46020c858067e71651b5ccac4c886eaca51a91de644932eb4b06271cf588bffc

Analysis

max time kernel
179s
max time network
181s
platform
android_x64
resource
android-x64-arm64-20240514-en
resource tags

androidarch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20240514-enlocale:en-usos:android-11-x64system
submitted
25-05-2024 23:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ready.apk
Size

9.3MB
MD5

7812d918f3358ab5daa99b89eb0e717e
SHA1

ce7d2d0735fa5058c1f825afe79d1d8a8fa5dac8
SHA256

46020c858067e71651b5ccac4c886eaca51a91de644932eb4b06271cf588bffc
SHA512

36c8cb1fbb058ad67bfb695a23b4d2b8febe998dbff08f24c2031924d551c551e5ec1bface9c51ce29ad6f2a08de90dc1772674c4aa3c0db72a07f0e614dc8e4
SSDEEP

98304:6oQTUTyqPyKKrr3F6VgKw5rnumzPzB8TL0tgdA4O:6pTQUK63jTnpze0cO

Score

8^/10

collection credential_access evasion persistence

Malware Config

Signatures

Makes use of the framework's Accessibility service 4 TTPs 1 IoCs

Retrieves information displayed on the phone screen using AccessibilityService.

collection evasion credential_access

Input Injection

T1516

Screen Capture

T1513

Keylogging

T1417.001

GUI Input Capture

T1417.002

Processes:

cnetcom.cited.activities

description	ioc	process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	cnetcom.cited.activities

Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
evasion persistence

Foreground Persistence
T1541

Processes:

cnetcom.cited.activities

description ioc process

Framework service call android.app.IActivityManager.setServiceForeground cnetcom.cited.activities
Acquires the wake lock 1 IoCs

Processes:

cnetcom.cited.activities

description ioc process

Framework service call android.os.IPowerManager.acquireWakeLock cnetcom.cited.activities

description	ioc	process
Framework service call	android.app.IActivityManager.setServiceForeground	cnetcom.cited.activities

description	ioc	process
Framework service call	android.os.IPowerManager.acquireWakeLock	cnetcom.cited.activities

cnetcom.cited.activities
1⤵
- Makes use of the framework's Accessibility service
- Makes use of the framework's foreground persistence service
- Acquires the wake lock
PID:4628

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Foreground Persistence

T1541

Privilege Escalation

Defense Evasion

Foreground Persistence

T1541

Input Injection

T1516

Credential Access

Input Capture

T1417

GUI Input Capture

T1417.002

Keylogging

T1417.001

Discovery

Lateral Movement

Collection

Input Capture

T1417

GUI Input Capture

T1417.002

Keylogging

T1417.001

Screen Capture

T1513

Command and Control

Exfiltration

Impact

Input Injection

T1516

Replay Monitor

Loading Replay Monitor...

Downloads

/storage/emulated/0/Config/sys/apps/log/log-2024-05-25.txt
Filesize
13B

MD5
de2c41a51ee9246eb1708f65b511add0

SHA1
2f442d634c8a18760a232c8829d4b5d74a52f074

SHA256
ad2d914ca347cd1930e32f21c6d5448c34104bea181b93abc85ec518985653ab

SHA512
7cdfbd001594503644e9ed80ae852f90ef9e841a8382e2eec6979e149a2c400a3b83055d205b4d1d66e1600e5127482932d5127eb5800d35a4ee5673fe34d84a

Download Submit
/storage/emulated/0/Config/sys/apps/log/log-2024-05-25.txt
Filesize
21B

MD5
307bb30d20d9e58d01d61b359f63ca14

SHA1
20a9312ee090df414bf0c21ea6f1ca33ab252b6a

SHA256
4810b89409f829aad1eaf616705d323a9fb062e2d37965e6ccb37f8eb909d552

SHA512
3bd9de9030e5a4365b241bd9626030333c3746791eb67f262a32581b7eecd0f9a7639779f8ae545be7a5c3a12990cb583a59eda4ca09cdce652a951fee366d45

Download Submit
/storage/emulated/0/Config/sys/apps/log/log-2024-05-25.txt
Filesize
21B

MD5
1892118c13284518940c9b030e81e31e

SHA1
43cfccb920c7dcaf2af53f5360a982a9a6aabc03

SHA256
fae2f316f855b5134e52bae8d5653d2aced10cc474d83d19f0817c9531e74e1c

SHA512
fb605fcfd51d28050811d958c5eac83c69c3ec5fbb82b24aeeb8e9b23dd6732d499bc2ab496d52e2730ff06927af76b7013787f7a9d788afc3d4aef7bf4007dd

Download Submit
/storage/emulated/0/Config/sys/apps/log/log-2024-05-25.txt
Filesize
57B

MD5
be10bac540cb99182e02fadf4de1ba11

SHA1
0f429d0684996a892d5fea8ec5b26b36cf3ba921

SHA256
d7f0672e83bc558bdcc2b14c51c826cc6fbcb6181e35baee7da3f02c9d1013b4

SHA512
a3eda5de4c089ddcb4e06951ef55def64873ad0257b7f82e137bc34a8bd3864c975b03bfb628187b3b1b79e0cf6cb623cf33ef6f48a559e3c738a5af42e6941b

Download Submit