Analysis
-
max time kernel
178s -
max time network
186s -
platform
android_x64 -
resource
android-x64-20240514-en -
resource tags
-
submitted
30/05/2024, 23:02
General
-
Target
0944febd5263fa81bff929a5a42cc2936a7040c91e50a274434a620db228f791.apk
-
Size
653KB
-
MD5
4eba04659822ba905fb6824a2b9ceb87
-
SHA1
a9799bf79a6873d0f8a6ed62beb91a1a4dae1958
-
SHA256
0944febd5263fa81bff929a5a42cc2936a7040c91e50a274434a620db228f791
-
SHA512
eb37783a88b580f00c8b6699808b500b86999af0150cec861b76ffbcdf560efba085721697feaa14a5c6676c314586e94ef888f325f76b97f313b41340efb909
-
SSDEEP
12288:6ZvKYorI1lIFwcA+Dh9lhjEjdU1L94mXu1vU8+F2:k2OlIFwcbB1EjUGmXQvt+F2
Malware Config
Signatures
-
Makes use of the framework's Accessibility service 4 TTPs 1 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Prevents application removal 1 TTPs 1 IoCs
Application may abuse the framework's APIs to prevent removal.
-
Checks CPU information 2 TTPs 1 IoCs
Checks CPU information which indicate if the system is an emulator.
-
Checks memory information 2 TTPs 1 IoCs
Checks memory information which indicate if the system is an emulator.
-
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
-
Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs
Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
-
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
-
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
-
Acquires the wake lock 1 IoCs
Processes
-
com.spacex.mmobile1⤵
- Makes use of the framework's Accessibility service
- Prevents application removal
- Checks CPU information
- Checks memory information
- Makes use of the framework's foreground persistence service
- Obtains sensitive information copied to the device clipboard
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Acquires the wake lock
Network
MITRE ATT&CK Mobile v15
Persistence
Event Triggered Execution
1Broadcast Receivers
1Foreground Persistence
1Defense Evasion
Foreground Persistence
1Impair Defenses
1Prevent Application Removal
1Input Injection
1Virtualization/Sandbox Evasion
2System Checks
2Credential Access
Clipboard Data
1Input Capture
2GUI Input Capture
1Keylogging
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
24B
MD51b27942acb7ef958e2c80f2a49cbecfb
SHA14b83ad3d47dfbc9ce8c41e53ccafed3e92009a6a
SHA2561a02a86841821a78da7f3a5d239fff824b34ef774652de2df7bb5cce13be274f
SHA512422ae59ab74079b1f2472e4fc48268eabbeb02888fc19d85fba4b3c35cde20885bd0fd9463794852d16e9ca776a2c1755967a12cbc2a2150323e828b8ef455ee
-
Filesize
8B
MD576249bb89a8dce79cdd45c83f657fc8d
SHA1d7928c466dfb3569eb21d47dd23a6a5286df26dc
SHA256fa14b031aa7050e02d4f02b647a74559eb3913a1a40d047f4d4779e8f3b30ea9
SHA5120d99dd3cafc857af9f9b8a8568466d3054bcc9cedb4f354ea45e5e726a647c072dd38c3d4f9887c7159489f41468fb291ad082dbe6578c9f78360cd6617b6407
-
Filesize
510B
MD57080ad066027e248f8f4759384a21f04
SHA160d44fd0a6c685d41ff0b5027ca8bb4e444e8657
SHA256acaaabcff38803646e8e993cb3c169df9fb5c0dd912e82743f379cfc4112c4b9
SHA5122183199286b65bfc12588410fa3080f38eb053101965f1dc284833847d4dedaf6a5f99dc761fc1116af7a06e7f71decb30620ed4b5ca9a664ba2644694d46b9a
-
Filesize
1KB
MD51b5018ea651c717ddac87a33aa154f55
SHA13a68052ce98a6663f94d212b5a5ed3d3a06e4c3e
SHA25667c3c60b9a14987728f6811bdb8cf84aa7e26ec76fc9cfb39e79532705c0731b
SHA512ff58f8b0e505a0b1bd9a659ea41fe63fe08c87f39c8d61fa976e9c8eb84fd85f34c54b94fba08f2c77d370b925ea479e3b7bf3350f46ae1b826b62adf8836caa
-
Filesize
1KB
MD5a5fe52bd2d2e48b1acd5d41702a5f294
SHA1f841b66dc2b3022591af8a0c4cac7f5ad90903e9
SHA25671de5541970a140fb18c6166a0beebadacd3260dba742d0509ec55feff427edc
SHA5128d24f75320c6cf7f6cea8ce203051bf27d66bf54da60e933637ab6655a5d704ccfb8b9b6ad0fb8595022b121a5f24f7e5948e4857d60cc1b5de4da867d2b67bd
-
Filesize
1KB
MD50602ef16758bad05d47da72eab9abf83
SHA1aab2a914a28c4aa80cf54e953bec04af16a0da55
SHA2565cb24b6bf14fce384be019ee84071e0ce75bc7a66e171a65862200cd8e7ad5b1
SHA51271eb6119393af399dedf36679fbb71d0fea8f7cbc3fcd840d40653c48c3b52b6afa0259fc24aedf50c4fee90412fa1d6098e7fe0c1fea784a863252edfd588fe
-
Filesize
1KB
MD57da7f55f5c9631d237fd8b2b1120d15f
SHA1745a8e8b0902fca8bc734b08747a1bd4d529df39
SHA256d6e4f07e45ae9a463190120c7c0cd5d0fca43fdb88e1061d21eb98d78464e337
SHA512dba0cdd3e4c0e09502b8e3acf5b3832b164a17ba9171eee5d3283d405a15453b61eab4ca30c5c7b3ff880dc67bc4f247131e077761946ae901bf8b1c11a69cc3