Analysis
-
max time kernel
149s -
max time network
153s -
platform
android_x86 -
resource
android-x86-arm-20240624-en -
resource tags
-
submitted
14/10/2024, 20:07
General
-
Target
c78901020e5cc35239904fba638594319d601a521cb3861959650becd27b587b.apk
-
Size
696KB
-
MD5
6eb1198d80702f3566cd99bf9e4ed1a2
-
SHA1
5232ea1996c3ca536e195a4cd0d90f7d1621ef01
-
SHA256
c78901020e5cc35239904fba638594319d601a521cb3861959650becd27b587b
-
SHA512
73958bfb8f13ad6a23d881ff699bfea90db79908350f9603d7e6cdeafb6ead399dccb11f7f103920c505246d3e994a4b16268bffb787c16b3883de265c3b1a04
-
SSDEEP
12288:H2wXPfCSkkLbLZSkBZm6UxVXGusT3cgtN0Fzml6Rq21Wg/QtWDsXd:H9P69WbLgkBZHHT3SFzmlGNDzst
Malware Config
Signatures
-
Removes its main activity from the application launcher 1 TTPs 1 IoCs
-
Makes use of the framework's Accessibility service 4 TTPs 2 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Acquires the wake lock 1 IoCs
-
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
-
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
-
Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
-
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
-
Schedules tasks to execute at a specified time 1 TTPs 1 IoCs
Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.
-
Checks CPU information 2 TTPs 1 IoCs
-
Checks memory information 2 TTPs 1 IoCs
Processes
-
app.everspy.ru1⤵
- Removes its main activity from the application launcher
- Makes use of the framework's Accessibility service
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Queries the mobile country code (MCC)
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Schedules tasks to execute at a specified time
- Checks CPU information
- Checks memory information
Network
MITRE ATT&CK Mobile v15
Persistence
Event Triggered Execution
1Broadcast Receivers
1Foreground Persistence
1Scheduled Task/Job
1Defense Evasion
Foreground Persistence
1Hide Artifacts
2Suppress Application Icon
1User Evasion
1Input Injection
1Virtualization/Sandbox Evasion
2System Checks
2Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
20B
MD5a1bb837a0a7716c00797da6af87029b1
SHA1aa3f7f5ae26e15fa1bff0fab2d9987c97dfbb90b
SHA256ee9d48e4aa1efb84fbedf68d1fc61782bb3a93c5da15dc197a492f150b4feeec
SHA512443955e3a57e98eaa6cd51f134352f37de8e8b79151816abacdc7a789a7ad92f4234e3766440a9ab4ed4a65bbe314f2f2338d93c17a7181f26d73ad2e302b911
-
Filesize
20B
MD536bee55fcd5bf21398e15c4dfab101b8
SHA1194fa0b9c8c7de572952fdd6ee12d0db84072d67
SHA2562b90fa71d86ece3d1e473e3a6029360bf8fa191d2d34cd7152e8dec14c46f93c
SHA512cb3ea4d1c7af6bbc5b18ff5dcf183abd9c2a15265a9dd9a9784cac8917f871603374dac261815f35166a420afffc2b1da853bf761e51b928a0f973d0f439a0c2
-
Filesize
36B
MD544abbff4966121dce248678525d33bea
SHA1bc3259c60f8bdad0e950f4f960cd895a1c007769
SHA25642cfbc29439b1ba6ce656d375cf28baf58dfe183bc7395970971ac9de3504faa
SHA512300b446925a137c5c5501df53fa6d0550481bc6da8bbe0b2449d3caca0e37032b918e7ae87a45f717d0dbecfe65239f492b89fc2e77b49c6beb0ce3dd545c5b2
-
Filesize
275B
MD5468df386e7b8bf29a67c7aac2dfe262f
SHA1110f169a4aaa3f73f9ab0587d97e08a02491e6ea
SHA25641439596d6655d12ca739a86a7ecc430c3a638daf13f521bf32f3b4037cb1fc1
SHA512e7a9c1083e9cafe10e563b0fe175bba5159ea0bd507e93b498787c298caec69057437281aae0d56ec435b6ab62c7e4bdb8e1d43d6e57569d0dffafadf9bf0c57