Analysis
-
max time kernel
175s -
max time network
188s -
platform
android_x64 -
resource
android-x64-arm64-20240514-en -
resource tags
-
submitted
30/05/2024, 23:02
General
-
Target
0944febd5263fa81bff929a5a42cc2936a7040c91e50a274434a620db228f791.apk
-
Size
653KB
-
MD5
4eba04659822ba905fb6824a2b9ceb87
-
SHA1
a9799bf79a6873d0f8a6ed62beb91a1a4dae1958
-
SHA256
0944febd5263fa81bff929a5a42cc2936a7040c91e50a274434a620db228f791
-
SHA512
eb37783a88b580f00c8b6699808b500b86999af0150cec861b76ffbcdf560efba085721697feaa14a5c6676c314586e94ef888f325f76b97f313b41340efb909
-
SSDEEP
12288:6ZvKYorI1lIFwcA+Dh9lhjEjdU1L94mXu1vU8+F2:k2OlIFwcbB1EjUGmXQvt+F2
Malware Config
Signatures
-
Makes use of the framework's Accessibility service 4 TTPs 1 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Prevents application removal 1 TTPs 1 IoCs
Application may abuse the framework's APIs to prevent removal.
-
Checks CPU information 2 TTPs 1 IoCs
Checks CPU information which indicate if the system is an emulator.
-
Checks memory information 2 TTPs 1 IoCs
Checks memory information which indicate if the system is an emulator.
-
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
-
Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs
Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
-
Acquires the wake lock 1 IoCs
-
Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
Processes
-
com.spacex.mmobile1⤵
- Makes use of the framework's Accessibility service
- Prevents application removal
- Checks CPU information
- Checks memory information
- Makes use of the framework's foreground persistence service
- Obtains sensitive information copied to the device clipboard
- Acquires the wake lock
- Requests disabling of battery optimizations (often used to enable hiding in the background).
Network
MITRE ATT&CK Mobile v15
Defense Evasion
Foreground Persistence
1Hide Artifacts
1User Evasion
1Impair Defenses
1Prevent Application Removal
1Input Injection
1Virtualization/Sandbox Evasion
2System Checks
2Credential Access
Clipboard Data
1Input Capture
2GUI Input Capture
1Keylogging
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
8B
MD5995271b0b35ff74cc396d1392b30a940
SHA1bb8b281508a3b5811eb6cc7c8e91cd9dc1b07728
SHA256b31becd4b6842427a7dfb8c846afb849b659e4930b3a9de528253bd43a723a79
SHA51273fbe57ee724e3a8fb7612512b38bab4f6f41fbe107db7d4558488d8d6055ab0fc5b090a0fc2a2734b5e060c250b4ff5e6deda55c85cc8d06c2919a7220d3520
-
Filesize
510B
MD57080ad066027e248f8f4759384a21f04
SHA160d44fd0a6c685d41ff0b5027ca8bb4e444e8657
SHA256acaaabcff38803646e8e993cb3c169df9fb5c0dd912e82743f379cfc4112c4b9
SHA5122183199286b65bfc12588410fa3080f38eb053101965f1dc284833847d4dedaf6a5f99dc761fc1116af7a06e7f71decb30620ed4b5ca9a664ba2644694d46b9a
-
Filesize
1KB
MD5505aa8e73447fe65bfa694a0696f4193
SHA14c07b389e5af8ed8ae1ef62e444278863ce8741a
SHA2564bb187f570b9fa5b26544f6aadc2e7a3670ce57f19af34027634a36700a17936
SHA512449d37da6bbc4046ade7f117279cb319a7068901ff4196921ff9177a3899327568de631ac94f2b60b46ee20cd57322e8671736b684e85e22c2cb9c30e1169ed5