Analysis
-
max time kernel
126s -
max time network
133s -
platform
android_x64 -
resource
android-x64-arm64-20240514-en -
resource tags
-
submitted
29-05-2024 23:05
General
-
Target
i.apk
-
Size
3.9MB
-
MD5
9f13cf568be897169486642fb1580013
-
SHA1
d3702031233d6c442bbacb5c1bd43eca6e02517e
-
SHA256
320962fdfaf126f942e173d8e3e7aa6c5da3577fa538c16796bd10e8166fa5a7
-
SHA512
124070450df268f5871835f0cd0a63dcd48453871a7365446621ec0959f1f8a2eb6196a683ef3085234d108191cfa6e8fc0ab9949b117ab9f7ce23e05564b8ea
-
SSDEEP
98304:ZpHsoushcDd/xTNAumRbLzHtq3xd5+HarQAFdeU4pQlJKqKgzRos:Zp/u7/AumbnN8N+HarX4pQegzJ
Score
8/10
Malware Config
Signatures
-
Makes use of the framework's Accessibility service 4 TTPs 2 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Prevents application removal 1 TTPs 1 IoCs
Application may abuse the framework's APIs to prevent removal.
-
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
-
Acquires the wake lock 1 IoCs
-
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
Processes
-
com.wrack.renounceable1⤵
- Makes use of the framework's Accessibility service
- Prevents application removal
- Makes use of the framework's foreground persistence service
- Acquires the wake lock
- Uses Crypto APIs (Might try to encrypt user data)