7db89b7e27a63e209b3c396626a627bdc67ed5104a73be96b9fc6e559eb6ce84

Analysis

max time kernel
179s
max time network
148s
platform
android_x64
resource
android-x64-20240624-en
resource tags

androidarch:x64arch:x86image:android-x64-20240624-enlocale:en-usos:android-10-x64system
submitted
02-08-2024 02:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7db89b7e27a63e209b3c396626a627bdc67ed5104a73be96b9fc6e559eb6ce84.apk
Size

6.8MB
MD5

1e64eff544bffee632f02830a8b176bd
SHA1

6820b9ce37c29871ef50c28d0790ee2c57df82cd
SHA256

7db89b7e27a63e209b3c396626a627bdc67ed5104a73be96b9fc6e559eb6ce84
SHA512

36b932abea2a0826f873d67835db78afc8d3d9d446ac285f69d2e2aba05ec5d28cafaeae3f870e57eac965c49b9b3e8a2136a299a4b5f3be84283cd0581614b9
SSDEEP

196608:4Kk+Ibp3avNs0Ki0LsehuOFv+rxK8w3Te16nU46xKBB:ar38Ns0YLXVFvCxw3y16nh

Score

8^/10

collection credential_access discovery evasion persistence

Malware Config

Signatures

Checks if the Android device is rooted. 1 TTPs 2 IoCs

evasion

System Information Discovery

T1426

ioc	Process
/system/app/Superuser.apk	com.ary.Configuration
/system/xbin/su	com.ary.Configuration

Makes use of the framework's Accessibility service 4 TTPs 1 IoCs

Retrieves information displayed on the phone screen using AccessibilityService.

collection evasion credential_access

Input Injection

T1516

Screen Capture

T1513

Keylogging

T1417.001

GUI Input Capture

T1417.002

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	com.ary.Configuration

Queries information about running processes on the device 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about running processes on the device.

discovery

Process Discovery

T1424

description	ioc	Process
Framework service call	android.app.IActivityManager.getRunningAppProcesses	com.ary.Configuration

Reads the contacts stored on the device. 1 TTPs 1 IoCs

collection

Contact List

T1636.003

description	ioc	Process
URI accessed for read	content://com.android.contacts/contacts	com.ary.Configuration

Acquires the wake lock 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.ary.Configuration

Declares services with permission to bind to the system 3 IoCs

description	ioc
Required by notification listener services to bind with the system. Allows apps to listen to and interact with notifications on the device.	android.permission.BIND_NOTIFICATION_LISTENER_SERVICE
Required by call screening services to bind with the system. Allows apps to filter and manage incoming phone calls.	android.permission.BIND_SCREENING_SERVICE
Required by accessibility services to bind with the system. Allows apps to access accessibility features.	android.permission.BIND_ACCESSIBILITY_SERVICE

Queries information about active data network 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.ary.Configuration

Requests dangerous framework permissions 8 IoCs

description	ioc
Allows an application to send SMS messages.	android.permission.SEND_SMS
Allows an application to read image files from external storage.	android.permission.READ_MEDIA_IMAGES
Allows an application to read SMS messages.	android.permission.READ_SMS
Allows read only access to phone state, including the current cellular network information, the status of any ongoing calls, and a list of any PhoneAccounts registered on the device.	android.permission.READ_PHONE_STATE
Allows an application to read the user's contacts data.	android.permission.READ_CONTACTS
Allows an application to receive SMS messages.	android.permission.RECEIVE_SMS
Allows an application to request installing packages.	android.permission.REQUEST_INSTALL_PACKAGES
Allows an app to post notifications.	android.permission.POST_NOTIFICATIONS

Checks the presence of a debugger
evasion

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs

persistence

Broadcast Receivers

T1624.001

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	com.ary.Configuration

com.ary.Configuration
1⤵
- Checks if the Android device is rooted.
- Makes use of the framework's Accessibility service
- Queries information about running processes on the device
- Reads the contacts stored on the device.
- Acquires the wake lock
- Queries information about active data network
- Registers a broadcast receiver at runtime (usually for listening for system events)
PID:4937

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Privilege Escalation

Defense Evasion

Input Injection

T1516

Credential Access

Input Capture

T1417

GUI Input Capture

T1417.002

Keylogging

T1417.001

Discovery

Process Discovery

T1424

System Information Discovery

T1426

System Network Connections Discovery

T1421

Lateral Movement

Collection

Input Capture

T1417

GUI Input Capture

T1417.002

Keylogging

T1417.001

Protected User Data

T1636

Contact List

T1636.003

Screen Capture

T1513

Command and Control

Exfiltration

Impact

Input Injection

T1516

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.ary.Configuration/cache/volley/-15765807901702283088

Filesize
646B

MD5
f7d808f4798bd8f9dd9046ce4b1cf326

SHA1
ce0be5048b7db228ef790f0f347046679970e1e7

SHA256
582e6b915dedf7d4b9da019d951d92720db13b7f9ec34c376a4e615f178eda7c

SHA512
74b47164326082540378391fdb9b0ee2f715d4bc602a42bd2e41649c901bd9d628d4ad98e9faf6cb65ed7cf27cb23dd841c69d88a423e5163ad172bb23969a1f

Download Submit
/data/data/com.ary.Configuration/cache/volley/-15765807901702283088

Filesize
646B

MD5
9ea1979b3846eada4056b0f76ebb44fc

SHA1
fafab2e5b4d0767fa3e881073c27308af40f4b9b

SHA256
292bf27a8523788c2989657a19d894db808d0b8cec5d9a0ca9de295305856ec2

SHA512
7469b5a8a8fb193828056444d9226baec33320bf80814862064483b1050b02aa7f31a1854f0adb0d232ca25297c53a358a1652d534883318b36d38481cad9007

Download Submit
/data/data/com.ary.Configuration/cache/volley/-15765807901702283088

Filesize
645B

MD5
bddb7b540a131118c58f8a306b47a4aa

SHA1
13408453bc4862d5c45a6f217ce3a64b6d924cd6

SHA256
b1b9d437afa495d2302b5bbcc71274b3f04a3bfc784b8befd02d9fd5ba1a490f

SHA512
91acdaa6d8721f1d95e687f5ed11bc8c561340898f72e9e35b89af898185b45395994b51e9e6abe6cdcecfa70114b4d96c79d82c7c0f647f6d7309227da54ea3

Download Submit
/data/data/com.ary.Configuration/cache/volley/-15765807901702283088

Filesize
864B

MD5
4dcfde9244b1fcaeff86b6949b729621

SHA1
25662cc454c384286e998f44dcb298cdcddd0842

SHA256
06618c4ddbbd3dbc35810b0973001dd285ecd87029665a20a30508219ad83bd4

SHA512
608adf0d2308d2d5aa15ba2534bb29bddb4544ac68ddf64d0138cfc99697897b904a73843ba48ecc26f5ae2cae8a09248b0d280604710aaaed8cab10c18fd5de

Download Submit
/data/data/com.ary.Configuration/cache/volley/-15765807901702283088

Filesize
627B

MD5
7622fa812fb5ef6ab26acbaf2edff63e

SHA1
cbf38114cf15d7ea51eae81b2049709067f028cc

SHA256
591ace7349a7315abcc2370e66cd9fc22085de6fe70a1579331d25abdca1f6c6

SHA512
63b87bcc7eeedef4352642c28e3c925b02144dfaaf5bc2dc045b5ff07752fbcf70aa4c925c05606a7526b8231c2f0b28d78f4b5d1ada6464c69f31560db24b16

Download Submit
/data/data/com.ary.Configuration/cache/volley/-15765807901702283088

Filesize
684B

MD5
3944b1b1496e25656bbf860d59aff374

SHA1
2d970709091674f01ab4f2916c91ab238b05b62f

SHA256
5d1fbcfb53de6152643c6f371d9d183baf9c03273a8ba13e0773aa7464c9f000

SHA512
ad3b069ed7a02ac8e642a43aeb625ed8a7d76672b6d1a1312c57d5c4dd4ed121c9ef90c9574a276762cb1b075143520596acaf564c0f6f1368a7283ba9006537

Download Submit
/data/data/com.ary.Configuration/databases/com.google.android.datatransport.events

Filesize
56KB

MD5
206b1d39ac0f4d30f848e9e34b9ef83a

SHA1
93d01560e6da57552f3efb6f361a40de26265f4d

SHA256
da79a8f49f7a03aad8d7749d8aedb2d0355f10c8652c1ca279b0a7c2134a2ce9

SHA512
86f4a9e21fa784ccf4fa1ba4df240579e14a0f8297f09f51e1f9f95a224c781672fc3725d7430ca96986c8d7b740ac581d58b057cd589fd66f833f874e79518c

Download Submit
/data/data/com.ary.Configuration/databases/com.google.android.datatransport.events-journal

Filesize
512B

MD5
19b6c7f6851da3f5913bd7e6009c2827

SHA1
39b6b5d11fa321a3093323974211442b4a3af799

SHA256
840aaf97286b85e6ab1c1fae1d4d21856a193f513f39ba7d0b54f65cf77e4550

SHA512
e1d6f83eec1b1d1517fddca47e3e14acf24b1f2fbbb643a225d3f8a96e7861a095fc5166cda9e399458407470d613b89027d527feb8edb52bd4144ed54221e98

Download Submit
/data/data/com.ary.Configuration/databases/com.google.android.datatransport.events-journal

Filesize
8KB

MD5
1ddb78cc275250cd1b2cea50e3fa2b28

SHA1
3a30e5147c37ecd6757ea62ab87d73951c250ef1

SHA256
18ee620b9f60d260d269de0e656ba8ff16f8cdefa7d2e0dddf8a2978075c05fd

SHA512
9be7b6aa4b937ea59d7a088bdf393f4b68822401c3a2430d6d47c2c26035caddcf1324c200e8e310fcfd417779612117b48510bdd064935a7685e843fbebb746

Download Submit
/data/data/com.ary.Configuration/databases/com.google.android.datatransport.events-journal

Filesize
8KB

MD5
db15126095a4b9b963cfe9c0316777ac

SHA1
509d39f6d2c8d1098ee053d121edfc1f23fbdf3b

SHA256
dc7b7a49e7acb9f5deacdc70b89a89869010536c6c39b751f4e5d123b850403d

SHA512
d2471043197de97852a5990c0209a16bb041c95522b75da58fe3bfa72e4d20e83b4ed1c2c21537fc90d10fd719324f152fc4e068f173f91f3fef703474894a63

Download Submit
/data/data/com.ary.Configuration/databases/google_app_measurement_local.db

Filesize
16KB

MD5
eb52a90bb70b76e946b62f50b6f7fb85

SHA1
42d767b5d1faa7dcef4cb4e1432a5f47ec2e9ee0

SHA256
48472f593a3e9cf9e91ee5f7d66dd9ff291bfb247eb6b46778c710fc24e8d3c4

SHA512
b356c858cadd14b6ecddf134f1c494c0107a1d36be9387984fc53dcb00e6779d944f058f4ac99d0fc2fe3a427cd1c2921c6fc38ecad53909fc4b5b6f04459b5c

Download Submit
/data/data/com.ary.Configuration/databases/google_app_measurement_local.db

Filesize
16KB

MD5
c7c7d109656c30f2bd4e1405b3e35eeb

SHA1
c4ea2557297af357ce46a07a42d32426b68b63c1

SHA256
b902d61f66bb647eb2598bfc210d4671ea7de2e396f05d6b7d8f4c24a7fecd9f

SHA512
8337f069f3772d97fe6cae38bf86603348c3f2d1a36c81d647d1805e2db5b4c0f69855c754337e886b3c8d148a47818d4b09eb220bf01a01c599104475b6ba46

Download Submit
/data/data/com.ary.Configuration/databases/google_app_measurement_local.db-journal

Filesize
512B

MD5
fff9645b9f3b89e10391e46ed44f537f

SHA1
54fd0c801403ae080f5dc3070386a0972ad038f1

SHA256
90418a6b8fdbf1d33de691ad9409f4f3c403a5d9d3e6e31acb092e06a3c0c1b1

SHA512
e5ecd690425dc982f3b8af105de6c3c2a4488a9e315cadea9cb12b740d267f44167dd2e05814055db19f99dd757a899d6e292c332f2972ad52208a169c2fa9c0

Download Submit
/data/data/com.ary.Configuration/databases/google_app_measurement_local.db-journal

Filesize
8KB

MD5
d616645fd8da63a79409dcdd3689c0d3

SHA1
eb0439e5c248b8c35624e16e98dc0d1e0715346a

SHA256
18e53aa6eb2d64ae47a0fdba6b7f31346cd1ed1cb14f1b0b9c902d77c2ad4371

SHA512
98b758f94b62124f5aad96072725547a26321344b82e59088c7807ae2dedc65bc4d4cdcec393b8baef32101516baa0f601c5cfb192deb332c5c5c65de7a32c19

Download Submit
/data/data/com.ary.Configuration/databases/google_app_measurement_local.db-journal

Filesize
4KB

MD5
cae18e8b7ca656a10645e77271bf9daf

SHA1
50c2da5df501daf2dac0988f5f6d1cecd32d1d9d

SHA256
a1d6e8d0d7223790da302b85501b12e9dc9b90b98ad1d18d919de2fcfaf167cd

SHA512
6f2342d913cdd0b8779abc01cc49e7ce6f28c864bf14e14121f754a05b5afa31bf286b59175ef47c0f105b30b248724f98e2d3fac34e598019392b012bc487ff

Download Submit
/data/data/com.ary.Configuration/databases/google_app_measurement_local.db-journal

Filesize
8KB

MD5
c0edee68ed7abfc9c146a3a60cdc39cb

SHA1
d452b83e9951494eb634091e88dbb6689117d192

SHA256
ce3d6325eb914687131e12c53965b5c10eeb705d520fb92f1156e28f9485e1ee

SHA512
d0c50139788d375afaa666d9437a96c00fade8bdd2a52d1312868a2413a017d9437f89d855fd2b9a0d56729f274146fb87f0b7b091d97d5883b138d949745169

Download Submit
/data/data/com.ary.Configuration/databases/google_app_measurement_local.db-journal

Filesize
8KB

MD5
f3ed3dcc7b483ed5ab3d10d92fef78b7

SHA1
5b61b70ead6809cd431d5d53e60ce46303d4fad7

SHA256
cae09046caec3085b3c73b19b92f991c17477b9045f5de39444e38f4391da8d7

SHA512
595f30d6b8e13821d940796e9c9246468231b6e54cf7c2ece4c9ab3fc89f754b848d64cab1b5a5a144916c2d89bc6971c9548057c8bbdf3e1fbd410065f1c716

Download Submit
/data/data/com.ary.Configuration/databases/google_app_measurement_local.db-journal

Filesize
8KB

MD5
ff429607a02e6fdf7b721e59e609ee91

SHA1
144dc387bf7f9743ab88e2b160e882b8709039e2

SHA256
9cdc996bdcfa241fd0b3e72ff7050de6a18520c9f07f2de8473a6587b21a46eb

SHA512
586b87de66741efda4e8808d16f57b212d448ef3c06ef1dea29c8e1c8d578821b65999ba8754e189388170b97a602401d16a97e4f36d712b39673e6cde7e175f

Download Submit
/data/data/com.ary.Configuration/files/.com.google.firebase.crashlytics.files.v2:com.ary.Configuration/open-sessions/66AC3DF803AF0001134984C04449F375/report

Filesize
788B

MD5
d95b6b25a968be3462bf7223f3645cb7

SHA1
8d668bbae1688db1311a0cdc3164310dafcbcbcd

SHA256
0d37a2d744ff876043af0eb24492622403c98d831243c57248e364cdf173f4a3

SHA512
d88d72dcd502a9cdebca3dadbd3fa918689bf09a96b791d4734ae3f6fc985a83b620d052878295dfdfbd7c70f4a23020b03db67ccd2ad2ff72499f1a38c6144a

Download Submit
/data/data/com.ary.Configuration/files/PersistedInstallation1287153520142299671tmp

Filesize
90B

MD5
af1e60ebc59b7fa2bbb14c0d8cb15427

SHA1
12cf6c97bfbf963cda0b63e918639bbe58c9a678

SHA256
8d0d0f5445d0132f59135133eb68b2581ef38f53b82051d84fc9dc229c0d4648

SHA512
a8c334b7916d713898f6b3702caabaedfb61c3da76e4bfc940e6655c9b8c9b3a5c7adea309fdb4e144e0bd6805238868308ef87c09d624a54a6a584f7efcb565

Download Submit
/data/data/com.ary.Configuration/files/PersistedInstallation2436133160127437560tmp

Filesize
566B

MD5
9b1f0b9e52c9cbaa279a46e038374d43

SHA1
5a3053bd992dce813e5cb5b69adb2f656c884d35

SHA256
a3cec150cb6d144a23f8cf89ccefc5f926540958143951bd501996eb931c4486

SHA512
ec9118b909e02826bf7d05ea95251bca298d972265e64d52e0bb35626468f54c1f7a4a940b3f1dd55bebbc458343cc53fc66d8be254648cc7c13a2543e960777

Download Submit
/data/data/com.ary.Configuration/files/apks/AApk.apk

Filesize
6.8MB

MD5
47bbb6b73f55739b481102b03f5c259d

SHA1
568aa7f71d528a96f9de3c39cfbb5eebd1c4d1a7

SHA256
3141a558165d163dc83f2a969185cc38ee3ed0a4e8295ea4ac99395a9cdb7499

SHA512
9df376e4bbc748a734521fb1db970f1d201ede7f7332992d30f4407e3ea52f8726f7d5d4015cabc59eb542a8c8bf399259f5e7958da7eb8c85125fbe5856c448

Download Submit
/data/data/com.ary.Configuration/files/localLog.txt

Filesize
82B

MD5
f5b0f56e9e965a7fd65171b7377d0c34

SHA1
6e61c021154321563732c71a3ff573727b73ff91

SHA256
bd5be5a4a7bd892d64b24626310248124caba8d2e9297dd644a154c5ae1a1c4b

SHA512
b4f2d59dc4751df5e67f9e2a384b3bb6f347e958498729e2065d126eac2f253302b7b53e7c15d8d51c5b8544e273408754657b325c3d7bd3576fcdfd676f5139

Download Submit
/data/data/com.ary.Configuration/files/localLog.txt

Filesize
82B

MD5
9fb491b557ddab713749fe7b3ced8d36

SHA1
6f392dc000a0ac4f73c79f6d5b2b112965bee4c5

SHA256
1e7945e67dfddf4611ea85a77b89937d5c5a8525e7351e59d5f409b9181923aa

SHA512
97351fcd40da2cd2b8860294db16cc9b3ea35433ecf53189ee9ce4fb5db18427b010719739daaeced3300382c14b32b4e06670a2cf1c1fe72687c2d44ac99313

Download Submit
/data/data/com.ary.Configuration/files/localLog.txt

Filesize
43B

MD5
d6c47883c8621409482168c2abbeea25

SHA1
0937a4e47175efa883d23f45737a3b1bbe863f9d

SHA256
3131f285db20027e6c01d4c403586d7ca7ae814fc819d10dd06cb0336fb879ce

SHA512
10d224b86cadddc70bc480ecad11b3b0f57dfbe88f63de80027b7070061402100f6538aac21298c34dc17a8d213e6ae667d4646f1ccd5bc8d547f00a9b3c6fe4

Download Submit
/data/data/com.ary.Configuration/files/localLog.txt

Filesize
34B

MD5
69b7f63335156db98324b671874e4a64

SHA1
fb641d2dff55f027cd0dfae8fabcd935a043e928

SHA256
5046d2f95f549edcdcdc2007abb06fcd8d532ac1db85e1ff00091af0c0b1c395

SHA512
d398261fa51b245e44199f0e62bf53fb9be44a7de1ce6f849d8e853399b309ea48c649a98aaeeff222f8f91bd914f0fc861fb99c1778a55927b815c8ddb714b9

Download Submit
/data/data/com.ary.Configuration/files/localLog.txt

Filesize
103B

MD5
3892f289f0cd6eaef39155f5f8d07eae

SHA1
cc37f7af4efc32a67d13b669cb25b23274e87c4e

SHA256
e364c9e7dc8910db7bbb2ece1af6424dd79114e70f20250aa9ad7cb9a7e96fe4

SHA512
f3e51067d45bb7554bd4fe2e2e6a9adf8f836cd7bec8c8fa1bae326a267c43a992ce35a31fc923e592d0f08e8a290febd5b0722669249d48b0cdb6119c38bb7f

Download Submit
/data/data/com.ary.Configuration/files/localLog.txt

Filesize
599B

MD5
bfd0c6a58858ab31a063681814eee81a

SHA1
0af4be85daff1138be50f02144f206e0fe6cfe9b

SHA256
4623e97835f0c57cb4da1ba9ad1bc2115e608cc280c1a25589005c948f305cbc

SHA512
f6f47dc2e82f4667f69d84e098544c38a9d38b22f97ffb512be65c47517a519983b69c903803535fd805611f90560ff6582f439a1caf896481f34926315feafd

Download Submit
/data/data/com.ary.Configuration/files/profileInstalled

Filesize
24B

MD5
9be6922a78b21423090bf38d452b74f0

SHA1
960bb0f44ef12d77d0731fb4931c08089344d38e

SHA256
cc8f1415da077574640443a896d4c2a9111780d7cf53979e53969814220262d9

SHA512
e91f0df46d0ce4d1e9204c9d44ab10522453fff7c9fb950ba4f1298161ae75afd0d128617d0dcf9247283ce05fce48219c9b0f680f5668636806c939989f6643

Download Submit
/data/data/com.ary.Configuration/files/profileinstaller_profileWrittenFor_lastUpdateTime.dat

Filesize
8B

MD5
dff07c9ffcc86841e469d9eafdb8ee1d

SHA1
8e3c1812c39d2cec4439ae36b906784791f61865

SHA256
930ee7b797e9e3fa79c1c5412866141f56dfb587566d2d294137e939a7498665

SHA512
fc472d64ce90092a89b362138396f78ab8a0a761405878b4646fee86142b40efd49da2cc49483f335f43312212c7bccf4ec959b4eb1d0055f3c63b1d724fdb9a

Download Submit
/data/misc/profiles/cur/0/com.ary.Configuration/primary.prof

Filesize
1KB

MD5
4176b0c3ebb802566a5bf877861cd0e6

SHA1
909639413fe0507917fb27d51c4c4d8f7264321f

SHA256
21d5dc40fd77bffe040732af5ee0b689ba7052ca7c86ad259ddb0c3a8f5b5a99

SHA512
d053b83172388e741d55f5305d60b2d92f827f20726173d36bb8e3f3b2b34c21f8a7b357a2461eced035feb62f1f4813cc2432a436345d912eeb385e969054e7

Download Submit
/data/misc/profiles/cur/0/com.ary.Configuration/primary.prof

Filesize
10KB

MD5
899d612ceb7aa6a30f0edb9e54e0cf8a

SHA1
d6dc8486ecf367b4aa3fdb9d8462cc640c1ba942

SHA256
41f93a5fdba5789d849b19020b9b82d7c6de3b02f2a8d51312d5552fd564c75e

SHA512
d4e747bcc2e72d4f6b5fd4ce5af7e02116740da7de5bd7b1623626926b2a32a6dde301e6f3e651824e974bdc125e39cf54769c07b233fb11f111903c1d3e1286

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads