Analysis
-
max time kernel
179s -
max time network
172s -
platform
android_x86 -
resource
android-x86-arm-20240611.1-en -
resource tags
-
submitted
11/06/2024, 22:12
General
-
Target
44cb9a9fe1ec9eb0ad20b2bbd6c4081d5c72f4bcad038077cecb4a1d13de46a6.apk
-
Size
2.9MB
-
MD5
7bf7be6fe91a26626818b7a00c7b25e4
-
SHA1
537f5248e5c2670ea9f16c42ece3c044fcf1eeee
-
SHA256
44cb9a9fe1ec9eb0ad20b2bbd6c4081d5c72f4bcad038077cecb4a1d13de46a6
-
SHA512
96654fce8604d535a62707fe5ee8a68184bd708e0bcffbd8727d7fe95052cefb3904040669c3ea0dcee1b33c5c38bf58734f2e8f7c34003cbc028329a305cce4
-
SSDEEP
49152:7SoctcwrcGCxGgAyseVnN4zN41jxpSb5c7rS217Z2V+H82szeTuGHfY:7SYwrcGCxGgAys2Gzu1jx4F+S217sV9Z
Malware Config
Signatures
-
Removes its main activity from the application launcher 1 TTPs 1 IoCs
-
Makes use of the framework's Accessibility service 4 TTPs 2 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Acquires the wake lock 1 IoCs
-
Performs UI accessibility actions on behalf of the user 1 TTPs 36 IoCs
Application may abuse the accessibility service to prevent their removal.
-
Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
-
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
-
Schedules tasks to execute at a specified time 1 TTPs 1 IoCs
Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.
Processes
-
com.quitimias.du1⤵
- Removes its main activity from the application launcher
- Makes use of the framework's Accessibility service
- Acquires the wake lock
- Performs UI accessibility actions on behalf of the user
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Registers a broadcast receiver at runtime (usually for listening for system events)
-
com.quitimias.du:remote1⤵
- Schedules tasks to execute at a specified time
Network
MITRE ATT&CK Mobile v15
Persistence
Event Triggered Execution
1Broadcast Receivers
1Scheduled Task/Job
1Defense Evasion
Hide Artifacts
2Suppress Application Icon
1User Evasion
1Impair Defenses
1Prevent Application Removal
1Input Injection
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
33B
MD597726f39254c46d2399bd7a87c49d0d3
SHA18beead1f06362d9afc6af181fb182e613ccd3320
SHA2567a2e48f362b9c3d378eb0217295f068678bff1c484616f0f839c6b0bb2c5ce96
SHA5126577f1d13d54935edd9125adc34729bc0534bad7d4f237e8039c068776739822a57207dfb48d34ec7775ea7551dde52b7e341fc83496f06572b80e8ec358fe25
-
Filesize
57B
MD5a9ec0c42a43c72d73c499e5c17ccbb8b
SHA1731652fbfe61eac3fdb4b9d3e2eaa010848a0906
SHA2566c5309ce3f31c9af3288b0de3305b7f5ddee97be60ca4ac1184f3c334480c05b
SHA5125f8ed24a51f68cfa0627aceb9190d3a7febaee61bd5a89898ab113ddaa7ce2a41f129a28c4e200d5e5e4ddff7a483abc0393dc38e870782caf1c46d2ec0df2e3
-
Filesize
33B
MD5e3ea408d14b19a8815f5bac388c6bcf6
SHA1a3b4f028e48b7113948b9b118eb4d249bd6d16cb
SHA256d0526c544f259f717ffd99a1a82a5862a00b62dac19055d7513da0ef4e1250ed
SHA51203658b1a58a60db3583ceac8f407358ec675a241381d5f8657eb1feaa831f66bdbd3d91ab27b4ebe90015e84f1dfc1208e3649e41089db1268c0679c47e0de81
-
Filesize
33B
MD5365f074d64faad2f0f0c7784608e5b57
SHA12105b80d01621cbd370bec93f73709a7b67d565b
SHA2560c4662ed55fc03738e7903864ed0249c921b8f2d858531577eebd53501237cc4
SHA512d29b5c16d10a78b386ba1f4882f7e80bc6d41887671abe6a36c746b015ea280d4a26f3d2af323b4ad755c256e5851a5b95d0bda8882c6c0a2c125bc748fab47a
-
Filesize
288B
MD50d32564eed92b5d2d5afe0e00a83ddb4
SHA19935759a55b4cc4546d1f7bf038e718d77c550d1
SHA2560dcae3753b4c3b57c5ddbc479440cf109cff63a1aa0778df5107cbcaa5373014
SHA5127e4245688e37712f5cc224364af4cbb1dd5519c8b13d9ca534b07d75f44ae513b9917f20fc9f657eaaa68d2078e6b6a2528ff8a7051c80dd1159fb9a052df026