Analysis

  • max time kernel
    126s
  • max time network
    156s
  • platform
    android_x64
  • resource
    android-x64-20240624-en
  • resource tags

    androidarch:x64arch:x86image:android-x64-20240624-enlocale:en-usos:android-10-x64system
  • submitted
    26-07-2024 22:07

General

  • Target

    289dffc1e9e8a23c41eca28ee87350464eeea076c653d709cab8a8cd0c980c58.apk

  • Size

    3.6MB

  • MD5

    bf715cdab30fca7c2d551a07219c54ba

  • SHA1

    969cee8e3cb30c083243edf7606f415dd675e861

  • SHA256

    289dffc1e9e8a23c41eca28ee87350464eeea076c653d709cab8a8cd0c980c58

  • SHA512

    8e84effe8947311aa1dc47ea8f0371b6a7fa32bc9548035527e8b1328746ec8554af48309bdaeaa74d9b95a7766e52bc08ccad489062c49eeb85625835f10cad

  • SSDEEP

    98304:vYJ3war8cXRHrCOvT/2iehAL0WHlRQjppymSNyk87lWI6:wOSRLCAT+JA4WHQOFQXxN6

Malware Config

Signatures

  • Acquires the wake lock 1 IoCs
  • Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

    Application may abuse the framework's foreground service to continue running in the foreground.

  • Performs UI accessibility actions on behalf of the user 1 TTPs 1 IoCs

    Application may abuse the accessibility service to prevent their removal.

  • Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

Processes

  • com.pitsaws.darcie
    1⤵
    • Acquires the wake lock
    • Makes use of the framework's foreground persistence service
    • Performs UI accessibility actions on behalf of the user
    • Uses Crypto APIs (Might try to encrypt user data)
    PID:5034

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads