Analysis
-
max time kernel
125s -
max time network
132s -
platform
android_x86 -
resource
android-x86-arm-20240624-en -
resource tags
-
submitted
26-07-2024 22:07
General
-
Target
289dffc1e9e8a23c41eca28ee87350464eeea076c653d709cab8a8cd0c980c58.apk
-
Size
3.6MB
-
MD5
bf715cdab30fca7c2d551a07219c54ba
-
SHA1
969cee8e3cb30c083243edf7606f415dd675e861
-
SHA256
289dffc1e9e8a23c41eca28ee87350464eeea076c653d709cab8a8cd0c980c58
-
SHA512
8e84effe8947311aa1dc47ea8f0371b6a7fa32bc9548035527e8b1328746ec8554af48309bdaeaa74d9b95a7766e52bc08ccad489062c49eeb85625835f10cad
-
SSDEEP
98304:vYJ3war8cXRHrCOvT/2iehAL0WHlRQjppymSNyk87lWI6:wOSRLCAT+JA4WHQOFQXxN6
Score
7/10
Malware Config
Signatures
-
Makes use of the framework's Accessibility service 4 TTPs 2 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Acquires the wake lock 1 IoCs
-
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
-
Performs UI accessibility actions on behalf of the user 1 TTPs 1 IoCs
Application may abuse the accessibility service to prevent their removal.
-
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
Processes
-
com.pitsaws.darcie1⤵
- Makes use of the framework's Accessibility service
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Performs UI accessibility actions on behalf of the user
- Uses Crypto APIs (Might try to encrypt user data)