Analysis
-
max time kernel
179s -
max time network
189s -
platform
android_x64 -
resource
android-33-x64-arm64-20240624-en -
resource tags
androidarch:arm64arch:x64image:android-33-x64-arm64-20240624-enlocale:en-usos:android-13-x64system -
submitted
23-07-2024 10:59
Behavioral task
behavioral1
Sample
ef5b77c003be850406ff8a18a35eb094632dcdc8f6112efcde036e3c454dde0c.apk
Resource
android-x64-20240624-en
Behavioral task
behavioral2
Sample
ef5b77c003be850406ff8a18a35eb094632dcdc8f6112efcde036e3c454dde0c.apk
Resource
android-x64-arm64-20240624-en
Behavioral task
behavioral3
Sample
ef5b77c003be850406ff8a18a35eb094632dcdc8f6112efcde036e3c454dde0c.apk
Resource
android-33-x64-arm64-20240624-en
Behavioral task
behavioral4
Sample
ef5b77c003be850406ff8a18a35eb094632dcdc8f6112efcde036e3c454dde0c.apk
Resource
android-x86-arm-20240624-en
General
-
Target
ef5b77c003be850406ff8a18a35eb094632dcdc8f6112efcde036e3c454dde0c.apk
-
Size
6.3MB
-
MD5
19e5c726ccf1b1797cc6b379cf5ba41a
-
SHA1
f159886dcf9021f41eaa2b0641a758c4f0c4033d
-
SHA256
ef5b77c003be850406ff8a18a35eb094632dcdc8f6112efcde036e3c454dde0c
-
SHA512
42b47700eaa27d1fbe66ab0500dfdf18513870fa04a182d445bacb9fe337fa39aac7a50ae4ee2587f3949430f3516c775201c8a0f82a16e321a631b3be0e9f49
-
SSDEEP
98304:UxK+fjTC9YH16/CFXNf+GtrS4KsREl2uggkXy49mzCzB7Ta0t0JdU/Nt:IKKC9YV3ob4KqruggkXbQz+5ZL
Malware Config
Signatures
-
Loads dropped Dex/Jar 1 TTPs 1 IoCs
Runs executable file dropped to the device during analysis.
Processes:
com.facebook.katanbioc pid process /data/user/0/com.facebook.katanb/cache/natives_sec_blob3532107474130175690.dex 4365 com.facebook.katanb -
Makes use of the framework's Accessibility service 4 TTPs 3 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
Processes:
com.facebook.katanbdescription ioc process Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByText com.facebook.katanb Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId com.facebook.katanb Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId com.facebook.katanb -
Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs
Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
Processes:
com.facebook.katanbdescription ioc process Framework service call android.content.IClipboard.addPrimaryClipChangedListener com.facebook.katanb -
Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
-
Acquires the wake lock 1 IoCs
Processes:
com.facebook.katanbdescription ioc process Framework service call android.os.IPowerManager.acquireWakeLock com.facebook.katanb -
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
Processes:
com.facebook.katanbdescription ioc process Framework service call android.app.IActivityManager.setServiceForeground com.facebook.katanb -
Performs UI accessibility actions on behalf of the user 1 TTPs 8 IoCs
Application may abuse the accessibility service to prevent their removal.
Processes:
com.facebook.katanbioc process android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction com.facebook.katanb android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction com.facebook.katanb android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction com.facebook.katanb android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction com.facebook.katanb android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction com.facebook.katanb android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction com.facebook.katanb android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction com.facebook.katanb android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction com.facebook.katanb -
Queries information about active data network 1 TTPs 1 IoCs
Processes:
com.facebook.katanbdescription ioc process Framework service call android.net.IConnectivityManager.getActiveNetworkInfo com.facebook.katanb -
Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
Processes:
com.facebook.katanbdescription ioc process Intent action android.settings.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS com.facebook.katanb -
Schedules tasks to execute at a specified time 1 TTPs 1 IoCs
Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.
Processes:
com.facebook.katanbdescription ioc process Framework service call android.app.job.IJobScheduler.schedule com.facebook.katanb -
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
Processes:
com.facebook.katanbdescription ioc process Framework API call javax.crypto.Cipher.doFinal com.facebook.katanb -
Checks CPU information 2 TTPs 1 IoCs
Processes:
com.facebook.katanbdescription ioc process File opened for read /proc/cpuinfo com.facebook.katanb -
Checks memory information 2 TTPs 1 IoCs
Processes:
com.facebook.katanbdescription ioc process File opened for read /proc/meminfo com.facebook.katanb
Processes
-
com.facebook.katanb1⤵
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Obtains sensitive information copied to the device clipboard
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Performs UI accessibility actions on behalf of the user
- Queries information about active data network
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Schedules tasks to execute at a specified time
- Uses Crypto APIs (Might try to encrypt user data)
- Checks CPU information
- Checks memory information
PID:4365
Network
MITRE ATT&CK Mobile v15
Defense Evasion
Download New Code at Runtime
1Foreground Persistence
1Hide Artifacts
1User Evasion
1Impair Defenses
1Prevent Application Removal
1Input Injection
1Virtualization/Sandbox Evasion
2System Checks
2Credential Access
Clipboard Data
1Input Capture
2GUI Input Capture
1Keylogging
1Discovery
Software Discovery
1Security Software Discovery
1System Information Discovery
2System Network Connections Discovery
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
550KB
MD5ffcba9530d4f171ab67983f5d1950b54
SHA1e74f816c65dc89dfbd668d27b65b4da0cde26b49
SHA256ced12259631608d6af65bf72ddb6695d0c945bdc3f539a4e7778377f0ed25e3d
SHA512c6251e08db812b41a63476755ff34f2f4fec232e910a6a4769b0a77a281e7ad48e7cb86f5d7bd7b67b579d3e5ab770b6145600f8877d72aabe626e2bc944ded6
-
Filesize
459B
MD5b51bb75b331ab01b5a3df850639dea25
SHA1f0547a51ed14992dadf63f32720d33a647560b6d
SHA2562f6c2daf033ad4af426e96815181b876cc567255ef00f160644edbe9965de79c
SHA512a47364a489db11cfc82ab50daeab868bc34e07b6b3d18eb3ecb94d4fba510e7b1469fc3e92306c1c26893da08839d4265ccd19a7680c28aac3123fc1f77b27b0
-
Filesize
10KB
MD5995c7d59e32429f932a861b4fba1c0f2
SHA1f7557b2253983f226683e40b2c9b98f23abc4dd4
SHA256ed773294442702aba1c7f8b9628302dfae68498432fe3aebf09339d0807b49ea
SHA51289e1411785e80b2fe89744db826ccb504b821656a0729c55eaf19847b9988e6fae66d8b4c6db687901f9177e798412507046173623a3ed5978c1b93e846c8b2e
-
Filesize
272B
MD5d60fe2fd976dff210e7115b00720bb46
SHA1b148f1855b31354a8923f0d5bf2f27d184c15a96
SHA256725bac79cad19fb23cbbffd9777df423b13b88c03ba52c3e1475291a8e3b0731
SHA51238a1d25b92be8d273a1dc4d0967ca6ce68ab623dd095be31cec8edabe7f3bad3e62c9c20fbcf4e09adbf3354273f9395634779ee5be971debd0a92db850fc3f1
-
Filesize
41B
MD5d47033afff9fdea5177c30833abe6a06
SHA12779b1cf7705db902554d53d7a1a5d7581cf80ed
SHA2562fe0755cba7b92e817d4919a8e7eb80119f184f98b35a75f80cee9292458dd6d
SHA512edc9adfcaee94b8bfe57c3107e251ae06443a9ea88a5718839e05e54b1bea9c4ca675f6d9f923d4e62840acb7f5648d01d73ef883fe4b0d6db03b800d70c41fc
-
Filesize
25B
MD5ba30336bf53d54ed3c0ea69dd545de8c
SHA1ce99c6724c75b93b7448e2d9fac16ca702a5711f
SHA2562d6988fb5afdaafc4e33fa1f71d6f10c95ab5a49a8ec820add5b13eef05439af
SHA512eea34ca526e03349e746d3687ea660b4748f0174fe2ffdb65161e232e08630b345e03329614852ce881a71362ba68575e9dd08fa361a416e5b2fb231e21a0a3e
-
Filesize
272B
MD5c6f78c31911c5eb5b83f932397f735fb
SHA115d54d9cdbde2f42dba9e6d4f6d2f578ed260bb4
SHA2564f2de6a1d65aa52a42bef2ded4ab599ab605b92ff9eb64ad88888ee72a93b848
SHA5122a4454e42a303514e9cacec919ebc550ed437f70cc6fbfed5ae5977f8c8ea16219c288ef11b7af24ffe0868c77fcfa614dc4172bd4a75b2c6514cc559fa8d842