5705b434e15ff8062762ac9d692b708d1284f8fe7c792a7375f092747d42c1c6

Analysis

max time kernel
125s
max time network
131s
platform
android_x86
resource
android-x86-arm-20240624-en
resource tags

androidarch:armarch:x86image:android-x86-arm-20240624-enlocale:en-usos:android-9-x86system
submitted
21-07-2024 22:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5705b434e15ff8062762ac9d692b708d1284f8fe7c792a7375f092747d42c1c6.apk
Size

3.7MB
MD5

eb4b2f66ff6b63730718457098e28553
SHA1

db2d76eff8ac87e84b5c9550e7feaa45b084bd2d
SHA256

5705b434e15ff8062762ac9d692b708d1284f8fe7c792a7375f092747d42c1c6
SHA512

1f1ac3269898a27e0ad0e83964c982774dc7d75998b6d3cc494d3e150ea651827882b72ecdc07b3cb07d4c396cba6538ff597517b6b247fa405f0c65abade498
SSDEEP

98304:xEJERzdoJhv8xT3haCi3yQ1LRShhEEgIk:xKEtyyh4DTSnPpk

Score

6^/10

evasion impact persistence

Malware Config

Signatures

Acquires the wake lock 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.litheness.ambivert

Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

Application may abuse the framework's foreground service to continue running in the foreground.

evasion persistence

Foreground Persistence

T1541

description	ioc	Process
Framework service call	android.app.IActivityManager.setServiceForeground	com.litheness.ambivert

Performs UI accessibility actions on behalf of the user 1 TTPs 1 IoCs

Application may abuse the accessibility service to prevent their removal.

evasion

Prevent Application Removal

T1629.001

ioc	Process
android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction	com.litheness.ambivert

Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

impact

Data Encrypted for Impact

T1471

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	com.litheness.ambivert

com.litheness.ambivert
1⤵
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Performs UI accessibility actions on behalf of the user
- Uses Crypto APIs (Might try to encrypt user data)
PID:4246

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Foreground Persistence

T1541

Privilege Escalation

Defense Evasion

Foreground Persistence

T1541

Impair Defenses

T1629

Prevent Application Removal

T1629.001

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

T1471

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads