Analysis
-
max time kernel
149s -
max time network
156s -
platform
android_x64 -
resource
android-x64-20240624-en -
resource tags
-
submitted
14/10/2024, 20:07
General
-
Target
c78901020e5cc35239904fba638594319d601a521cb3861959650becd27b587b.apk
-
Size
696KB
-
MD5
6eb1198d80702f3566cd99bf9e4ed1a2
-
SHA1
5232ea1996c3ca536e195a4cd0d90f7d1621ef01
-
SHA256
c78901020e5cc35239904fba638594319d601a521cb3861959650becd27b587b
-
SHA512
73958bfb8f13ad6a23d881ff699bfea90db79908350f9603d7e6cdeafb6ead399dccb11f7f103920c505246d3e994a4b16268bffb787c16b3883de265c3b1a04
-
SSDEEP
12288:H2wXPfCSkkLbLZSkBZm6UxVXGusT3cgtN0Fzml6Rq21Wg/QtWDsXd:H9P69WbLgkBZHHT3SFzmlGNDzst
Malware Config
Signatures
-
Removes its main activity from the application launcher 1 TTPs 1 IoCs
-
Makes use of the framework's Accessibility service 4 TTPs 2 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs
Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
-
Acquires the wake lock 1 IoCs
-
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
-
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
-
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
-
Schedules tasks to execute at a specified time 1 TTPs 1 IoCs
Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.
-
Checks CPU information 2 TTPs 1 IoCs
-
Checks memory information 2 TTPs 1 IoCs
Processes
-
app.everspy.ru1⤵
- Removes its main activity from the application launcher
- Makes use of the framework's Accessibility service
- Obtains sensitive information copied to the device clipboard
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Schedules tasks to execute at a specified time
- Checks CPU information
- Checks memory information
Network
MITRE ATT&CK Mobile v15
Persistence
Event Triggered Execution
1Broadcast Receivers
1Foreground Persistence
1Scheduled Task/Job
1Defense Evasion
Foreground Persistence
1Hide Artifacts
1Suppress Application Icon
1Input Injection
1Virtualization/Sandbox Evasion
2System Checks
2Credential Access
Clipboard Data
1Input Capture
2GUI Input Capture
1Keylogging
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
20B
MD5a1bb837a0a7716c00797da6af87029b1
SHA1aa3f7f5ae26e15fa1bff0fab2d9987c97dfbb90b
SHA256ee9d48e4aa1efb84fbedf68d1fc61782bb3a93c5da15dc197a492f150b4feeec
SHA512443955e3a57e98eaa6cd51f134352f37de8e8b79151816abacdc7a789a7ad92f4234e3766440a9ab4ed4a65bbe314f2f2338d93c17a7181f26d73ad2e302b911
-
Filesize
20B
MD536bee55fcd5bf21398e15c4dfab101b8
SHA1194fa0b9c8c7de572952fdd6ee12d0db84072d67
SHA2562b90fa71d86ece3d1e473e3a6029360bf8fa191d2d34cd7152e8dec14c46f93c
SHA512cb3ea4d1c7af6bbc5b18ff5dcf183abd9c2a15265a9dd9a9784cac8917f871603374dac261815f35166a420afffc2b1da853bf761e51b928a0f973d0f439a0c2
-
Filesize
48B
MD54d04c6fb171d6a43c27cc3dca809f079
SHA1bcff408e87266d4f7431c082102becfd28bb678d
SHA25672adb8501aeff878aea10c9e4c2e1f3db8f8fa6b51934841969e961e6c8ed41b
SHA51215f8fdd1f686f5a4b60637faa5103cffde223f7a3f2cf666e5992084418844a093fb5145ae5b6c93e995d106817a981299dd9f8cb0d41387ed032230c4569dc5
-
Filesize
275B
MD5d7b164e569793914db278779b63563ee
SHA113bbb04b49ff78838b4db19ecb5591c7d2c8f8e7
SHA2561349249a80af05bf6db5d2c5f7300cf541fadafbdee2ec0e88c8cb95991db9f1
SHA5128950f0920ee5ff3ca86c879d167949f831102a27f7d8ba5bcd15d5a85bcde7be29ac6881d74313f95ce2ea22bac05dc899597854439923053fe2f9daa7279dbb