Analysis
-
max time kernel
179s -
max time network
189s -
platform
android_x64 -
resource
android-x64-arm64-20240514-en -
resource tags
-
submitted
29-05-2024 21:54
General
-
Target
01b0e9cb7e864e753261b94e3e652254968d8188562a5abfc240d19fa783bc5f.apk
-
Size
4.6MB
-
MD5
2c36088fec061815bdcebb93aec8771d
-
SHA1
e84c7530b996cd455f6fdaaf5f852c39970edf42
-
SHA256
01b0e9cb7e864e753261b94e3e652254968d8188562a5abfc240d19fa783bc5f
-
SHA512
cd87c739d424312f961cb7a025dfd708cd07bd5ebbe09918934743a92596d6d2b8e8e33c9d3790eefd529209ca706c75486d2e307fefd3dd98c2aea126247f0e
-
SSDEEP
98304:u1kVoDshYuBmbMypvBSpoHogIbLD0euD0mD0/D0EgD0nAMD0ID0bD0xjP:ukVoAhJ3ympoHmbLDcDjDmDGDCFDtDGg
Malware Config
Signatures
-
Makes use of the framework's Accessibility service 4 TTPs 2 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Prevents application removal 1 TTPs 1 IoCs
Application may abuse the framework's APIs to prevent removal.
-
Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
-
Requests accessing notifications (often used to intercept notifications before users become aware). 1 TTPs 1 IoCs
-
Checks CPU information 2 TTPs 1 IoCs
Checks CPU information which indicate if the system is an emulator.
-
Checks memory information 2 TTPs 1 IoCs
Checks memory information which indicate if the system is an emulator.
-
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
-
Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs
Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
-
Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.
-
Acquires the wake lock 1 IoCs
Processes
-
com.sastiupana.newicon1⤵
- Makes use of the framework's Accessibility service
- Prevents application removal
- Requests accessing notifications (often used to intercept notifications before users become aware).
- Checks CPU information
- Checks memory information
- Makes use of the framework's foreground persistence service
- Obtains sensitive information copied to the device clipboard
- Queries information about the current Wi-Fi connection
- Acquires the wake lock
Network
MITRE ATT&CK Mobile v15
Defense Evasion
Foreground Persistence
1Impair Defenses
1Prevent Application Removal
1Input Injection
1Virtualization/Sandbox Evasion
2System Checks
2Credential Access
Access Notifications
1Clipboard Data
1Input Capture
2GUI Input Capture
1Keylogging
1Discovery
Software Discovery
1Security Software Discovery
1System Information Discovery
2System Network Connections Discovery
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
428B
MD58ea05750cd0afb6ebe66aa822129b7ed
SHA1fe5e49382cfd721198b206a978c9320f8ae4be18
SHA25637362894c27e9e68ced1b75fe56abbc286a3aa482a3f29de2d3992a5072b5871
SHA5121618f65affd3d7266cd48cead0a7d31629d6f13717ab3e2d4c3e021a3b03f43284a76ba437386b057382c18629ae17ef0dc1775a5c0e90e9cbdcc3f78e87839d
-
Filesize
4B
MD5098f6bcd4621d373cade4e832627b4f6
SHA1a94a8fe5ccb19ba61c4c0873d391e987982fbbd3
SHA2569f86d081884c7d659a2feaa0c55ad015a3bf4f1b2b0b822cd15d6c15b0f00a08
SHA512ee26b0dd4af7e749aa1a8ee3c10ae9923f618980772e473f8819a5d4940e0db27ac185f8a0e1d5f84f88bc887fd67b143732c304cc5fa9ad8e6f57f50028a8ff
-
Filesize
44KB
MD5d5d190e1180c5e6858c40a93f7526f12
SHA10d054f2e34776c8d5bcfd54d743831b9919618fe
SHA256274fe3e82fc2630d99809afd6a1c64768a77ed69c04b33e0df6a292a5a042203
SHA5120d58df37359d6e35f02ef95e4edcfb05fac6c3bc57d1c3e56e49fa7b6c66aef3f99b383cb14dc5a01b52bc6a0d4685f275fb30279aa26e8339a5e0b8416ba85e
-
Filesize
121KB
MD57b38720a0352dffa26411726c72dd2b0
SHA1b15e687f42abcdc12427f146a3115ef2259211f8
SHA2562013f490d45638cada331b3474ed65b9a43cec60da773accc98332e58c06336d
SHA5120df28f87da4f9beb3ca8c108f54021a2a1a1434771abbb5ba67a2736097f2287b05e5220a33e92c42ee13ecae1144714a422b986763712794f69e65bc44c83e3
-
Filesize
11B
MD51b65c10c6215685f9d621d797f911373
SHA1cc50aaed5cd521a62ec8cf9fe0413153ec90f265
SHA2562230c2b2787663a054c47450ecd1718f0296853ad768b8e5d306ecb912685e89
SHA5125a9139f295dbe384b1584eff5c11f3f86759232f7b661b75f27fe92b996b4cdc0552e315f79b26f5f2c1f91756d9ae04cf0c3675b6172e91a3d373b9b314496f
