c78901020e5cc35239904fba638594319d601a521cb3861959650becd27b587b

General

Target

c78901020e5cc35239904fba638594319d601a521cb3861959650becd27b587b.apk
Size

696KB
MD5

6eb1198d80702f3566cd99bf9e4ed1a2
SHA1

5232ea1996c3ca536e195a4cd0d90f7d1621ef01
SHA256

c78901020e5cc35239904fba638594319d601a521cb3861959650becd27b587b
SHA512

73958bfb8f13ad6a23d881ff699bfea90db79908350f9603d7e6cdeafb6ead399dccb11f7f103920c505246d3e994a4b16268bffb787c16b3883de265c3b1a04
SSDEEP

12288:H2wXPfCSkkLbLZSkBZm6UxVXGusT3cgtN0Fzml6Rq21Wg/QtWDsXd:H9P69WbLgkBZHHT3SFzmlGNDzst

Score

8^/10

collection credential_access evasion execution impact persistence stealth trojan

Malware Config

Signatures

Removes its main activity from the application launcher 1 TTPs 1 IoCs

stealth trojan evasion

Suppress Application Icon

T1628.001

pid	Process
4517	app.everspy.ru

Makes use of the framework's Accessibility service 4 TTPs 2 IoCs

Retrieves information displayed on the phone screen using AccessibilityService.

collection evasion credential_access

Input Injection

T1516

Screen Capture

T1513

Keylogging

T1417.001

GUI Input Capture

T1417.002

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	app.everspy.ru
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId	app.everspy.ru

Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs

Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.

collection credential_access impact

Clipboard Data

T1414

Transmitted Data Manipulation

T1641.001

description	ioc	Process
Framework service call	android.content.IClipboard.addPrimaryClipChangedListener	app.everspy.ru

Acquires the wake lock 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	app.everspy.ru

Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

Application may abuse the framework's foreground service to continue running in the foreground.

evasion persistence

Foreground Persistence

T1541

description	ioc	Process
Framework service call	android.app.IActivityManager.setServiceForeground	app.everspy.ru

Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs

evasion

User Evasion

T1628.002

description	ioc	Process
Intent action	android.settings.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS	app.everspy.ru

Schedules tasks to execute at a specified time 1 TTPs 1 IoCs

Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.

execution persistence

Scheduled Task/Job

T1603

description	ioc	Process
Framework service call	android.app.job.IJobScheduler.schedule	app.everspy.ru

Checks CPU information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	app.everspy.ru

Checks memory information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	app.everspy.ru

app.everspy.ru
1⤵
- Removes its main activity from the application launcher
- Makes use of the framework's Accessibility service
- Obtains sensitive information copied to the device clipboard
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Schedules tasks to execute at a specified time
- Checks CPU information
- Checks memory information
PID:4517

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Scheduled Task/Job

1

T1603

Persistence

Foreground Persistence

Scheduled Task/Job

Privilege Escalation

Defense Evasion

Foreground Persistence

1

T1541

Hide Artifacts

2

T1628

Suppress Application Icon

1

T1628.001

User Evasion

Input Injection

Virtualization/Sandbox Evasion

2

T1633

System Checks

2

T1633.001

Credential Access

Clipboard Data

1

T1414

Input Capture

2

T1417

GUI Input Capture

1

T1417.002

Keylogging

1

T1417.001

Discovery

System Information Discovery

2

T1426

Lateral Movement

Collection

Clipboard Data

1

T1414

Input Capture

2

T1417

GUI Input Capture

1

T1417.002

Keylogging

Screen Capture

Command and Control

Exfiltration

Impact

Data Manipulation

1

T1641

Transmitted Data Manipulation

Input Injection

Replay Monitor

Loading Replay Monitor...

Downloads

/storage/emulated/0/Config/sys/apps/log/log-2024-10-14.txt

Filesize
32B

MD5
c93c5f7a849ac5dd9d99a7dd77fcbbaf

SHA1
2b8b0fd7d84143e80a979b9b476986d3cf6a1e1b

SHA256
dc892a6df66d12e2c278ea6e8584b0a8b2f155c6402481efe6332d9fe42513a6

SHA512
08359d3325a88a5bb8c5ed49a6653805d6b170247a90b9bac68d05f5623af75e6702140528830143850aea164ac87d24b435467d94f2cee61572d7d60e4c3bf8

Download Submit
/storage/emulated/0/Config/sys/apps/log/log-2024-10-14.txt

Filesize
20B

MD5
a1bb837a0a7716c00797da6af87029b1

SHA1
aa3f7f5ae26e15fa1bff0fab2d9987c97dfbb90b

SHA256
ee9d48e4aa1efb84fbedf68d1fc61782bb3a93c5da15dc197a492f150b4feeec

SHA512
443955e3a57e98eaa6cd51f134352f37de8e8b79151816abacdc7a789a7ad92f4234e3766440a9ab4ed4a65bbe314f2f2338d93c17a7181f26d73ad2e302b911

Download Submit
/storage/emulated/0/Config/sys/apps/log/log-2024-10-14.txt

Filesize
20B

MD5
36bee55fcd5bf21398e15c4dfab101b8

SHA1
194fa0b9c8c7de572952fdd6ee12d0db84072d67

SHA256
2b90fa71d86ece3d1e473e3a6029360bf8fa191d2d34cd7152e8dec14c46f93c

SHA512
cb3ea4d1c7af6bbc5b18ff5dcf183abd9c2a15265a9dd9a9784cac8917f871603374dac261815f35166a420afffc2b1da853bf761e51b928a0f973d0f439a0c2

Download Submit
/storage/emulated/0/Config/sys/apps/log/log-2024-10-14.txt

Filesize
48B

MD5
4d04c6fb171d6a43c27cc3dca809f079

SHA1
bcff408e87266d4f7431c082102becfd28bb678d

SHA256
72adb8501aeff878aea10c9e4c2e1f3db8f8fa6b51934841969e961e6c8ed41b

SHA512
15f8fdd1f686f5a4b60637faa5103cffde223f7a3f2cf666e5992084418844a093fb5145ae5b6c93e995d106817a981299dd9f8cb0d41387ed032230c4569dc5

Download Submit
/storage/emulated/0/Config/sys/apps/log/log-2024-10-14.txt

Filesize
275B

MD5
d7b164e569793914db278779b63563ee

SHA1
13bbb04b49ff78838b4db19ecb5591c7d2c8f8e7

SHA256
1349249a80af05bf6db5d2c5f7300cf541fadafbdee2ec0e88c8cb95991db9f1

SHA512
8950f0920ee5ff3ca86c879d167949f831102a27f7d8ba5bcd15d5a85bcde7be29ac6881d74313f95ce2ea22bac05dc899597854439923053fe2f9daa7279dbb

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads