Analysis

  • max time kernel
    179s
  • max time network
    157s
  • platform
    android_x64
  • resource
    android-x64-20240624-en
  • resource tags

    androidarch:x64arch:x86image:android-x64-20240624-enlocale:en-usos:android-10-x64system
  • submitted
    19-07-2024 13:37

General

  • Target

    ready.apk

  • Size

    9.3MB

  • MD5

    580222efdce1dca72c8402f3da095983

  • SHA1

    37867faf2c1f88c7bde0a96dc382e962ceec93ac

  • SHA256

    5b491059221e92e592326a582f84e416e623c7b5c9da6393340176d0f76df9da

  • SHA512

    7febef3134a22dc910ff2d3ba9400a316e1e9e48ec2ce1b79497c87c086994713d2951579987286a18b0563e9ff5b2ffb0951a516047aed04da8ec02a832516d

  • SSDEEP

    98304:nYZgoDdDHQvubBsPp6nfxg6lreKmzjzBRTE0tMTVa:YjDdzrVJiXlzv3z

Malware Config

Signatures

  • Makes use of the framework's Accessibility service 4 TTPs 1 IoCs

    Retrieves information displayed on the phone screen using AccessibilityService.

  • Acquires the wake lock 1 IoCs
  • Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

    Application may abuse the framework's foreground service to continue running in the foreground.

  • Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
  • Schedules tasks to execute at a specified time 1 TTPs 1 IoCs

    Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.

Processes

  • um.tahoe.broker
    1⤵
    • Makes use of the framework's Accessibility service
    • Acquires the wake lock
    • Makes use of the framework's foreground persistence service
    • Registers a broadcast receiver at runtime (usually for listening for system events)
    • Schedules tasks to execute at a specified time
    PID:5052

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • /storage/emulated/0/Config/sys/apps/log/log-2024-07-19.txt

    Filesize

    13B

    MD5

    de2c41a51ee9246eb1708f65b511add0

    SHA1

    2f442d634c8a18760a232c8829d4b5d74a52f074

    SHA256

    ad2d914ca347cd1930e32f21c6d5448c34104bea181b93abc85ec518985653ab

    SHA512

    7cdfbd001594503644e9ed80ae852f90ef9e841a8382e2eec6979e149a2c400a3b83055d205b4d1d66e1600e5127482932d5127eb5800d35a4ee5673fe34d84a

  • /storage/emulated/0/Config/sys/apps/log/log-2024-07-19.txt

    Filesize

    45B

    MD5

    d5df609115a56748e3ee4746c4519c10

    SHA1

    5072ac1782b18245b27301fe11a8dd6684520d20

    SHA256

    563a222f0ead65d2aa7a4a4b34e341b11efedc4e622684d572a48dfe3a15921a

    SHA512

    d6d769c3d8124722e4e58358c595f731a1e5261d6b5844cd9b35b906f0dc05e4b951349bc70174a1c7486a7ef1db7f86478d2c16789aed64b1023897f642d60f

  • /storage/emulated/0/Config/sys/apps/log/log-2024-07-19.txt

    Filesize

    29B

    MD5

    11fa7fad5a8ff5baea05ef1d75d56402

    SHA1

    dd9778eb3a0fa8204ad9dccb9fbf6b711cb736ba

    SHA256

    76daa30be424486bb90569267769be8bbc28d5770b9d8b07d41372d064df9ba7

    SHA512

    6bc8d9f1a98cd5bd6bf3f496b201a50780afce5e2b288850a303a4f0d0dfcef9bc5c0a8a750bd1d8245061482c837b1fe1244e452e8aa6f05d6e56aec81e6616