c0d42ce79a54343aabac5e737d42c621ecf06ffd94ac117d4bf9eecc4acc5aa0

Analysis

max time kernel
126s
max time network
132s
platform
android_x64
resource
android-x64-arm64-20240514-en
resource tags

androidarch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20240514-enlocale:en-usos:android-11-x64system
submitted
23-05-2024 22:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c0d42ce79a54343aabac5e737d42c621ecf06ffd94ac117d4bf9eecc4acc5aa0.apk
Size

3.9MB
MD5

98341d0629597b84ef1391856fb6ba8c
SHA1

62ced21668e6f5ea68b945608f98627f209cad39
SHA256

c0d42ce79a54343aabac5e737d42c621ecf06ffd94ac117d4bf9eecc4acc5aa0
SHA512

67c345de64dd06521d36d76787ea131ca60c9fd283ce5aad68f4bd4a73799f92b00635adfecf7b32c92cb13defc99ed2e84befb27635e51b9e72e19f85ad375b
SSDEEP

98304:pFMDOCLXKVHgTgoERjo4VGAFx/5jBXk/55meRVshFO+ibx:EaGKKLgvFLjZkhRVsWbx

Score

8^/10

evasion impact persistence

Malware Config

Signatures

Prevents application removal 1 TTPs 1 IoCs

Application may abuse the framework's APIs to prevent removal.

evasion

Prevent Application Removal

T1629.001

Processes:

com.kilndried.mesenterical

description	ioc	process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction	com.kilndried.mesenterical

Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
evasion persistence

Foreground Persistence
T1541

Processes:

com.kilndried.mesenterical

description ioc process

Framework service call android.app.IActivityManager.setServiceForeground com.kilndried.mesenterical
Acquires the wake lock 1 IoCs

Processes:

com.kilndried.mesenterical

description ioc process

Framework service call android.os.IPowerManager.acquireWakeLock com.kilndried.mesenterical
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
impact

Data Encrypted for Impact
T1471

Processes:

com.kilndried.mesenterical

description ioc process

Framework API call javax.crypto.Cipher.doFinal com.kilndried.mesenterical

description	ioc	process
Framework service call	android.app.IActivityManager.setServiceForeground	com.kilndried.mesenterical

description	ioc	process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.kilndried.mesenterical

description	ioc	process
Framework API call	javax.crypto.Cipher.doFinal	com.kilndried.mesenterical

com.kilndried.mesenterical
1⤵
- Prevents application removal
- Makes use of the framework's foreground persistence service
- Acquires the wake lock
- Uses Crypto APIs (Might try to encrypt user data)
PID:4517

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Foreground Persistence

T1541

Privilege Escalation

Defense Evasion

Foreground Persistence

T1541

Impair Defenses

T1629

Prevent Application Removal

T1629.001

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

T1471

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads