Analysis
-
max time kernel
316s -
max time network
330s -
platform
android_x86 -
resource
android-x86-arm-20240624-en -
resource tags
androidarch:armarch:x86image:android-x86-arm-20240624-enlocale:en-usos:android-9-x86system -
submitted
07-08-2024 21:37
Behavioral task
behavioral1
Sample
ready.apk
Resource
android-x86-arm-20240624-en
Behavioral task
behavioral2
Sample
ready.apk
Resource
android-x64-20240624-en
Behavioral task
behavioral3
Sample
ready.apk
Resource
android-x64-arm64-20240624-en
General
-
Target
ready.apk
-
Size
696KB
-
MD5
06c5a35a4bef96e1c743ac8acab2c9d4
-
SHA1
c8d83b155a00b89e36887430b9782e0710e22559
-
SHA256
464997c76514be1c491da9fd9999e4da0e7d67e3e744dae020ef8744a6a98271
-
SHA512
d539bd77d9cdbfe6e78c9b9239c9e53a9715742d94db7c4218f13069db5624a9763b2990bb907548ff398467e87e9b134a551d59c834ada82618f9f9ed74b62f
-
SSDEEP
12288:+kUSDx7lDazAK8DdOuOR8ZJ9KZSHJosqrusT3cgtN0FHO6Rq21dgrftWDGT:+kUSF7l4E+R85LoZHT3SFHOGN+wGT
Malware Config
Signatures
-
Makes use of the framework's Accessibility service 4 TTPs 1 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
Processes:
com.appser.verappdescription ioc process Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId com.appser.verapp -
Performs UI accessibility actions on behalf of the user 1 TTPs 16 IoCs
Application may abuse the accessibility service to prevent their removal.
Processes:
com.appser.verappioc process android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction com.appser.verapp android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction com.appser.verapp android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction com.appser.verapp android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction com.appser.verapp android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction com.appser.verapp android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction com.appser.verapp android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction com.appser.verapp android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction com.appser.verapp android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction com.appser.verapp android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction com.appser.verapp android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction com.appser.verapp android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction com.appser.verapp android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction com.appser.verapp android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction com.appser.verapp android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction com.appser.verapp android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction com.appser.verapp -
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
Processes:
com.appser.verappdescription ioc process Framework service call com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone com.appser.verapp -
Requests enabling of the accessibility settings. 1 IoCs
Processes:
com.appser.verappdescription ioc process Intent action android.settings.ACCESSIBILITY_SETTINGS com.appser.verapp -
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
Processes:
com.appser.verappdescription ioc process Framework service call android.app.IActivityManager.registerReceiver com.appser.verapp -
Checks CPU information 2 TTPs 1 IoCs
Processes:
com.appser.verappdescription ioc process File opened for read /proc/cpuinfo com.appser.verapp -
Checks memory information 2 TTPs 1 IoCs
Processes:
com.appser.verappdescription ioc process File opened for read /proc/meminfo com.appser.verapp
Processes
-
com.appser.verapp1⤵
- Makes use of the framework's Accessibility service
- Performs UI accessibility actions on behalf of the user
- Queries the mobile country code (MCC)
- Requests enabling of the accessibility settings.
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Checks CPU information
- Checks memory information
PID:4253
Network
MITRE ATT&CK Mobile v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
24B
MD5c08bccb4124a1cd289e7a67082ffb639
SHA1c8fafeded1677786496114f2e7c0343a23adf8de
SHA25605494abd0b5bac3a977873d05ca37a96a336453db5044280d20f5cf78669f244
SHA512ddc7982748abe683d7ad3d9526d962e26fedb5b475aba2709e90d8bf3a2e4d88a77d09934345cd00ffd4c780383d90af12a126771369f4f6f22d4de2781cd317
-
Filesize
40B
MD53a71cc46a72de9883a7b8fa8cbe34ca1
SHA1ef1bbdb281e546b3628a1a845b4941db1ca9e4a3
SHA256c06d9e99f6ee253432eadfdfac6008e211182c3770fd883fd0ff6e4e08a5e201
SHA512f65df913a1f4ecb920de54fb6c30ec52368e3b61043f9e37656f364d420f97d3a816ef2b0c6d9e770521e3cf1818cf9c5d689482418278b3c967a4d57c9bdf07
-
Filesize
24B
MD519e9022a0237abfcb41de0da45b6cdc8
SHA1cfcb8500f6e281eb42e54dbf472cc05fefdf55ac
SHA2566a3ed19be60f504848d404f19e7c3dc35b0e2d623fab204e02d6aa93acc0c4c3
SHA512bd02400d5f3f91054f1bf60ccc35457d6f3d83fccae18b3fbbe22b81c5fa86e430d2886685a6a7777c5714d25b16499be31ce86097e64d3b878c04d89dd2aec6
-
Filesize
255B
MD55aa83f2038ff2c209e30c933b9e418d5
SHA1cacfe99f0b60816d455ecfb2dd89687617fee9f0
SHA256518358f5dc7ed9465a3eb42c250c6eb776cece12e4cffca279171ceca9e69968
SHA512a7bfb5ef95a86c547c7cea87e563b36e568a8ccf3f9b72dc5ca3ee021a43e0a480bdc9f20b36d44bf91ce6a26ae4a1be67f6238c59f07b77a6f0d9000bd94f9d