Analysis
-
max time kernel
179s -
max time network
189s -
platform
android_x64 -
resource
android-x64-arm64-20240624-en -
resource tags
-
submitted
23-08-2024 13:08
General
-
Target
ready.apk
-
Size
5.6MB
-
MD5
968a107ff580a03959ac90ae8a5952e9
-
SHA1
bc513532c356995f7b0cfeaafb42793e65c57ff6
-
SHA256
afa70b455d4ee532d679323f6e189b225647784ca8103df62acc5c78c537f9cb
-
SHA512
c0d566e0d96c0f35abf022ee32df8af0703cc65e7e55260f788d32747b65d9b5268a086f9c0f27cf67d87110b854bc871d4709462efdc2f104425a79000a0917
-
SSDEEP
12288:twlbo9GgLRBWItYYyow7HCgI4arSQP7fKBx6Rq21Fg975oC:twlfglBWItYYjwjCgI4EmbGN2R
Malware Config
Signatures
-
Removes its main activity from the application launcher 1 TTPs 1 IoCs
-
Makes use of the framework's Accessibility service 4 TTPs 3 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs
Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
-
Acquires the wake lock 1 IoCs
-
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
-
Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
-
Schedules tasks to execute at a specified time 1 TTPs 1 IoCs
Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.
-
Checks CPU information 2 TTPs 1 IoCs
-
Checks memory information 2 TTPs 1 IoCs
Processes
-
upskirto1.kiss.street1⤵
- Removes its main activity from the application launcher
- Makes use of the framework's Accessibility service
- Obtains sensitive information copied to the device clipboard
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Schedules tasks to execute at a specified time
- Checks CPU information
- Checks memory information
Network
MITRE ATT&CK Mobile v15
Defense Evasion
Foreground Persistence
1Hide Artifacts
2Suppress Application Icon
1User Evasion
1Input Injection
1Virtualization/Sandbox Evasion
2System Checks
2Credential Access
Clipboard Data
1Input Capture
2GUI Input Capture
1Keylogging
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
20B
MD5e2ee1d5a5fd0f95c540e2e454514c7fc
SHA16d00b6c1e3f8201042bbaf93d3a330cfd7357b3a
SHA2562f12b8423a6aad2f17a2256bde9b8c5f34f4f02c17179814b388996580fc7b1e
SHA5121d40224ff0c3b93d4dbb1db0ab3615753cf2172afbf2278a92d4860d55ead9f64f6817b6444d0b4ac144e52b33b6b9cb43706f5ebf6696f6aafadfc3189ffec5
-
Filesize
12B
MD5a9256f55737b655c8cff95418411997c
SHA1d81a4e85ecef3a4f08d50da9c75c49a3c64ffe24
SHA256bad705c44807d12463fb587087c4e9eb24769d82981229ac8b74abc9b1a44412
SHA51210d10a6498973ed65d47c74ba6d8831dad94213a5071353dc445de46e021689284fbbf4accf5ba1f97a0675a7652ec069ac70f38d63ba36b8595a8caf8d37574
-
Filesize
271B
MD5e9675010d5975e731cba6c38d0a18c31
SHA1894875a6ef454a4f6db867416d79e8d4828af961
SHA2569bfea5a0cce4402a135fd0e853b1de75951086a0169fe03fbb6f10028a64b659
SHA512dda3745b4880999555fb9c5da118725093d4a2507568eef4974185b78154787f8f87399484b0f77100c07862ada226c75250b3a336eae63eac6516ada324b107