Analysis
-
max time kernel
127s -
max time network
156s -
platform
android_x64 -
resource
android-x64-20240624-en -
resource tags
-
submitted
17-07-2024 22:06
General
-
Target
up.apk
-
Size
3.7MB
-
MD5
21f1b0b33ff48b6c8b8f6b5e95b96fa9
-
SHA1
0444c98c048c0de65adc2e920955d4bb99ae41e7
-
SHA256
103f2a0a29c230f3cc3249e49dcf9dd9e98396bc90dff2629aca1c54d8ac51d7
-
SHA512
0eed972fa8d2fe172ef6db7c28dd4e32b9ce1c5fcc2ced2627f03f436c7597c756c310a86f36a07f3c29fe1a264ff81236a77804ec002f01a6922a9beca1c189
-
SSDEEP
98304:qAslPP7AdOBy2BJAnMNCpVETNkzmgJoHM3YnOPisY2qmU8RMnWuez:UEVRnMNCQZkLJoHyYeZqmU83uez
Score
7/10
Malware Config
Signatures
-
Makes use of the framework's Accessibility service 4 TTPs 2 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Acquires the wake lock 1 IoCs
-
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
-
Performs UI accessibility actions on behalf of the user 1 TTPs 1 IoCs
Application may abuse the accessibility service to prevent their removal.
-
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
Processes
-
com.soonspeeding.barnaba1⤵
- Makes use of the framework's Accessibility service
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Performs UI accessibility actions on behalf of the user
- Uses Crypto APIs (Might try to encrypt user data)