Analysis
- max time kernel
149s - max time network
155s - platform
android_x64 - resource
android-x64-20240624-en - resource tags
androidarch:x64arch:x86image:android-x64-20240624-enlocale:en-usos:android-10-x64system - submitted
17/09/2024, 02:09
Behavioral task
behavioral1
Sample
ZOTEYD.apk
Resource
android-x86-arm-20240624-en
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
ZOTEYD.apk
Resource
android-x64-20240624-en
4 signatures
150 seconds
General
- Target ZOTEYD.apk
- Size 2.0MB
- Sample240917-ck71eazekk
- SHA256 8651b7d7bee00f17fc9c6e0e65563c9b491e81edbde8c479bde6ec1ddc960d15
- MD5 a3ff7ca693095014914f3ae37f05ac28
- SHA1 df519db5d0441db91881fc701faff240637ed6c5
- SHA512 ee01d2452d4741f2813b244e27cd8c94d17e9d5a9105694725556cd0c26ca2ffa10f8f087cbf9aded4427d738b8ff8fdb8c23b5f507b7d16ecf712ab2410d6e3
- SSDEEP 49152:XrDrfuUFQWjF6ICtCbcj4ZtRxBnH4ZFm7Tpl0:XrDrHQUF6IPbccnRxN4ZFg0
- MD5 SHA1 SHA512 SSDEEP
Score
7/10
Malware Config
Signatures
- Queries account information for other applications stored on the device 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect account information stored on the device.
description ioc Process Framework service call android.accounts.IAccountManager.getAccounts com.example.dat.a8andoserverx - Acquires the wake lock 1 IoCs
description ioc Process Framework service call android.os.IPowerManager.acquireWakeLock com.example.dat.a8andoserverx - Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
description ioc Process Framework service call android.app.IActivityManager.setServiceForeground com.example.dat.a8andoserverx - Queries information about active data network 1 TTPs 1 IoCs
description ioc Process Framework service call android.net.IConnectivityManager.getActiveNetworkInfo com.example.dat.a8andoserverx
Processes
Network
MITRE ATT&CK Mobile v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path /storage/emulated/0/DCIM/.im8.jpg
- Size 4KB
- SHA256 89f4677035ac1783b8249dffe2381ad7df82fca3a10873e7fee270967ffa57b8
- MD5 51d95a2ce94184c0fcba6f16613db0f5
- SHA1 d74ef7421a592ef804c17c375aca9549f103ed07
- SHA512 3cccf6108a524283c98a7ca8b8d968a18e4911f6ba83689ddcdd645738320645a97363d51b87d6a36d972bcd61519a5f7d979b2eac1a3185a9e9a73d5f2cce87
- SSDEEP 48:96l81V/JAyuIPEXe1dQsmmGao56T837Q8I03nIIBKSkL6Hi/rbgEojgu2DlEqT0/:96l8RuIwPmrosT83U8hQ60rbgr6Z0UuN
- MD5 SHA1 SHA512 SSDEEP
- Path /storage/emulated/0/DCIM/.im8.jpg
- Size 5KB
- SHA256 bd775c101026bbd6ba43391f2bb36749a489e684c8a05662ef8f6e5162d5cc38
- MD5 3ae3aafb2bed1223470bb0904a870a66
- SHA1 1b3e90b8dbc0df17a5f59bc552f0389e7cec38ea
- SHA512 da863bd8a7dea728d22d3e51072c8ddcb9edf452757efc3d85bc9f8efc32505a826da2d480c4659d7e0b0d0265483f0a1f392250f2022788146097db5971b608
- SSDEEP 96:96l8etJd2nVMUTNOamACaVZfLiA/3ebgfmfsdIjUgo:9jy7U5OqtfLiAjuAb
- MD5 SHA1 SHA512 SSDEEP
- Path /storage/emulated/0/DCIM/.im8.jpg
- Size 5KB
- SHA256 16aeec47ff433c55def6270077db65de25595ee1934cd5331cfc133bb7b0b659
- MD5 7194a57e5a8987fe7a74e52ac7ff938c
- SHA1 dced0a1c95dd19ee820b05fb27e8999ea737045c
- SHA512 60a2876cf9b096fa211bdda3ee671be5e90b6cbd58d4c59e44f254c9fb0f60419950d45cd0e916403bb79773a3953319808982ca7b3bae767b28afd1ebd345ed
- SSDEEP 96:96l8nv2zGkUuoZE9bWpxvgdKpD+0RpthuI:9jv26jubwjoeDJRpzuI
- MD5 SHA1 SHA512 SSDEEP