Analysis
-
max time kernel
126s -
max time network
156s -
platform
android_x64 -
resource
android-x64-20240624-en -
resource tags
-
submitted
21-07-2024 22:01
General
-
Target
up.apk
-
Size
3.7MB
-
MD5
eb4b2f66ff6b63730718457098e28553
-
SHA1
db2d76eff8ac87e84b5c9550e7feaa45b084bd2d
-
SHA256
5705b434e15ff8062762ac9d692b708d1284f8fe7c792a7375f092747d42c1c6
-
SHA512
1f1ac3269898a27e0ad0e83964c982774dc7d75998b6d3cc494d3e150ea651827882b72ecdc07b3cb07d4c396cba6538ff597517b6b247fa405f0c65abade498
-
SSDEEP
98304:xEJERzdoJhv8xT3haCi3yQ1LRShhEEgIk:xKEtyyh4DTSnPpk
Score
7/10
Malware Config
Signatures
-
Makes use of the framework's Accessibility service 4 TTPs 2 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Acquires the wake lock 1 IoCs
-
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
-
Performs UI accessibility actions on behalf of the user 1 TTPs 1 IoCs
Application may abuse the accessibility service to prevent their removal.
-
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
Processes
-
com.litheness.ambivert1⤵
- Makes use of the framework's Accessibility service
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Performs UI accessibility actions on behalf of the user
- Uses Crypto APIs (Might try to encrypt user data)