Analysis

  • max time kernel
    111s
  • max time network
    84s
  • platform
    android_x86
  • resource
    android-x86-arm-20240624-en
  • resource tags

    androidarch:armarch:x86image:android-x86-arm-20240624-enlocale:en-usos:android-9-x86system
  • submitted
    07-08-2024 21:53

General

  • Target

    ready.apk

  • Size

    8.5MB

  • MD5

    6082b5dc1353aae9aa21cdea633aba35

  • SHA1

    8938bf46337000b30a0506d0462d46166de49899

  • SHA256

    22db1592a6baa3f90ae2ba47bc024b28ab48b2fb420e2b838ba216c9bfaa9507

  • SHA512

    befcf1b32e352e2ba1dc09f5c4b32ee2ce7685522be5d1e54967723a9f8cbf150649f7b3d11cf1ce1ca42d1524ce61dbc6115b0a4095b0aa35c8882e2eeb6b0d

  • SSDEEP

    98304:ES6p+dL6maOWsGN6GpQ81Mlmz8zBmTC0tRu:ES6pc1WskT13zlB0

Malware Config

Signatures

  • Makes use of the framework's Accessibility service 4 TTPs 3 IoCs

    Retrieves information displayed on the phone screen using AccessibilityService.

  • Acquires the wake lock 1 IoCs
  • Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

    Application may abuse the framework's foreground service to continue running in the foreground.

  • Performs UI accessibility actions on behalf of the user 1 TTPs 4 IoCs

    Application may abuse the accessibility service to prevent their removal.

  • Queries information about active data network 1 TTPs 1 IoCs
  • Queries the mobile country code (MCC) 1 TTPs 1 IoCs
  • Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
  • Requests enabling of the accessibility settings. 1 IoCs
  • Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
  • Schedules tasks to execute at a specified time 1 TTPs 1 IoCs

    Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.

  • Checks CPU information 2 TTPs 1 IoCs
  • Checks memory information 2 TTPs 1 IoCs

Processes

  • susan.re.tape
    1⤵
    • Makes use of the framework's Accessibility service
    • Acquires the wake lock
    • Makes use of the framework's foreground persistence service
    • Performs UI accessibility actions on behalf of the user
    • Queries information about active data network
    • Queries the mobile country code (MCC)
    • Requests disabling of battery optimizations (often used to enable hiding in the background).
    • Requests enabling of the accessibility settings.
    • Registers a broadcast receiver at runtime (usually for listening for system events)
    • Schedules tasks to execute at a specified time
    • Checks CPU information
    • Checks memory information
    PID:4262

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • /storage/emulated/0/Config/sys/apps/log/log-2024-08-07.txt

    Filesize

    25B

    MD5

    d03c94c89c9dee43c7422d4efa7937cf

    SHA1

    c752cde3ac59c2cf986bf488ed7078a9ae27fa3f

    SHA256

    9c65480d93292ef16a3ad639c5ff36321a700ae05aa02a7ba40a24d92935434c

    SHA512

    bee9f0abcb20c784491eec95bf4626beb56e054f8939c1ab4385f694d4cc0a542267af4b662ef3a83f35e10de2b0a4b7038e34fd4a79f58db53bd726eebd4b2b

  • /storage/emulated/0/Config/sys/apps/log/log-2024-08-07.txt

    Filesize

    25B

    MD5

    455606a8ce76478454a9271cf0cd20f8

    SHA1

    dfd6238c9fb16d16a71a1f7e616d65974bc69036

    SHA256

    ac0b11d28c0ed6926261a37d2e5fb0ad65550de1817abd40681e3847fa1289f4

    SHA512

    b8d57cdeed494bb0de7e709bd37d21a9c4781f03bee988287bc93c11a60ac90332838b5a4a8c041173a43123b76863ac1a0ea676c7aec46294c81c136400aa10

  • /storage/emulated/0/Config/sys/apps/log/log-2024-08-07.txt

    Filesize

    25B

    MD5

    ba30336bf53d54ed3c0ea69dd545de8c

    SHA1

    ce99c6724c75b93b7448e2d9fac16ca702a5711f

    SHA256

    2d6988fb5afdaafc4e33fa1f71d6f10c95ab5a49a8ec820add5b13eef05439af

    SHA512

    eea34ca526e03349e746d3687ea660b4748f0174fe2ffdb65161e232e08630b345e03329614852ce881a71362ba68575e9dd08fa361a416e5b2fb231e21a0a3e

  • /storage/emulated/0/Config/sys/apps/log/log-2024-08-07.txt

    Filesize

    280B

    MD5

    60e2c9f868e1e36c08d88029044dbea1

    SHA1

    29291ad58bdf12988571b6f51712524fab47608f

    SHA256

    fe0c7039bedf14a9ca19e0e3d0de4b0a540cd994fa17ebd7a5608a565ce53724

    SHA512

    10f3a8840dab0009982c57547b81d2546df321805c80dbb2694e5e90444b715015a83dd62c4055b8311f1fdfd2d3f86830f8bdc93d729270a06731707abf570e