Resubmissions

06-08-2024 09:37

240806-ll1gdszcqd 10

05-08-2024 17:24

240805-vypebswgrf 10

05-08-2024 17:22

240805-vxll2swgpd 10

04-08-2024 22:14

240804-15xxyaxhmr 10

Analysis

  • max time kernel
    179s
  • max time network
    187s
  • platform
    android_x64
  • resource
    android-33-x64-arm64-20240624-en
  • resource tags

    androidarch:arm64arch:x64image:android-33-x64-arm64-20240624-enlocale:en-usos:android-13-x64system
  • submitted
    05-08-2024 17:24

General

  • Target

    xiezi015436 .apk

  • Size

    5.0MB

  • MD5

    8fe8d843d3ccd242dce71ab13827aff3

  • SHA1

    1a650859ba4aaa79b9d091c6909afca7d8f12799

  • SHA256

    aa8829ed490d1eb7794d3baf3f4693583da130d275b44083c050255fc92fc8a1

  • SHA512

    ccbb57a89bb6cf1ed66b6b6c833bb52c27cf7f4034cebd3a38151f3f8999405ee09f24756e28b7bef6c2f20caede8ea110d52dff3735e89633fd36b449f0cc61

  • SSDEEP

    98304:ewmzezBzTz0trktFXpBX4MfjZakOqtkjDUwFUfaoK57f:+ze8YXpxj4kD2lF0W9f

Malware Config

Signatures

  • Makes use of the framework's Accessibility service 4 TTPs 3 IoCs

    Retrieves information displayed on the phone screen using AccessibilityService.

  • Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs

    Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.

  • Acquires the wake lock 1 IoCs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
  • Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

    Application may abuse the framework's foreground service to continue running in the foreground.

  • Performs UI accessibility actions on behalf of the user 1 TTPs 8 IoCs

    Application may abuse the accessibility service to prevent their removal.

  • Queries information about active data network 1 TTPs 1 IoCs
  • Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
  • Schedules tasks to execute at a specified time 1 TTPs 1 IoCs

    Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.

  • Checks CPU information 2 TTPs 1 IoCs
  • Checks memory information 2 TTPs 1 IoCs

Processes

  • goat.proportion.performance
    1⤵
    • Makes use of the framework's Accessibility service
    • Obtains sensitive information copied to the device clipboard
    • Acquires the wake lock
    • Makes use of the framework's foreground persistence service
    • Performs UI accessibility actions on behalf of the user
    • Queries information about active data network
    • Requests disabling of battery optimizations (often used to enable hiding in the background).
    • Schedules tasks to execute at a specified time
    • Checks CPU information
    • Checks memory information
    PID:4361

Network

MITRE ATT&CK Enterprise v15

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • /storage/emulated/0/Config/sys/apps/log/log-2024-08-05.txt

    Filesize

    21B

    MD5

    cfb2fc8a0af4f4adec3fe47a4b07650c

    SHA1

    bf2888f53795c86ca8cd8f65477b475181502547

    SHA256

    916f3c154374fb9958d715001a369e4eb7a00ba5b3dc8c39a3f91b23be1e191d

    SHA512

    f7e44ccc4e499e319960f5c9f1aa49fac6038912d3608bdd161d0279d422b40456292eabef080f0e3466f2050b5240d3ee6d653dc80df489a859a367c1d289c6

  • /storage/emulated/0/Config/sys/apps/log/log-2024-08-05.txt

    Filesize

    25B

    MD5

    ba30336bf53d54ed3c0ea69dd545de8c

    SHA1

    ce99c6724c75b93b7448e2d9fac16ca702a5711f

    SHA256

    2d6988fb5afdaafc4e33fa1f71d6f10c95ab5a49a8ec820add5b13eef05439af

    SHA512

    eea34ca526e03349e746d3687ea660b4748f0174fe2ffdb65161e232e08630b345e03329614852ce881a71362ba68575e9dd08fa361a416e5b2fb231e21a0a3e

  • /storage/emulated/0/Config/sys/apps/log/log-2024-08-05.txt

    Filesize

    252B

    MD5

    79ddf3da9a97236fb01f79bc7070ab6e

    SHA1

    0c0dfa17ef65b5851f1bf70cc750285389fa69ba

    SHA256

    66b85608b934d0d4fb101be61830e74575f6bbc8c2363b3913c120ebf342a009

    SHA512

    518a2be820d6da64e9dccb3446195e0e5ac5896f4afa90b7828fd675bd503aef93a7104aa4d317a11f46e5b6c6635a9f9f277a1cd1c4d2dae86216da81b8ede6

  • /storage/emulated/0/Config/sys/apps/log/log-2024-08-05.txt

    Filesize

    57B

    MD5

    f6779f298e8b7d295bff5052756e20b0

    SHA1

    e319e6b2112d1f6375bdb9eecea946a37acb83f9

    SHA256

    b9e2bb4393b820eba129503a1923344bd5d85cf58dc72a3ac61507bd8b8b00ea

    SHA512

    f8e51df072e101203747f1a3c3d85ab2bd63a0d1645b895115e4bb1fef73da9cfefa9da0f256e94a9b48a6b477807e3297dc4a685dab647159033d90bc8ab53c