Analysis
-
max time kernel
141s -
max time network
133s -
platform
android_x86 -
resource
android-x86-arm-20240624-en -
resource tags
-
submitted
10-10-2024 01:32
General
-
Target
i.apk
-
Size
7.1MB
-
MD5
0ea1827d432e1f7564cb1f19c9c103f1
-
SHA1
93b37065c3c6fe2b26196c05f7caf85bba21ef68
-
SHA256
3f5064669a60ae6a5bbabe7edb12e263bd4915bf2db1497d7ac35823114c938a
-
SHA512
52134ec2c2c1e3e0ab458af4875d5a2715e128d350ced2f784caa2eaf7f4dca574c9e6b4b27598667607b6c81c0acb519128718a0b86bc04cd44c85c410ee448
-
SSDEEP
98304:Y6i3HB8NCRrr9aFvuwIVuzOLMxjipCB+Tk1h2reR0YwVP4Q8nkC2+kPIqVjzCp64:li3HuERrr9fDSZjiocrkkP43MPIqi2+
Malware Config
Signatures
-
Loads dropped Dex/Jar 1 TTPs 6 IoCs
Runs executable file dropped to the device during analysis.
-
Makes use of the framework's Accessibility service 4 TTPs 2 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Acquires the wake lock 1 IoCs
-
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
-
Performs UI accessibility actions on behalf of the user 1 TTPs 1 IoCs
Application may abuse the accessibility service to prevent their removal.
-
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
Processes
-
com.hnrizrrwx.ymrrhnwee1⤵
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Performs UI accessibility actions on behalf of the user
- Uses Crypto APIs (Might try to encrypt user data)
-
/system/bin/dex2oat --debuggable --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --debuggable --generate-mini-debug-info --dex-file=/data/user/0/com.hnrizrrwx.ymrrhnwee/app_app_dex/kmsgekm.nqi --output-vdex-fd=42 --oat-fd=43 --oat-location=/data/user/0/com.hnrizrrwx.ymrrhnwee/app_app_dex/oat/x86/kmsgekm.odex --compiler-filter=quicken --class-loader-context=&2⤵
- Loads dropped Dex/Jar
-
-
/system/bin/dex2oat --debuggable --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --debuggable --generate-mini-debug-info --dex-file=/data/user/0/com.hnrizrrwx.ymrrhnwee/app_app_dex/nwueeqs.nqi --output-vdex-fd=42 --oat-fd=43 --oat-location=/data/user/0/com.hnrizrrwx.ymrrhnwee/app_app_dex/oat/x86/nwueeqs.odex --compiler-filter=quicken --class-loader-context=&2⤵
- Loads dropped Dex/Jar
-
Network
MITRE ATT&CK Mobile v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3.1MB
MD547d0379611610d169b7bc36de0078bca
SHA151219928bef9b5cc2184c0c108c5415ea0963ca0
SHA256d96e1eff9974ffa121678ca8132f7c667303cc96615aa6378c286171e87153a4
SHA5126c2d6897374be2f1e66254a0a80281c1c526b7e4c2a4dbe5f529f8ef5bb1bf5dd3c5dbb3792d60b7f9492f50a244873be7feb3036826e5bee2cab2abc575b2d4
-
Filesize
5.6MB
MD50c56b4e0f578fe3c09cafad0680ebf99
SHA157d9e101c70e4efa316f2c4836be84292af6dae9
SHA256e8a53838ace9e57b54b4c3b5dc35cb9a0c71455c2c082fac42646986d5136385
SHA512636f4a529d5187059ac22734a49a379023d66115170d69df605012973478fb1fb9f9182169626bed00415386693eb0febd1b537f8d40dc9f7364335b0e392189