Analysis
-
max time kernel
329s -
max time network
340s -
platform
android_x64 -
resource
android-x64-arm64-20240624-en -
resource tags
androidarch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20240624-enlocale:en-usos:android-11-x64system -
submitted
22-07-2024 19:36
Behavioral task
behavioral1
Sample
Xiaomi.Service.ver.3.31.165.build.331165.apk
Resource
android-x64-arm64-20240624-en
Behavioral task
behavioral2
Sample
Xiaomi.Service.ver.3.31.165.build.331165.apk
Resource
android-33-x64-arm64-20240624-en
Behavioral task
behavioral3
Sample
Xiaomi.Service.ver.3.31.165.build.331165.apk
Resource
android-x86-arm-20240624-en
Behavioral task
behavioral4
Sample
childapp.apk
Resource
android-x64-arm64-20240624-en
Behavioral task
behavioral5
Sample
childapp.apk
Resource
android-33-x64-arm64-20240624-en
Behavioral task
behavioral6
Sample
childapp.apk
Resource
android-x86-arm-20240624-en
General
-
Target
childapp.apk
-
Size
18.3MB
-
MD5
051916df0c9afa5bb89b4d4771f291f7
-
SHA1
49fc19b18617e39f788b93846d679cfe4cc7963f
-
SHA256
61ef15e9eccee437915a643c86e7f5049bcee9c439360a0a9cd4818adb98fb26
-
SHA512
167bef68e5eb04f438d93a08e098ef1306d674ee252bd93a976732b4f1c1e8a036b9054ea2798052af57fc47315720753061f69f1280b76ec06349fe05a6f9c4
-
SSDEEP
98304:+jwaGeWClCZmcsPS75miKq0T0Q797HmzzzBGTr0t4d:PaZCZwPSYiKq0gY0zgUy
Malware Config
Signatures
-
Makes use of the framework's Accessibility service 4 TTPs 3 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
Processes:
com.xiaomi.servicedescription ioc process Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId com.xiaomi.service Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByText com.xiaomi.service Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId com.xiaomi.service -
Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
-
Acquires the wake lock 1 IoCs
Processes:
com.xiaomi.servicedescription ioc process Framework service call android.os.IPowerManager.acquireWakeLock com.xiaomi.service -
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
Processes:
com.xiaomi.servicedescription ioc process Framework service call android.app.IActivityManager.setServiceForeground com.xiaomi.service -
Performs UI accessibility actions on behalf of the user 1 TTPs 8 IoCs
Application may abuse the accessibility service to prevent their removal.
Processes:
com.xiaomi.serviceioc process android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction com.xiaomi.service android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction com.xiaomi.service android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction com.xiaomi.service android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction com.xiaomi.service android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction com.xiaomi.service android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction com.xiaomi.service android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction com.xiaomi.service android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction com.xiaomi.service -
Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
Processes:
com.xiaomi.servicedescription ioc process Intent action android.settings.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS com.xiaomi.service -
Requests enabling of the accessibility settings. 1 IoCs
Processes:
com.xiaomi.servicedescription ioc process Intent action android.settings.ACCESSIBILITY_SETTINGS com.xiaomi.service -
Schedules tasks to execute at a specified time 1 TTPs 1 IoCs
Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.
Processes:
com.xiaomi.servicedescription ioc process Framework service call android.app.job.IJobScheduler.schedule com.xiaomi.service
Processes
-
com.xiaomi.service1⤵
- Removes its main activity from the application launcher
- Makes use of the framework's Accessibility service
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Performs UI accessibility actions on behalf of the user
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Requests enabling of the accessibility settings.
- Schedules tasks to execute at a specified time
PID:4465
Network
MITRE ATT&CK Mobile v15
Defense Evasion
Foreground Persistence
1Hide Artifacts
2Suppress Application Icon
1User Evasion
1Impair Defenses
1Prevent Application Removal
1Input Injection
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
33B
MD5111217063cfd8a765f9d48038297403f
SHA104dbe27a0357f44d16a8722bace7fda298644462
SHA256b9d9bebcdaa9696ef40aa42a98676ded43230e411c3f4e5b2a0a1ee61e4f41ba
SHA512f4b5ce0914bb79bd84de7c97f55c68a7a8cf25c9ebfcfa842abb0e4107bb12ee61d879e493024fc5e6de68cc83b32052921d119246e1656b90d567ed683aad9b
-
Filesize
25B
MD5ba30336bf53d54ed3c0ea69dd545de8c
SHA1ce99c6724c75b93b7448e2d9fac16ca702a5711f
SHA2562d6988fb5afdaafc4e33fa1f71d6f10c95ab5a49a8ec820add5b13eef05439af
SHA512eea34ca526e03349e746d3687ea660b4748f0174fe2ffdb65161e232e08630b345e03329614852ce881a71362ba68575e9dd08fa361a416e5b2fb231e21a0a3e
-
Filesize
284B
MD5e7098a1e2f67059298f42517d4d774a8
SHA1a510d2c509539711aefa5c97ff5603bbff00c0c5
SHA256c301fd9af98ef18117e70c5bef2f3c7bfb0312281cb11781a3215a26c29ba8cb
SHA51295c46fde2a9c6e6e54cb71375fe6ddcc0ccb004067d1cb0cdd8f49051395966c8a36df8014099093cfe1baa09be3cd88e5d2e2d75056c8c30013d3a1f26232e2
-
Filesize
57B
MD53af69119804d1d999d56d230338ffd36
SHA169350826205583c8acc385ee0a6e3fc2673ee2ca
SHA25610994862cb263ab6b1e4428cc24cc9c585458fc67544fe0f5dfea81a5a7a115c
SHA5124a41b19d28f637b397d9dff225621694c44c750a9bd65f3e6ad5d3b9acf0d118910ddf53d4618213f9e14c61e0fb154f33f2747dd3b8d50459990767f42fc8cb