Analysis
-
max time kernel
329s -
max time network
340s -
platform
android_x64 -
resource
android-33-x64-arm64-20240624-en -
resource tags
-
submitted
22-07-2024 19:36
General
-
Target
childapp.apk
-
Size
18.3MB
-
MD5
051916df0c9afa5bb89b4d4771f291f7
-
SHA1
49fc19b18617e39f788b93846d679cfe4cc7963f
-
SHA256
61ef15e9eccee437915a643c86e7f5049bcee9c439360a0a9cd4818adb98fb26
-
SHA512
167bef68e5eb04f438d93a08e098ef1306d674ee252bd93a976732b4f1c1e8a036b9054ea2798052af57fc47315720753061f69f1280b76ec06349fe05a6f9c4
-
SSDEEP
98304:+jwaGeWClCZmcsPS75miKq0T0Q797HmzzzBGTr0t4d:PaZCZwPSYiKq0gY0zgUy
Malware Config
Signatures
-
Makes use of the framework's Accessibility service 4 TTPs 3 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Acquires the wake lock 1 IoCs
-
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
-
Performs UI accessibility actions on behalf of the user 1 TTPs 8 IoCs
Application may abuse the accessibility service to prevent their removal.
-
Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
-
Requests enabling of the accessibility settings. 1 IoCs
-
Schedules tasks to execute at a specified time 1 TTPs 1 IoCs
Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.
Processes
-
com.xiaomi.service1⤵
- Makes use of the framework's Accessibility service
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Performs UI accessibility actions on behalf of the user
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Requests enabling of the accessibility settings.
- Schedules tasks to execute at a specified time
Network
MITRE ATT&CK Mobile v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
33B
MD5111217063cfd8a765f9d48038297403f
SHA104dbe27a0357f44d16a8722bace7fda298644462
SHA256b9d9bebcdaa9696ef40aa42a98676ded43230e411c3f4e5b2a0a1ee61e4f41ba
SHA512f4b5ce0914bb79bd84de7c97f55c68a7a8cf25c9ebfcfa842abb0e4107bb12ee61d879e493024fc5e6de68cc83b32052921d119246e1656b90d567ed683aad9b
-
Filesize
25B
MD5ba30336bf53d54ed3c0ea69dd545de8c
SHA1ce99c6724c75b93b7448e2d9fac16ca702a5711f
SHA2562d6988fb5afdaafc4e33fa1f71d6f10c95ab5a49a8ec820add5b13eef05439af
SHA512eea34ca526e03349e746d3687ea660b4748f0174fe2ffdb65161e232e08630b345e03329614852ce881a71362ba68575e9dd08fa361a416e5b2fb231e21a0a3e
-
Filesize
264B
MD5fd7015c55030836fc455e1989ca120d8
SHA12e7ad51c29662ce0c563e4257fdcb6cb8828f8a9
SHA25649cfce378c0d91cca43913c7d228f3cd21a4492b303bd9191b083d5399d81ac1
SHA5127357453d95c25aab8c57e1a7a6e065deb304d659c9c046f368084317a34db9223fa42f7f4ca05564bd5cf014d478c0fe186ddf79d5fad9b65e493d2419d9e57f
-
Filesize
57B
MD53af69119804d1d999d56d230338ffd36
SHA169350826205583c8acc385ee0a6e3fc2673ee2ca
SHA25610994862cb263ab6b1e4428cc24cc9c585458fc67544fe0f5dfea81a5a7a115c
SHA5124a41b19d28f637b397d9dff225621694c44c750a9bd65f3e6ad5d3b9acf0d118910ddf53d4618213f9e14c61e0fb154f33f2747dd3b8d50459990767f42fc8cb