ae29301ef83709e61d6d4d242a0498ebfb96ca2401c7a42508d54173aa2aab5f

Analysis

max time kernel
179s
max time network
168s
platform
android_x86
resource
android-x86-arm-20240514-en
resource tags

androidarch:armarch:x86image:android-x86-arm-20240514-enlocale:en-usos:android-9-x86system
submitted
24-05-2024 01:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ae29301ef83709e61d6d4d242a0498ebfb96ca2401c7a42508d54173aa2aab5f.apk
Size

9.4MB
MD5

1cfc0ef1eb446a16783809cb817a0bcb
SHA1

839af4cc69e589f6fa51e1f9f6d781fb05e0848a
SHA256

ae29301ef83709e61d6d4d242a0498ebfb96ca2401c7a42508d54173aa2aab5f
SHA512

482871b170611124ffb68afbb83fea11ce7ef19165e8fccf3d668cff91bf918e8bdfba6cb25df79d9191768e4809e97d3a264b0596401fbb20d99b4dee3767b2
SSDEEP

98304:gB/aB7ljdsrxyZ3+xm0PUEb/rgNnsbymzvzB9T60tEvSj1WDt:gB/ujds24H5b/0I9z7ZAPDt

Score

8^/10

collection credential_access evasion execution persistence

Malware Config

Signatures

Makes use of the framework's Accessibility service 4 TTPs 1 IoCs

Retrieves information displayed on the phone screen using AccessibilityService.

collection evasion credential_access

T1516

T1513

T1417.001

T1417.002

Processes:

synthesis.element.waste

description	ioc	process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	synthesis.element.waste

Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
evasion persistence

T1541

Processes:

synthesis.element.waste

description ioc process

Framework service call android.app.IActivityManager.setServiceForeground synthesis.element.waste
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
persistence

T1624.001

Processes:

synthesis.element.waste

description ioc process

Framework service call android.app.IActivityManager.registerReceiver synthesis.element.waste
Acquires the wake lock 1 IoCs

Processes:

synthesis.element.waste

description ioc process

Framework service call android.os.IPowerManager.acquireWakeLock synthesis.element.waste
Schedules tasks to execute at a specified time 1 TTPs 1 IoCs
Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.
execution persistence

T1603

Processes:

synthesis.element.waste

description ioc process

Framework service call android.app.job.IJobScheduler.schedule synthesis.element.waste

description	ioc	process
Framework service call	android.app.IActivityManager.setServiceForeground	synthesis.element.waste

description	ioc	process
Framework service call	android.app.IActivityManager.registerReceiver	synthesis.element.waste

description	ioc	process
Framework service call	android.os.IPowerManager.acquireWakeLock	synthesis.element.waste

description	ioc	process
Framework service call	android.app.job.IJobScheduler.schedule	synthesis.element.waste

synthesis.element.waste
1⤵
- Makes use of the framework's Accessibility service
- Makes use of the framework's foreground persistence service
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Acquires the wake lock
- Schedules tasks to execute at a specified time
PID:4305

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

/storage/emulated/0/Config/sys/apps/log/log-2024-05-24.txt
Filesize
13B

MD5
de2c41a51ee9246eb1708f65b511add0

SHA1
2f442d634c8a18760a232c8829d4b5d74a52f074

SHA256
ad2d914ca347cd1930e32f21c6d5448c34104bea181b93abc85ec518985653ab

SHA512
7cdfbd001594503644e9ed80ae852f90ef9e841a8382e2eec6979e149a2c400a3b83055d205b4d1d66e1600e5127482932d5127eb5800d35a4ee5673fe34d84a

Download Submit
/storage/emulated/0/Config/sys/apps/log/log-2024-05-24.txt
Filesize
25B

MD5
d84ad9f9e186132fc6837e635c30fa13

SHA1
a58eb17c6d127297355545c3c13c90e389508804

SHA256
1bcf89bc7c9fe6e96e49804387b4d69cc6d354cc8b83b32a646832954dfdf9f0

SHA512
914634312fbd7b6f45068f2f8a4e5d38b62cb2a15915824c3045f3b8ab7d85144f8f828f8199f0ba6f6877d1205484875e0c6cfd23128c6e4f435ae02616c15f

Download Submit
/storage/emulated/0/Config/sys/apps/log/log-2024-05-24.txt
Filesize
21B

MD5
e24e1912b93c2679f04e808a267b3558

SHA1
dd8ceb9843ce6fb185075e1af4d529c11777c8c5

SHA256
e62e6e1b4a6a8d53929b58daa50e84dbb292ca9c66cba093de0e5ce9add558ca

SHA512
765a898bf62079dce25a043928e84ebc879da5c1e3a28805ef2c20424c23c585b82ffd2e2dfe59158e1292e99b34e18341b2ea059b5e7c2c4ccfa391a3dfebdc

Download Submit
/storage/emulated/0/Config/sys/apps/log/log-2024-05-24.txt
Filesize
25B

MD5
bdb821a955117250611e94cd23842584

SHA1
81edcea1b44f94cfc140710c8410d0696b760c67

SHA256
076eb89055ff3d929eb732e1002a0105652e628682a741151388ce1df3b6ec9d

SHA512
e52ffed4ee84acc414c530c239c8876d9e99c1f2b2c7626c0ed7fbe0c59b9cb8f8a5e9e983541bea3dfdb849dd3b9593df054c2482ed8bcda7c70ebd960ca268

Download Submit