Analysis
-
max time kernel
29s -
max time network
39s -
platform
android_x64 -
resource
android-x64-arm64-20240624-en -
resource tags
androidarch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20240624-enlocale:en-usos:android-11-x64system -
submitted
24-08-2024 10:20
Static task
static1
Behavioral task
behavioral1
Sample
c18c5ca32b80d4b595500853e1899d03edbe954d1e79da14f167aa888918d547.apk
Resource
android-x86-arm-20240624-en
Behavioral task
behavioral2
Sample
c18c5ca32b80d4b595500853e1899d03edbe954d1e79da14f167aa888918d547.apk
Resource
android-x64-20240624-en
Behavioral task
behavioral3
Sample
c18c5ca32b80d4b595500853e1899d03edbe954d1e79da14f167aa888918d547.apk
Resource
android-x64-arm64-20240624-en
General
-
Target
c18c5ca32b80d4b595500853e1899d03edbe954d1e79da14f167aa888918d547.apk
-
Size
312KB
-
MD5
1285e688bb834e348023425ab4bbbfa5
-
SHA1
605526f8ee8bb7150dbd2a4b90ab9ab5edabd7da
-
SHA256
c18c5ca32b80d4b595500853e1899d03edbe954d1e79da14f167aa888918d547
-
SHA512
6cf4ab3fa4222487731d7cc353b96db63129e9138092167abdb577f6cace82f4f7ffb0a992e9d76c30ae5b2a24f4c87a9bdcd767f30c52ee885ea1f5b2d5d258
-
SSDEEP
6144:jam054ohSedp4p1znyG5RUMWjgZCoXJvasgcgN:jjWhCnnFHUs3pashgN
Malware Config
Signatures
-
pid Process 4730 wcqrucdpzh.otstodvvsm.vrbnjqrsrr -
Makes use of the framework's Accessibility service 4 TTPs 2 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
description ioc Process Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId wcqrucdpzh.otstodvvsm.vrbnjqrsrr Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByText wcqrucdpzh.otstodvvsm.vrbnjqrsrr -
Acquires the wake lock 1 IoCs
description ioc Process Framework service call android.os.IPowerManager.acquireWakeLock wcqrucdpzh.otstodvvsm.vrbnjqrsrr -
Schedules tasks to execute at a specified time 1 TTPs 1 IoCs
Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.
description ioc Process Framework service call android.app.job.IJobScheduler.schedule wcqrucdpzh.otstodvvsm.vrbnjqrsrr