Analysis
-
max time kernel
124s -
max time network
132s -
platform
android_x64 -
resource
android-x64-arm64-20240624-en -
resource tags
-
submitted
26-06-2024 22:00
General
-
Target
app.apk
-
Size
3.9MB
-
MD5
abd81cf3135d94171f458a9fd1daa846
-
SHA1
a9396a706bcf7b36927a6b12e34545c6836fed03
-
SHA256
36d899b738f0b6dd577c1222f51a0bb19cd038690d39c7b6be4e4c4c3687e2c4
-
SHA512
b4e5232125ae0db2f33e3ae763b0a7b71bc0eef12262451d1c46ac9208c155748f4f3cde0310f75fe9484a2daa737670fa66e473f8b0275f297b1b180d26b49b
-
SSDEEP
98304:7u/zIKslV+cJ3ooy5UC/SgWc624SY/j+p1c:7uKVpoomJSgWhSYCTc
Score
7/10
Malware Config
Signatures
-
Makes use of the framework's Accessibility service 4 TTPs 2 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Acquires the wake lock 1 IoCs
-
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
-
Performs UI accessibility actions on behalf of the user 1 TTPs 1 IoCs
Application may abuse the accessibility service to prevent their removal.
-
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
Processes
-
com.subdeltoid.armin1⤵
- Makes use of the framework's Accessibility service
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Performs UI accessibility actions on behalf of the user
- Uses Crypto APIs (Might try to encrypt user data)