320962fdfaf126f942e173d8e3e7aa6c5da3577fa538c16796bd10e8166fa5a7

Analysis

max time kernel
126s
max time network
132s
platform
android_x64
resource
android-x64-arm64-20240514-en
resource tags

androidarch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20240514-enlocale:en-usos:android-11-x64system
submitted
29-05-2024 23:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

320962fdfaf126f942e173d8e3e7aa6c5da3577fa538c16796bd10e8166fa5a7.apk
Size

3.9MB
MD5

9f13cf568be897169486642fb1580013
SHA1

d3702031233d6c442bbacb5c1bd43eca6e02517e
SHA256

320962fdfaf126f942e173d8e3e7aa6c5da3577fa538c16796bd10e8166fa5a7
SHA512

124070450df268f5871835f0cd0a63dcd48453871a7365446621ec0959f1f8a2eb6196a683ef3085234d108191cfa6e8fc0ab9949b117ab9f7ce23e05564b8ea
SSDEEP

98304:ZpHsoushcDd/xTNAumRbLzHtq3xd5+HarQAFdeU4pQlJKqKgzRos:Zp/u7/AumbnN8N+HarX4pQegzJ

Score

8^/10

evasion impact persistence

Malware Config

Signatures

Prevents application removal 1 TTPs 1 IoCs
Application may abuse the framework's APIs to prevent removal.
evasion

Prevent Application Removal
T1629.001

Processes:

com.wrack.renounceable

description ioc process

Framework service call android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction com.wrack.renounceable
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
evasion persistence

Foreground Persistence
T1541

Processes:

com.wrack.renounceable

description ioc process

Framework service call android.app.IActivityManager.setServiceForeground com.wrack.renounceable
Acquires the wake lock 1 IoCs

Processes:

com.wrack.renounceable

description ioc process

Framework service call android.os.IPowerManager.acquireWakeLock com.wrack.renounceable
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
impact

Data Encrypted for Impact
T1471

Processes:

com.wrack.renounceable

description ioc process

Framework API call javax.crypto.Cipher.doFinal com.wrack.renounceable

description	ioc	process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction	com.wrack.renounceable

description	ioc	process
Framework service call	android.app.IActivityManager.setServiceForeground	com.wrack.renounceable

description	ioc	process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.wrack.renounceable

description	ioc	process
Framework API call	javax.crypto.Cipher.doFinal	com.wrack.renounceable

com.wrack.renounceable
1⤵
- Prevents application removal
- Makes use of the framework's foreground persistence service
- Acquires the wake lock
- Uses Crypto APIs (Might try to encrypt user data)
PID:4651

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Foreground Persistence

T1541

Privilege Escalation

Defense Evasion

Foreground Persistence

T1541

Impair Defenses

T1629

Prevent Application Removal

T1629.001

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

T1471

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads