Analysis

  • max time kernel
    179s
  • max time network
    161s
  • platform
    android_x86
  • resource
    android-x86-arm-20240624-en
  • resource tags

    androidarch:armarch:x86image:android-x86-arm-20240624-enlocale:en-usos:android-9-x86system
  • submitted
    06-08-2024 09:51

General

  • Target

    ready.apk

  • Size

    6.2MB

  • MD5

    211d34ce11710f949825bb6cd0df21df

  • SHA1

    4485edf80952024922c352b1616f507e65a6d634

  • SHA256

    e9d1f2314105bfa14bc60b3e312463a044fa4cc7b1c8455751a9f2582a077ce2

  • SHA512

    4f68ef062189262ffc95c12ee9b5b1cd6ea20af2c20493a7114ec3e88ec4f6abdadf6c062c19249cfe4d05dd89dcec5000f2dcf3655078c55a19d70c0b86ee63

  • SSDEEP

    24576:GIAma80GlSNwpBlicH26/yHLRF7VyioVDca77EjwFsNiz:GTmaUJpBR26KlF7Vyiod77wC

Malware Config

Signatures

  • Makes use of the framework's Accessibility service 4 TTPs 3 IoCs

    Retrieves information displayed on the phone screen using AccessibilityService.

  • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
  • Acquires the wake lock 1 IoCs
  • Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

    Application may abuse the framework's foreground service to continue running in the foreground.

  • Performs UI accessibility actions on behalf of the user 1 TTPs 12 IoCs

    Application may abuse the accessibility service to prevent their removal.

  • Queries information about active data network 1 TTPs 1 IoCs
  • Queries the mobile country code (MCC) 1 TTPs 1 IoCs
  • Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
  • Requests enabling of the accessibility settings. 1 IoCs
  • Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
  • Schedules tasks to execute at a specified time 1 TTPs 1 IoCs

    Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.

  • Checks CPU information 2 TTPs 1 IoCs
  • Checks memory information 2 TTPs 1 IoCs

Processes

  • westminster.ala.soldier
    1⤵
    • Makes use of the framework's Accessibility service
    • Acquires the wake lock
    • Makes use of the framework's foreground persistence service
    • Performs UI accessibility actions on behalf of the user
    • Queries information about active data network
    • Queries the mobile country code (MCC)
    • Requests disabling of battery optimizations (often used to enable hiding in the background).
    • Requests enabling of the accessibility settings.
    • Registers a broadcast receiver at runtime (usually for listening for system events)
    • Schedules tasks to execute at a specified time
    • Checks CPU information
    • Checks memory information
    PID:4262

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • /storage/emulated/0/Config/sys/apps/log/log-2024-08-06.txt

    Filesize

    25B

    MD5

    ba30336bf53d54ed3c0ea69dd545de8c

    SHA1

    ce99c6724c75b93b7448e2d9fac16ca702a5711f

    SHA256

    2d6988fb5afdaafc4e33fa1f71d6f10c95ab5a49a8ec820add5b13eef05439af

    SHA512

    eea34ca526e03349e746d3687ea660b4748f0174fe2ffdb65161e232e08630b345e03329614852ce881a71362ba68575e9dd08fa361a416e5b2fb231e21a0a3e

  • /storage/emulated/0/Config/sys/apps/log/log-2024-08-06.txt

    Filesize

    17B

    MD5

    e9741c8b822d66f3190e379511b05305

    SHA1

    5a534d9a8acf1d681cc5fcc3fe872eff02abaec2

    SHA256

    5cbdeb6552a33c4de8ade686f135d01418fe09d82e9cb3a7219be145c80bd152

    SHA512

    44db01c4a90608d23be9825e7ce24d240e1ee211e576b7b67b564b67f7737d9fcd28ed5338196bc5541592ad0284aeda4a9f4df0302f462147b127f3a1db1fc9

  • /storage/emulated/0/Config/sys/apps/log/log-2024-08-06.txt

    Filesize

    29B

    MD5

    7894f49b8a2827fd2ca587bc3832fb53

    SHA1

    cadefe15bb5b19112d4ff1b299ada21e239cbaea

    SHA256

    d29aec8f78950c9ad553834d4007fc26de49b80f5b3b07a3c4b90c342814c1c3

    SHA512

    e3b111bf1a5409b905d6cf7465b9f325ff401ce8d16b67de47f1e581c2b056fa58d285b46999dbb1ac2ff3b9ce2f18a08685c5a6625a24a597171c9ac6dfaefe

  • /storage/emulated/0/Config/sys/apps/log/log-2024-08-06.txt

    Filesize

    341B

    MD5

    d2b727d0e0e72c9e27e0643a40723b1e

    SHA1

    e4f19c6e50e0fd7584293c7efc2cda53082dbf6e

    SHA256

    fdb6ace5da4a17bf17c754636adf16b5322efb982293324a6775733bb7511ada

    SHA512

    ce589a6cdf30a24c2508fb7db6c215fefb33863ba3ede176be81e61d3a0cd38c22c2ff000a6e26d7d4d4ff738bd0c73e64e3654dc2863d7771183e6320a4021b