Analysis
- max time kernel
47s - max time network
132s - platform
android_x64 - resource
android-x64-arm64-20240611.1-en - resource tags
androidarch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20240611.1-enlocale:en-usos:android-11-x64system - submitted
14/06/2024, 00:22
Static task
static1
Behavioral task
behavioral1
Sample
681746480927bb0ea963274be95e56ffc5f56aa447003394b40bd9f2f094599c.apk
Resource
android-x86-arm-20240611.1-en
Behavioral task
behavioral2
Sample
681746480927bb0ea963274be95e56ffc5f56aa447003394b40bd9f2f094599c.apk
Resource
android-x64-20240611.1-en
Behavioral task
behavioral3
Sample
681746480927bb0ea963274be95e56ffc5f56aa447003394b40bd9f2f094599c.apk
Resource
android-x64-arm64-20240611.1-en
General
- Target 681746480927bb0ea963274be95e56ffc5f56aa447003394b40bd9f2f094599c.apk
- Size 3.2MB
- Sample240614-apd7sa1dnn
- SHA256 681746480927bb0ea963274be95e56ffc5f56aa447003394b40bd9f2f094599c
- MD5 5980eb10e48de34b102deff85d574be0
- SHA1 611f659aaf6cc2ae139ca857b8a80e4a118aa0cc
- SHA512 c1ae0a18f674fc2d3c802d3224ccfaaba65b40596107e4b1b098a47be99ba8ecb070ecf03d1202880a5d2eaf9b00b88836e2b33b6e5043b8257d7e1318c3a7c2
- SSDEEP 98304:yWJECs296ETOp2VgUk3XH2ZQvUzfrivHlA:yW6Cs2IwUkkHH08W
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Loads dropped Dex/Jar 1 TTPs 3 IoCs
Runs executable file dropped to the device during analysis.
ioc pid Process /system_ext/framework/androidx.window.sidecar.jar 4436 com.perl.gqm /system_ext/framework/androidx.window.sidecar.jar 4436 com.perl.gqm /data/user/0/com.perl.gqm/[email protected] 4436 com.perl.gqm - Makes use of the framework's Accessibility service 4 TTPs 1 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
description ioc Process Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId com.perl.gqm - Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs
Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
description ioc Process Framework service call android.content.IClipboard.addPrimaryClipChangedListener com.perl.gqm - Checks CPU information 2 TTPs 1 IoCs
description ioc Process File opened for read /proc/cpuinfo com.perl.gqm - Checks memory information 2 TTPs 1 IoCs
description ioc Process File opened for read /proc/meminfo com.perl.gqm
Processes
Network
MITRE ATT&CK Mobile v15
Defense Evasion
Download New Code at Runtime
1Input Injection
1Virtualization/Sandbox Evasion
2System Checks
2Credential Access
Clipboard Data
1Input Capture
2GUI Input Capture
1Keylogging
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path /data/user/0/com.perl.gqm/[email protected]
- Size 300B
- SHA256 ed26ed598d0393b52cb68fd71e26f7eb5fba998f72c1c30eae4622bb0752692f
- MD5 7c80da100acf95df2c9629e515898a6b
- SHA1 28c7d9a00126bc12a0760f9cc6270abea6866d73
- SHA512 b2eb8340ae3dd3ddbe2a5cf3de6b735a33bb15b51b728f01643fed02375c8962f37fcbd4827fd578cb73678847cc47c45290d763281be5caeded67fa8923c6a2
- MD5 SHA1 SHA512
- Path /data/user/0/com.perl.gqm/app_outdex/libdexprotector.4436.so
- Size 370KB
- SHA256 422bb97f93c6e69c43d0e47267dafc0a043ab3ae7cfbfd1930b56f6fe4353861
- MD5 93716cc80bb61aeab2afbbdec51ccbb1
- SHA1 066efb5f0c4a68520561bdb5691a3e3fbe8e8e2d
- SHA512 54718505600be76cd334d93c221faa10ae1fc14a7acea5d8ee1e0c1b56e40ba642c01b977c7c9cbeb81b98818f040f60227dc22738841ea9df9dac922ff3198b
- SSDEEP 6144:k3cGn65mVsUTBA1Dy0tPx6xCebDqXf1/jU3vRKQ:ksX5mVsUTP7xZbSf1rqL
- MD5 SHA1 SHA512 SSDEEP
- Path /system_ext/framework/androidx.window.sidecar.jar
- Size 12KB
- SHA256 bbc8300dd1e9cd08de8f66560c1ac2c928615b72b51cef9649f88974f586d64b
- MD5 bdf3529e80318eb14e53a5bf3720c10d
- SHA1 25c9ace4b1af6e80ebb2572345972c56505969ba
- SHA512 48b9c2d01171bb651b9b54826baa51f4add48431a3efd8ceb5f7cc3bcd6f8f37edf47fabb24349dd15b3a02329cd450f90a8d164bf4f8dfae554bf3b35a8a55b
- SSDEEP 384:6BDL3KyMB6PluKnxH1ybbC0t7dvBvi22OUHpR1H:C/8B6PluKXybbrZvBvi22OUHpRl
- MD5 SHA1 SHA512 SSDEEP