSS.Absensi

description	ioc	Process
Framework service call	android.app.IActivityManager.setServiceForeground	BSS.Absensi

BSS.Absensi
1⤵
- Makes use of the framework's foreground persistence service
PID:4256

Initial Access

Execution

Persistence

Foreground Persistence

Privilege Escalation

Defense Evasion

Foreground Persistence

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

/storage/emulated/0/Absensi/ABS.db

Filesize
4KB

MD5
f2b4b0190b9f384ca885f0c8c9b14700

SHA1
934ff2646757b5b6e7f20f6a0aa76c7f995d9361

SHA256
0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514

SHA512
ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1

Download Submit
/storage/emulated/0/Absensi/ABS.db-journal

Filesize
512B

MD5
f0a2c7e12c1da0e516401a5d28193873

SHA1
e90fc848e1cb04212938bd5f6d4726634235b222

SHA256
ff8925b62f0e6d4dcc7e77dacac9afe061dcb64ab3886e66cbea831caf5efe2c

SHA512
eb012fd3a6cac09aa88282d2478c4c3dfae47674a9af737440a84eb8aa72ca63613cb98822d3a580f966ffe2d6b3e4b8fd2e3928c5083cba1f41e64a91f3cd1d

Download Submit
/storage/emulated/0/Absensi/ABS.db-shm

Filesize
32KB

MD5
bb7df04e1b0a2570657527a7e108ae23

SHA1
5188431849b4613152fd7bdba6a3ff0a4fd6424b

SHA256
c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479

SHA512
768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

Download Submit
/storage/emulated/0/Absensi/ABS.db-wal

Filesize
36KB

MD5
2184873f20c543475fea34dd40fd5bf1

SHA1
f99f12395e683f36669e7fa3ba3441a562492cab

SHA256
370871730fe729af9def5c8b89619c81998a26bdf60770b1c84471256ccf5fe3

SHA512
74d9e1b7fb7a0bd79e1b2d51c6235a0fe024a7866005dfb6a7ce94a910038fd9ea5e70d8d901c5dc44fa755f1b2283512ae45e3346a27912b6f8a0036e7a89f7

Download Submit