Resubmissions
20/08/2024, 14:07
240820-re1rgazcjl1029/07/2024, 14:41
240729-r2l7lashqr29/07/2024, 14:34
240729-rxelyssfpk10Analysis
- max time kernel
14s - max time network
183s - platform
android_x86 - resource
android-x86-arm-20240624-en - resource tags
androidarch:armarch:x86image:android-x86-arm-20240624-enlocale:en-usos:android-9-x86system - submitted
29/07/2024, 14:34
Behavioral task
behavioral1
Sample
e769ef0d011cbf3322c9e85d4cdf70af413f021d033aed884c1431f2b7861d0d.apk
Resource
android-x86-arm-20240624-en
3 signatures
150 seconds
General
- Target e769ef0d011cbf3322c9e85d4cdf70af413f021d033aed884c1431f2b7861d0d.apk
- Size 5.6MB
- Sample240729-rxelyssfpk
- SHA256 e769ef0d011cbf3322c9e85d4cdf70af413f021d033aed884c1431f2b7861d0d
- MD5 220ec1e3effb6f4a4a3acb6b3b3d2e90
- SHA1 c429857766ae7fca8e65e15ad9b1fa691e0b8de7
- SHA512 72ae059063abf45284402dc5f55fa281fb64d5a156d166ba155b91007169843bf2da49269c32f5435c8872dee472cc577063b7175e8858bf7205958cc68cfc93
- SSDEEP 98304:K3qblT3h/tjtU6GAoNX2OnR03JhSv8TAA4DaoHuZzpIwUfS5J93QMqT5+:BblT3ltBBAlnMc441uFn5X3bqT8
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Makes use of the framework's Accessibility service 4 TTPs 1 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
description ioc Process Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId com.necapp.lpp4201 - Acquires the wake lock 1 IoCs
description ioc Process Framework service call android.os.IPowerManager.acquireWakeLock com.necapp.lpp4201 - Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
description ioc Process Framework service call android.app.IActivityManager.setServiceForeground com.necapp.lpp4201
Processes
Network
MITRE ATT&CK Mobile v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path /data/data/com.necapp.lpp4201/files/localdb.db
- Size 12KB
- SHA256 409f05ab16c6f1f0897959456d72f94a870b03581569f7c4970b22e541db827f
- MD5 e7179ba1abb576a1eb3486db34de4037
- SHA1 4dc87664c9be3d7a94d4886b7f56f4a8d7b983dd
- SHA512 50ee847527ad249dcb43d3d95dca9d8bb5bfdc459f6e5d639db4a31895e4f2ad75355451846cb732e380a576f41f1c3af19387cdc9ee7c5e46464c61613e458a
- SSDEEP 12:TLJQIhuqyVO0V/y8yVCRQCOuF8OlGYhdVw:TLdhuq76BlO5O5dVw
- MD5 SHA1 SHA512 SSDEEP
- Path /data/data/com.necapp.lpp4201/files/localdb.db
- Size 4KB
- SHA256 84c1c2e80fe7a0a5ce0c6493bd1100d1f5c032b18571ef8344b836f5b1fa580c
- MD5 7e11f5e484b8033c30a14d7ac98cab88
- SHA1 4baf6012a5f88fa9cd7a2b3baf403c1f44c1a6a1
- SHA512 70c98036e5072c22dbb4ba2efd093acd2500b0c2a418f77782bb6d983ecce7d826cb14c76f333c3e6796f48b2ad4107995bbad315143b3ecb2813194b38e6684
- MD5 SHA1 SHA512
- Path /data/data/com.necapp.lpp4201/files/localdb.db-journal
- Size 4KB
- SHA256 87f2465c65d6fe53bcc3ffcd5d6ef28b7fadbaf9df52a323d7355932d0db4b90
- MD5 a19c324fc5ac6d5f86b112f15c5b1bf3
- SHA1 0b9e937f9e4229b76fa6531e79d5cfb5c54603c4
- SHA512 f8566594e6cf769baf383f8f54c2926117ec27bd55e3ab04c7a1dac525601931654637cba38ce04b439382309d808b677445b3fb19c2dbd3cddf4b81cf02d50a
- SSDEEP 12:7+tZiqLJQIhuqyVO0V/y8yVCRQCOuF8OlGYh1PJ:7+t0qLdhuq76BlO5O5NJ
- MD5 SHA1 SHA512 SSDEEP
- Path /data/data/com.necapp.lpp4201/files/localdb.db-shm
- Size 28KB
- SHA256 18619b678a5c207a971a0aa931604f48162e307c57ecdec450d5f095fe9f32c7
- MD5 cf845a781c107ec1346e849c9dd1b7e8
- SHA1 b44ccc7f7d519352422e59ee8b0bdbac881768a7
- SHA512 4802861ea06dc7fb85229a3c8f04e707a084f1ba516510c6f269821b33c8ee4ebf495258fe5bee4850668a5aac1a45f0edf51580da13b7ee160a29d067c67612
- SSDEEP 3::
- MD5 SHA1 SHA512 SSDEEP