Analysis
-
max time kernel
128s -
max time network
137s -
platform
android_x64 -
resource
android-x64-arm64-20240624-en -
resource tags
-
submitted
23-07-2024 22:01
General
-
Target
28c9db4769809b56f1814cc298500d873cd1e461cbfd88c6296ed432bb1d1401.apk
-
Size
3.7MB
-
MD5
79b10992cca9bd20b1512c87f4625ef3
-
SHA1
fddaae066aba87524c79dfd46f377eebc4fcc069
-
SHA256
28c9db4769809b56f1814cc298500d873cd1e461cbfd88c6296ed432bb1d1401
-
SHA512
1f263bb1e8730aa885752ebe77e2c35a05385e5c57521671e91c55367422f7c14fead11d44a64ad77d11256eb0240ce1e4ae701ea7eb52f6714cc70b4359b824
-
SSDEEP
98304:gaSZ+eFMJx14UTicxpzrKJLsDcppygzi6eNtOgRjMZcZXYfyUBlo:gaSkZUUTTr+LsQp4g26eNcgtMZYEvo
Score
7/10
Malware Config
Signatures
-
Makes use of the framework's Accessibility service 4 TTPs 2 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Acquires the wake lock 1 IoCs
-
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
-
Performs UI accessibility actions on behalf of the user 1 TTPs 1 IoCs
Application may abuse the accessibility service to prevent their removal.
-
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
Processes
-
com.fondle.desmothoraca1⤵
- Makes use of the framework's Accessibility service
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Performs UI accessibility actions on behalf of the user
- Uses Crypto APIs (Might try to encrypt user data)