a8c5e980d5c57742fd4e46c39c1d76cbd8c51851b5f1294f50446902d4e3558c

Analysis

max time kernel
126s
max time network
134s
platform
android_x64
resource
android-x64-arm64-20240624-en
resource tags

androidarch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20240624-enlocale:en-usos:android-11-x64system
submitted
29-07-2024 22:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a8c5e980d5c57742fd4e46c39c1d76cbd8c51851b5f1294f50446902d4e3558c.apk
Size

3.7MB
MD5

28fa4f44c97afaf0a774f97449bc6957
SHA1

3331d31341e055938029a068b3073d5551cbda23
SHA256

a8c5e980d5c57742fd4e46c39c1d76cbd8c51851b5f1294f50446902d4e3558c
SHA512

4f85e8a4130b36fad163e35ab56cc4826ece8c0a000f96b1bf0a658711bdd9845f06d4a8fecdf0e047ecb9af88b2995fb0eeda288f9f84b1deec3674f37a0be4
SSDEEP

98304:pEjJUcI8MO9w37j3SIU5h11GTzBjYgAMQDvNufaOUen:p8uKMO9w3Pe/11UFAN7Nt4

Score

6^/10

evasion impact persistence

Malware Config

Signatures

Acquires the wake lock 1 IoCs

Processes:

com.quadricrescentic.seacompelling

description ioc process

Framework service call android.os.IPowerManager.acquireWakeLock com.quadricrescentic.seacompelling
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
evasion persistence

Foreground Persistence
T1541

Processes:

com.quadricrescentic.seacompelling

description ioc process

Framework service call android.app.IActivityManager.setServiceForeground com.quadricrescentic.seacompelling
Performs UI accessibility actions on behalf of the user 1 TTPs 1 IoCs
Application may abuse the accessibility service to prevent their removal.
evasion

Prevent Application Removal
T1629.001

Processes:

com.quadricrescentic.seacompelling

ioc process

android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction com.quadricrescentic.seacompelling
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
impact

Data Encrypted for Impact
T1471

Processes:

com.quadricrescentic.seacompelling

description ioc process

Framework API call javax.crypto.Cipher.doFinal com.quadricrescentic.seacompelling

description	ioc	process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.quadricrescentic.seacompelling

description	ioc	process
Framework service call	android.app.IActivityManager.setServiceForeground	com.quadricrescentic.seacompelling

ioc	process
android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction	com.quadricrescentic.seacompelling

description	ioc	process
Framework API call	javax.crypto.Cipher.doFinal	com.quadricrescentic.seacompelling

com.quadricrescentic.seacompelling
1⤵
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Performs UI accessibility actions on behalf of the user
- Uses Crypto APIs (Might try to encrypt user data)
PID:4597

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Foreground Persistence

T1541

Privilege Escalation

Defense Evasion

Foreground Persistence

T1541

Impair Defenses

T1629

Prevent Application Removal

T1629.001

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

T1471

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads