Analysis
-
max time kernel
179s -
max time network
185s -
platform
android_x64 -
resource
android-x64-20240624-en -
resource tags
androidarch:x64arch:x86image:android-x64-20240624-enlocale:en-usos:android-10-x64system -
submitted
07-07-2024 22:04
Static task
static1
Behavioral task
behavioral1
Sample
e62de5d557d62604d526c7ca32440a59eca1416b05e08f9783393e7387f7fa28.apk
Resource
android-x86-arm-20240624-en
Behavioral task
behavioral2
Sample
e62de5d557d62604d526c7ca32440a59eca1416b05e08f9783393e7387f7fa28.apk
Resource
android-x64-20240624-en
Behavioral task
behavioral3
Sample
e62de5d557d62604d526c7ca32440a59eca1416b05e08f9783393e7387f7fa28.apk
Resource
android-x64-arm64-20240624-en
General
-
Target
e62de5d557d62604d526c7ca32440a59eca1416b05e08f9783393e7387f7fa28.apk
-
Size
1.5MB
-
MD5
29999e1946850b5ee947f19af46e941c
-
SHA1
250b23846236841c49159b8618cb0cee9f4ae63a
-
SHA256
e62de5d557d62604d526c7ca32440a59eca1416b05e08f9783393e7387f7fa28
-
SHA512
a16464ac4a2885b8b474676c1228e55b4bbae2272b64274a9d69b105abcad1e28e23f160bec8595d033c818f1428ed8bfe36d9cd90ed3551b1656e13bb1f63b9
-
SSDEEP
24576:vHhfesEQwdnDbFeS/8c3165miMfys6j8fo2a6z95nFLeH9fEkgk1WCP:vHdSnBeSkcF65miMu2a6MdzWw
Malware Config
Signatures
-
Makes use of the framework's Accessibility service 4 TTPs 1 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
Processes:
sampop.sampo.sampdescription ioc process Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId sampop.sampo.samp -
Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
-
Queries the phone number (MSISDN for GSM devices) 1 TTPs
-
Acquires the wake lock 1 IoCs
Processes:
sampop.sampo.sampdescription ioc process Framework service call android.os.IPowerManager.acquireWakeLock sampop.sampo.samp -
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
Processes:
sampop.sampo.sampdescription ioc process Framework service call android.app.IActivityManager.setServiceForeground sampop.sampo.samp -
Queries information about active data network 1 TTPs 1 IoCs
Processes:
sampop.sampo.sampdescription ioc process Framework service call android.net.IConnectivityManager.getActiveNetworkInfo sampop.sampo.samp -
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
Processes:
sampop.sampo.sampdescription ioc process Framework service call com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone sampop.sampo.samp -
Reads information about phone network operator. 1 TTPs
-
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
Processes:
sampop.sampo.sampdescription ioc process Framework service call android.app.IActivityManager.registerReceiver sampop.sampo.samp -
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
Processes:
sampop.sampo.sampdescription ioc process Framework API call javax.crypto.Cipher.doFinal sampop.sampo.samp
Processes
-
sampop.sampo.samp1⤵
- Removes its main activity from the application launcher
- Makes use of the framework's Accessibility service
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Queries information about active data network
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Uses Crypto APIs (Might try to encrypt user data)
PID:5063
Network
MITRE ATT&CK Mobile v15
Persistence
Event Triggered Execution
1Broadcast Receivers
1Foreground Persistence
1Defense Evasion
Foreground Persistence
1Hide Artifacts
1Suppress Application Icon
1Input Injection
1Discovery
Software Discovery
1Security Software Discovery
1System Network Configuration Discovery
3System Network Connections Discovery
1