Analysis
-
max time kernel
179s -
max time network
176s -
platform
android_x64 -
resource
android-x64-arm64-20240624-en -
resource tags
-
submitted
07-08-2024 22:16
General
-
Target
cb27e4531fb2c11b30d7f149a5fdf6b802137b7bc04426dc27e089c6353ed3e2.apk
-
Size
1.5MB
-
MD5
caf8ce8f4987e423481b28b00587ab73
-
SHA1
97845805f238b05440e6bc96421d01de5925668d
-
SHA256
cb27e4531fb2c11b30d7f149a5fdf6b802137b7bc04426dc27e089c6353ed3e2
-
SHA512
bcb265526f51135c2a3d5ad750abb0f0664cd121f3a45fd417793d8544e25655f4e9fe629b337f60c5440a9bf82b874a0022f1761064fd4fac5ac99338a4712c
-
SSDEEP
49152:M5EIKco/5XVCHt0Ckhq2sFxYnSk/CL/n2a:MmIZo/5lCHtGhq2ksr/+2a
Malware Config
Signatures
-
Removes its main activity from the application launcher 1 TTPs 1 IoCs
-
Makes use of the framework's Accessibility service 4 TTPs 1 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
-
Queries the phone number (MSISDN for GSM devices) 1 TTPs
-
Acquires the wake lock 1 IoCs
-
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
-
Queries information about active data network 1 TTPs 1 IoCs
-
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
-
Requests enabling of the accessibility settings. 1 IoCs
-
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
Processes
-
sampop.sampo.samp1⤵
- Removes its main activity from the application launcher
- Makes use of the framework's Accessibility service
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Queries information about active data network
- Queries the mobile country code (MCC)
- Requests enabling of the accessibility settings.
- Uses Crypto APIs (Might try to encrypt user data)
Network
MITRE ATT&CK Mobile v15
Defense Evasion
Foreground Persistence
1Hide Artifacts
1Suppress Application Icon
1Input Injection
1Discovery
Software Discovery
1Security Software Discovery
1System Network Configuration Discovery
2System Network Connections Discovery
1