Analysis
-
max time kernel
127s -
max time network
143s -
platform
android_x86 -
resource
android-x86-arm-20240624-en -
resource tags
-
submitted
16-07-2024 22:01
General
-
Target
up.apk
-
Size
3.7MB
-
MD5
3658e9292d8c0b5f2457e25779a75a86
-
SHA1
6a5fb266fecf5770e94d5b98bda8a09dd53b73f6
-
SHA256
606b34104c31fc4210ee6f0efa7d30e4b6de93b3cb4be95db46066572f7ee8e5
-
SHA512
4e332ed18a373e9c70ef165e14ee32647a4086109e6b02d56c6c482faf09d5009992c164632a21fa7cc99e4b484b41997264fb00f384b27d45bf97c783bf3202
-
SSDEEP
98304:+j8kuL6FfQ+qURYZFK70DrJFGbCio04NeIi3aS/Y:hd4OTM0rmVn4NeIyY
Score
7/10
Malware Config
Signatures
-
Makes use of the framework's Accessibility service 4 TTPs 2 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Acquires the wake lock 1 IoCs
-
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
-
Performs UI accessibility actions on behalf of the user 1 TTPs 1 IoCs
Application may abuse the accessibility service to prevent their removal.
-
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
Processes
-
com.tubicolae.unnumbered1⤵
- Makes use of the framework's Accessibility service
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Performs UI accessibility actions on behalf of the user
- Uses Crypto APIs (Might try to encrypt user data)