Analysis
-
max time kernel
178s -
max time network
187s -
platform
android_x64 -
resource
android-x64-arm64-20240514-en -
resource tags
-
submitted
30-05-2024 23:17
General
-
Target
fbca91109b321b0e9a483d33908fff0cf847aa7b0155d95455b2842913e60e73.apk
-
Size
852KB
-
MD5
256694acd2988e3f61ba02a2ad85b076
-
SHA1
53fc95d2a6b9a6294daeea0bc557eafb713da4ea
-
SHA256
fbca91109b321b0e9a483d33908fff0cf847aa7b0155d95455b2842913e60e73
-
SHA512
7694a044030ccaa552269a131a69ea8f143450bc961a01a2aeeb3bd7d236ae4295bc5ed99a7e4f1ef38b12e91ac3f36f197ddef606334d73b24aff9291893ffe
-
SSDEEP
12288:QksFZdds6RsMUTSwIITNTBvDWPRhSx58pi9Gv/njEjdUFT9jFNkMRn6F:QksvTSXBRiPRhSx58p5/jEjstkMRn6F
Malware Config
Signatures
-
Makes use of the framework's Accessibility service 4 TTPs 1 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Prevents application removal 1 TTPs 1 IoCs
Application may abuse the framework's APIs to prevent removal.
-
Removes its main activity from the application launcher 1 TTPs 1 IoCs
-
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
-
Requests enabling of the accessibility settings. 1 IoCs
-
Acquires the wake lock 1 IoCs
-
Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
Processes
-
com.ku.traffic1⤵
- Makes use of the framework's Accessibility service
- Prevents application removal
- Removes its main activity from the application launcher
- Makes use of the framework's foreground persistence service
- Requests enabling of the accessibility settings.
- Acquires the wake lock
- Requests disabling of battery optimizations (often used to enable hiding in the background).
Network
MITRE ATT&CK Mobile v15
Defense Evasion
Foreground Persistence
1Hide Artifacts
2Suppress Application Icon
1User Evasion
1Impair Defenses
1Prevent Application Removal
1Input Injection
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
8B
MD5afd7fa9519c6137adb2ec0af9d4ac222
SHA1942a2582c139413f4b77c90cbbdefa23679f816c
SHA2561b25ec012fdb852de1f1498785e817b7b5c90c0af4b8a2af11384048c08872bb
SHA512b56ae605b201d325e7570c1208aac4ccb945fb8ece52d81fbe0ac6cb0d99409a6bea41526c93be425c283137f7cc557b3693f7f8482a0a9089f7af6c63565e05
-
Filesize
584B
MD54853d61e7656fac7dc2e28c1836b290f
SHA13869eafcdd0a88f893ef9f9aef01f0f41e3ea718
SHA256b0de8da8e6cf67058c45b8b80031ee0e6cafbe6b2f51c925b18ac4eb2afbb343
SHA5128b60cecbf246d812f7d006220483d022291b2e3804cf13e86bf309db68f28a670c0d1f7513c6a0c1c80fcccb8ba15d005419e216f5869a525dc52505160a41bc
-
Filesize
1KB
MD50c1d55f92f0f009137bd388fbbf681ef
SHA11abd36fc5c5dc1b69b04ee07abccbe25b445378a
SHA2569f59aae6a1b67bb61aba74ad9baca748e9b129c84d044958c6e94e4643ea9ae7
SHA512416344d4ec7fc84cdd7f572c6490e907feef3f3624cc2b1746ffc5650b6d0d374d81d7f66fe4e49c2987e48aaccbb1b392959fe6426f1a363a60f649c0a0bf9d