Analysis

  • max time kernel
    149s
  • max time network
    155s
  • platform
    android_x64
  • resource
    android-x64-20240624-en
  • resource tags

    androidarch:x64arch:x86image:android-x64-20240624-enlocale:en-usos:android-10-x64system
  • submitted
    17/09/2024, 02:09

General

  • Target
    ZOTEYD.apk
  • Size 2.0MB
  • Sample240917-ck71eazekk
  • SHA256 8651b7d7bee00f17fc9c6e0e65563c9b491e81edbde8c479bde6ec1ddc960d15
  • MD5 SHA1 SHA512 SSDEEP

Malware Config

Signatures

  • Queries account information for other applications stored on the device 1 TTPs 1 IoCs

    Application may abuse the framework's APIs to collect account information stored on the device.

  • Acquires the wake lock 1 IoCs
  • Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

    Application may abuse the framework's foreground service to continue running in the foreground.

  • Queries information about active data network 1 TTPs 1 IoCs

Processes

  • com.example.dat.a8andoserverx
    1⤵
    • Queries account information for other applications stored on the device
    • Acquires the wake lock
    • Makes use of the framework's foreground persistence service
    • Queries information about active data network
    PID:4969

Network

        MITRE ATT&CK Mobile v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        .im8.jpg

        • Path /storage/emulated/0/DCIM/.im8.jpg
        • Size 4KB
        • SHA256 89f4677035ac1783b8249dffe2381ad7df82fca3a10873e7fee270967ffa57b8
        • MD5 SHA1 SHA512 SSDEEP

        .im8.jpg

        • Path /storage/emulated/0/DCIM/.im8.jpg
        • Size 5KB
        • SHA256 bd775c101026bbd6ba43391f2bb36749a489e684c8a05662ef8f6e5162d5cc38
        • MD5 SHA1 SHA512 SSDEEP

        .im8.jpg

        • Path /storage/emulated/0/DCIM/.im8.jpg
        • Size 5KB
        • SHA256 16aeec47ff433c55def6270077db65de25595ee1934cd5331cfc133bb7b0b659
        • MD5 SHA1 SHA512 SSDEEP