Analysis
-
max time kernel
179s -
max time network
161s -
platform
android_x86 -
resource
android-x86-arm-20240624-en -
resource tags
androidarch:armarch:x86image:android-x86-arm-20240624-enlocale:en-usos:android-9-x86system -
submitted
06-08-2024 09:51
Behavioral task
behavioral1
Sample
ready.apk
Resource
android-x86-arm-20240624-en
Behavioral task
behavioral2
Sample
ready.apk
Resource
android-x64-20240624-en
Behavioral task
behavioral3
Sample
ready.apk
Resource
android-x64-arm64-20240624-en
General
-
Target
ready.apk
-
Size
6.2MB
-
MD5
211d34ce11710f949825bb6cd0df21df
-
SHA1
4485edf80952024922c352b1616f507e65a6d634
-
SHA256
e9d1f2314105bfa14bc60b3e312463a044fa4cc7b1c8455751a9f2582a077ce2
-
SHA512
4f68ef062189262ffc95c12ee9b5b1cd6ea20af2c20493a7114ec3e88ec4f6abdadf6c062c19249cfe4d05dd89dcec5000f2dcf3655078c55a19d70c0b86ee63
-
SSDEEP
24576:GIAma80GlSNwpBlicH26/yHLRF7VyioVDca77EjwFsNiz:GTmaUJpBR26KlF7Vyiod77wC
Malware Config
Signatures
-
Makes use of the framework's Accessibility service 4 TTPs 3 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
Processes:
westminster.ala.soldierdescription ioc process Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByText westminster.ala.soldier Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId westminster.ala.soldier Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId westminster.ala.soldier -
Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
-
Acquires the wake lock 1 IoCs
Processes:
westminster.ala.soldierdescription ioc process Framework service call android.os.IPowerManager.acquireWakeLock westminster.ala.soldier -
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
Processes:
westminster.ala.soldierdescription ioc process Framework service call android.app.IActivityManager.setServiceForeground westminster.ala.soldier -
Performs UI accessibility actions on behalf of the user 1 TTPs 12 IoCs
Application may abuse the accessibility service to prevent their removal.
Processes:
westminster.ala.soldierioc process android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction westminster.ala.soldier android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction westminster.ala.soldier android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction westminster.ala.soldier android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction westminster.ala.soldier android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction westminster.ala.soldier android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction westminster.ala.soldier android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction westminster.ala.soldier android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction westminster.ala.soldier android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction westminster.ala.soldier android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction westminster.ala.soldier android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction westminster.ala.soldier android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction westminster.ala.soldier -
Queries information about active data network 1 TTPs 1 IoCs
Processes:
westminster.ala.soldierdescription ioc process Framework service call android.net.IConnectivityManager.getActiveNetworkInfo westminster.ala.soldier -
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
Processes:
westminster.ala.soldierdescription ioc process Framework service call com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone westminster.ala.soldier -
Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
Processes:
westminster.ala.soldierdescription ioc process Intent action android.settings.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS westminster.ala.soldier -
Requests enabling of the accessibility settings. 1 IoCs
Processes:
westminster.ala.soldierdescription ioc process Intent action android.settings.ACCESSIBILITY_SETTINGS westminster.ala.soldier -
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
Processes:
westminster.ala.soldierdescription ioc process Framework service call android.app.IActivityManager.registerReceiver westminster.ala.soldier -
Schedules tasks to execute at a specified time 1 TTPs 1 IoCs
Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.
Processes:
westminster.ala.soldierdescription ioc process Framework service call android.app.job.IJobScheduler.schedule westminster.ala.soldier -
Checks CPU information 2 TTPs 1 IoCs
Processes:
westminster.ala.soldierdescription ioc process File opened for read /proc/cpuinfo westminster.ala.soldier -
Checks memory information 2 TTPs 1 IoCs
Processes:
westminster.ala.soldierdescription ioc process File opened for read /proc/meminfo westminster.ala.soldier
Processes
-
westminster.ala.soldier1⤵
- Makes use of the framework's Accessibility service
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Performs UI accessibility actions on behalf of the user
- Queries information about active data network
- Queries the mobile country code (MCC)
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Requests enabling of the accessibility settings.
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Schedules tasks to execute at a specified time
- Checks CPU information
- Checks memory information
PID:4262
Network
MITRE ATT&CK Mobile v15
Persistence
Event Triggered Execution
1Broadcast Receivers
1Foreground Persistence
1Scheduled Task/Job
1Defense Evasion
Foreground Persistence
1Hide Artifacts
1User Evasion
1Impair Defenses
1Prevent Application Removal
1Input Injection
1Virtualization/Sandbox Evasion
2System Checks
2Discovery
Software Discovery
1Security Software Discovery
1System Information Discovery
2System Network Configuration Discovery
1System Network Connections Discovery
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
25B
MD5ba30336bf53d54ed3c0ea69dd545de8c
SHA1ce99c6724c75b93b7448e2d9fac16ca702a5711f
SHA2562d6988fb5afdaafc4e33fa1f71d6f10c95ab5a49a8ec820add5b13eef05439af
SHA512eea34ca526e03349e746d3687ea660b4748f0174fe2ffdb65161e232e08630b345e03329614852ce881a71362ba68575e9dd08fa361a416e5b2fb231e21a0a3e
-
Filesize
17B
MD5e9741c8b822d66f3190e379511b05305
SHA15a534d9a8acf1d681cc5fcc3fe872eff02abaec2
SHA2565cbdeb6552a33c4de8ade686f135d01418fe09d82e9cb3a7219be145c80bd152
SHA51244db01c4a90608d23be9825e7ce24d240e1ee211e576b7b67b564b67f7737d9fcd28ed5338196bc5541592ad0284aeda4a9f4df0302f462147b127f3a1db1fc9
-
Filesize
29B
MD57894f49b8a2827fd2ca587bc3832fb53
SHA1cadefe15bb5b19112d4ff1b299ada21e239cbaea
SHA256d29aec8f78950c9ad553834d4007fc26de49b80f5b3b07a3c4b90c342814c1c3
SHA512e3b111bf1a5409b905d6cf7465b9f325ff401ce8d16b67de47f1e581c2b056fa58d285b46999dbb1ac2ff3b9ce2f18a08685c5a6625a24a597171c9ac6dfaefe
-
Filesize
341B
MD5d2b727d0e0e72c9e27e0643a40723b1e
SHA1e4f19c6e50e0fd7584293c7efc2cda53082dbf6e
SHA256fdb6ace5da4a17bf17c754636adf16b5322efb982293324a6775733bb7511ada
SHA512ce589a6cdf30a24c2508fb7db6c215fefb33863ba3ede176be81e61d3a0cd38c22c2ff000a6e26d7d4d4ff738bd0c73e64e3654dc2863d7771183e6320a4021b