7b77dfd02850aaf5d9c978dd531cd35f720a92a83376e8d58cffcde26dfbcfb1

Analysis

max time kernel
125s
max time network
151s
platform
android_x64
resource
android-x64-20240514-en
resource tags

androidarch:x64arch:x86image:android-x64-20240514-enlocale:en-usos:android-10-x64system
submitted
23-05-2024 22:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

i.apk
Size

3.9MB
MD5

3b48d6176ebb206f48102dffe8c64d67
SHA1

9d003ff7195d5930554ac92934f34cb5dbeae0ae
SHA256

b655f341c88c73883f25cd6e12c1bf2c7e7e93af40ba2e1ac31cb4a749546a67
SHA512

7a254961f15653985ebdd072f12da224e211ee3f3503f7d7f37b8463c2d0f02141bba7fe3c8151bb24472112ead6b480628c31a3630dfffd844acea56d28fe65
SSDEEP

98304:GZcQHqHyEFcPBOffLa3WGJCateNzeDskD/sSJ67jQBBCu6Q6Xf:YXHqyQcPBMTyHJC6EeIkD8jQeQWf

Score

8^/10

evasion impact persistence

Malware Config

Signatures

Prevents application removal 1 TTPs 1 IoCs
Application may abuse the framework's APIs to prevent removal.
evasion

Prevent Application Removal
T1629.001

Processes:

com.fillowite.outrows

description ioc process

Framework service call android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction com.fillowite.outrows
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
evasion persistence

Foreground Persistence
T1541

Processes:

com.fillowite.outrows

description ioc process

Framework service call android.app.IActivityManager.setServiceForeground com.fillowite.outrows
Acquires the wake lock 1 IoCs

Processes:

com.fillowite.outrows

description ioc process

Framework service call android.os.IPowerManager.acquireWakeLock com.fillowite.outrows
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
impact

Data Encrypted for Impact
T1471

Processes:

com.fillowite.outrows

description ioc process

Framework API call javax.crypto.Cipher.doFinal com.fillowite.outrows

description	ioc	process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction	com.fillowite.outrows

description	ioc	process
Framework service call	android.app.IActivityManager.setServiceForeground	com.fillowite.outrows

description	ioc	process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.fillowite.outrows

description	ioc	process
Framework API call	javax.crypto.Cipher.doFinal	com.fillowite.outrows

com.fillowite.outrows
1⤵
- Prevents application removal
- Makes use of the framework's foreground persistence service
- Acquires the wake lock
- Uses Crypto APIs (Might try to encrypt user data)
PID:5155

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Foreground Persistence

T1541

Privilege Escalation

Defense Evasion

Foreground Persistence

T1541

Impair Defenses

T1629

Prevent Application Removal

T1629.001

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

T1471

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads