fc2cbc8d925ee585cdc02e99bd467c8f943f891f377d3605a1e1329d33c7178b

Analysis

max time kernel
174s
max time network
148s
platform
android_x64
resource
android-x64-20240514-en
resource tags

androidarch:x64arch:x86image:android-x64-20240514-enlocale:en-usos:android-10-x64system
submitted
21-05-2024 06:20

Target

fc2cbc8d925ee585cdc02e99bd467c8f943f891f377d3605a1e1329d33c7178b.apk
Size

631KB
MD5

77e3e03ba74747b0cbb3b2d72fa5dc8e
SHA1

6cf91fc0ca7b06a408fa40c55c43b8f3ee1c5983
SHA256

fc2cbc8d925ee585cdc02e99bd467c8f943f891f377d3605a1e1329d33c7178b
SHA512

faaaf30db4bedf9b63f036657530ab3031380e147ea38d1ecbafaa2785b91291c6f6e5112b8b9cc28f715eb577592130e1c56418a9069181c26e45ff9b80b35c
SSDEEP

12288:b9m4/lrMU5qnDfctsWfm9edzP5BTO/H+8X6F8oTD:b9dMbnzwdfm9ShFO/HfoTD

Score

7^/10

Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

Application may abuse the framework's foreground service to continue running in the foreground.

Foreground Persistence

Processes:

BSS.Absensi

description	ioc	Process
Framework service call	android.app.IActivityManager.setServiceForeground	BSS.Absensi

Queries the unique device ID (IMEI, MEID, IMSI) 1 TTPs
discovery

System Network Configuration Discovery
T1422

BSS.Absensi
1⤵
- Makes use of the framework's foreground persistence service
PID:5208

Initial Access

Execution

Persistence

Foreground Persistence

Privilege Escalation

Defense Evasion

Foreground Persistence

Credential Access

Discovery

System Network Configuration Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

/storage/emulated/0/Absensi/ABS.db

Filesize
24KB

MD5
94d878dfd9a2d68ccd03c38321c2c374

SHA1
6703b2feade9b4d50f80e4418b90951c896c7165

SHA256
dacbe7641ea297b9a67eaf915225ab79be59e3089eeb021ccdf59bab81edece7

SHA512
88d55d65dae687837144b8c753b5f9a61bd2c1d3d89aa2817960bdd3d292a657e69f4e4f351a464569efb9297e1f1d471db946ea6b353218e7403ef60d075929

Download Submit
/storage/emulated/0/Absensi/ABS.db-journal

Filesize
512B

MD5
e751bc82019ade996a993086c438b7c0

SHA1
c4acf3c24ef134b9705598486dfdf08f9a2845a2

SHA256
54022c2ef5094a72f43ed3b243729a47038e275a97fcdea12879bc0126393e59

SHA512
b7592052e3f600c34b2d0cd5175e1b4bf0331ab4c4f0a5aac7b5e2684c3d4b624e99e1a2186e6dbe0645ace8f003ea3e546fffa26cd36a8309a3f2fbd6e30a88

Download Submit
/storage/emulated/0/Absensi/ABS.db-journal

Filesize
8KB

MD5
6832f9d4409fe827159687efc468513a

SHA1
8aa11b8da6074a106b5e71d0bd8a35a3dff92d21

SHA256
e2e03b80ef9fc0b437d91e2ee2a0d551011cb7d336c4ca23ca0e52fad42c39db

SHA512
0c99e810b69489d6df0503dae15f6b1f9f2f3b90ac6d12f3bb5f8d9fa7171a109d328057f3a9a1f6fb9b33ba5ac9b2c57ec9812442319fca6bc978935f1c4672

Download Submit
/storage/emulated/0/Absensi/ABS.db-journal

Filesize
4KB

MD5
6cca89f0ba62acdda83daafbe740533d

SHA1
c0482521785aada2acec7803601777fa73e2f5bd

SHA256
8cf89a01660bc5859450d8c3c82dec18bad10a6e7c503fa48ab6ff626255b9fa

SHA512
737729d0ec80b193544181e4f5a35ef6b92b00d0cd4f3d7b05b4a82add3b114411bc3b0e114776f84d1cdde07123b4f562c45a8829b9a7e5e8d9250c4015cc33

Download Submit