Analysis
-
max time kernel
302s -
max time network
311s -
platform
android_x64 -
resource
android-x64-20240624-en -
resource tags
androidarch:x64arch:x86image:android-x64-20240624-enlocale:en-usos:android-10-x64system -
submitted
07-08-2024 21:37
Behavioral task
behavioral1
Sample
ready.apk
Resource
android-x86-arm-20240624-en
Behavioral task
behavioral2
Sample
ready.apk
Resource
android-x64-20240624-en
Behavioral task
behavioral3
Sample
ready.apk
Resource
android-x64-arm64-20240624-en
General
-
Target
ready.apk
-
Size
696KB
-
MD5
06c5a35a4bef96e1c743ac8acab2c9d4
-
SHA1
c8d83b155a00b89e36887430b9782e0710e22559
-
SHA256
464997c76514be1c491da9fd9999e4da0e7d67e3e744dae020ef8744a6a98271
-
SHA512
d539bd77d9cdbfe6e78c9b9239c9e53a9715742d94db7c4218f13069db5624a9763b2990bb907548ff398467e87e9b134a551d59c834ada82618f9f9ed74b62f
-
SSDEEP
12288:+kUSDx7lDazAK8DdOuOR8ZJ9KZSHJosqrusT3cgtN0FHO6Rq21dgrftWDGT:+kUSF7l4E+R85LoZHT3SFHOGN+wGT
Malware Config
Signatures
-
Makes use of the framework's Accessibility service 4 TTPs 1 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
Processes:
com.appser.verappdescription ioc process Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId com.appser.verapp -
Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs
Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
Processes:
com.appser.verappdescription ioc process Framework service call android.content.IClipboard.addPrimaryClipChangedListener com.appser.verapp -
Performs UI accessibility actions on behalf of the user 1 TTPs 8 IoCs
Application may abuse the accessibility service to prevent their removal.
Processes:
com.appser.verappioc process android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction com.appser.verapp android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction com.appser.verapp android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction com.appser.verapp android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction com.appser.verapp android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction com.appser.verapp android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction com.appser.verapp android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction com.appser.verapp android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction com.appser.verapp -
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
Processes:
com.appser.verappdescription ioc process Framework service call com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone com.appser.verapp -
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
Processes:
com.appser.verappdescription ioc process Framework service call android.app.IActivityManager.registerReceiver com.appser.verapp -
Checks CPU information 2 TTPs 1 IoCs
Processes:
com.appser.verappdescription ioc process File opened for read /proc/cpuinfo com.appser.verapp -
Checks memory information 2 TTPs 1 IoCs
Processes:
com.appser.verappdescription ioc process File opened for read /proc/meminfo com.appser.verapp
Processes
-
com.appser.verapp1⤵
- Makes use of the framework's Accessibility service
- Obtains sensitive information copied to the device clipboard
- Performs UI accessibility actions on behalf of the user
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Checks CPU information
- Checks memory information
PID:4990
Network
MITRE ATT&CK Mobile v15
Defense Evasion
Impair Defenses
1Prevent Application Removal
1Input Injection
1Virtualization/Sandbox Evasion
2System Checks
2Credential Access
Clipboard Data
1Input Capture
2GUI Input Capture
1Keylogging
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
36B
MD5c9f5a46edc612d91584dd6740045e349
SHA1dc38008eb20bd058e295a8da99684f0678b6c82c
SHA256848f27e572de855f0a7db7f5947b3faacf5cb9b4749421a05ab1b5a143f35f7a
SHA512893ae0832923534969e73b82a3ac747d95d85c8e0501dc5c9c646eae892ff26e68a59aed588ef1aa17329ee456f4188b5d20ca967833d4a46f22b74402f4d713
-
Filesize
24B
MD5c08bccb4124a1cd289e7a67082ffb639
SHA1c8fafeded1677786496114f2e7c0343a23adf8de
SHA25605494abd0b5bac3a977873d05ca37a96a336453db5044280d20f5cf78669f244
SHA512ddc7982748abe683d7ad3d9526d962e26fedb5b475aba2709e90d8bf3a2e4d88a77d09934345cd00ffd4c780383d90af12a126771369f4f6f22d4de2781cd317
-
Filesize
24B
MD5a18b62006e1b019beac143f6f420ded7
SHA1cfb0cce0682eaa507e5085356fec570ec614c98d
SHA256255d22364c7467f1dacc13f7b37d4bc528f1ea811b17ff08ef884a4d2ddefdc4
SHA5122c7a4f531829878e346cc0e6981b5a5d0892197fd264767517d2169100d1dad2aca4bdd0dd21537de3dd672fcd8b2b8fcd22007826401b1f8a4720fd36b92541
-
Filesize
24B
MD5ca637df9c30b6340cfc2af75e10c4087
SHA124ba8810903725e5486e4fa3b3039295fe999995
SHA256f5345c751feae5f9fb889b017827d876a8130248f22d394ab4950ae949abf26f
SHA51281372f0ef0138f2dba75e06d38e9f7e6f073101a01838fbb7ee72abdd0b0c2e6d2166af1e8d21c642064d54c24a49430304e02ea6158681fa30c03493defae1d
-
Filesize
56B
MD5206b0652c3fbc176ec8ad02b96d7512b
SHA1b955e72e0c18936f75324d5b6d98fd042207fe04
SHA2566218fdcde2f9e7a0bfbcfadfc2be5bafdd05d38590a155b5a61374394b0af82b
SHA5124b018e26a4e93cf4b20eb3e8d36d63341f3732a165592e98e63dd5ab897a5258a7b84b437d12b0bd5ca15c83e3961bbbfe8c418668ab9ea1561df9fe4a93e6e6