Analysis
-
max time kernel
140s -
max time network
151s -
platform
android_x86 -
resource
android-x86-arm-20240624-en -
resource tags
-
submitted
21-10-2024 14:34
General
-
Target
M-Pajak.apk
-
Size
22.2MB
-
MD5
75faa8e3b2cae0d41561a0e4e63c5eac
-
SHA1
ec358f63b45940bb8f6675d69391b5ca591bf3f1
-
SHA256
0af689da84a03383863583dcad6c640ba4ab9762affde3d56c199a9eb08e9f41
-
SHA512
ee6bc16cd86b4996515aeca347342b1001f313ac4bce514b86a22719c32c3ae63ef616b9804a0b828af549c5d384d1fb21d9bf0305f3e4f4a7bd0d41a803aa0f
-
SSDEEP
196608:uvc4oayxD6neRJi68tCHH58Js1sgAXFNgI7a7YSu33Zu9yzhLrZPsnFphv1rnFpD:ubumeW6uCHOss3FNgIuc9zhL9pY/+ekC
Malware Config
Signatures
-
Checks if the Android device is rooted. 1 TTPs 1 IoCs
-
Makes use of the framework's Accessibility service 4 TTPs 1 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
-
Queries information about running processes on the device 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about running processes on the device.
-
Queries the phone number (MSISDN for GSM devices) 1 TTPs
-
Reads the contacts stored on the device. 1 TTPs 1 IoCs
-
Reads the content of the SMS messages. 1 TTPs 1 IoCs
-
Enumerates running processes
Discovers information about currently running processes on the system
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
-
Makes use of the framework's foreground persistence service 1 TTPs 2 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
-
Performs UI accessibility actions on behalf of the user 1 TTPs 2 IoCs
Application may abuse the accessibility service to prevent their removal.
-
Queries information about active data network 1 TTPs 1 IoCs
-
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
-
Queries the unique device ID (IMEI, MEID, IMSI) 1 TTPs
-
Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
-
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
-
Schedules tasks to execute at a specified time 1 TTPs 1 IoCs
Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.
-
Checks CPU information 2 TTPs 1 IoCs
-
Checks memory information 2 TTPs 1 IoCs
Processes
-
com.anydesk.adcontrol.ad11⤵
- Checks if the Android device is rooted.
- Makes use of the framework's Accessibility service
- Queries information about running processes on the device
- Reads the contacts stored on the device.
- Reads the content of the SMS messages.
- Makes use of the framework's foreground persistence service
- Performs UI accessibility actions on behalf of the user
- Queries information about active data network
- Queries the mobile country code (MCC)
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Schedules tasks to execute at a specified time
- Checks CPU information
- Checks memory information
-
com.anydesk.adcontrol.ad1:remote1⤵
- Makes use of the framework's foreground persistence service
Network
MITRE ATT&CK Enterprise v15
MITRE ATT&CK Mobile v15
Persistence
Event Triggered Execution
1Broadcast Receivers
1Foreground Persistence
1Scheduled Task/Job
1Defense Evasion
Foreground Persistence
1Hide Artifacts
1User Evasion
1Impair Defenses
1Prevent Application Removal
1Input Injection
1Virtualization/Sandbox Evasion
2System Checks
2Discovery
Process Discovery
1Software Discovery
1Security Software Discovery
1System Information Discovery
3System Network Configuration Discovery
3System Network Connections Discovery
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
232B
MD5a1ff966771967082a58695782042f3ad
SHA10272b32d80f90fd22fb555c1eff81b577a09ea00
SHA2561a16059d7ba29fa9afd0edae1a8e6996d88390c91f75f31e2fcde0611215c80d
SHA5129c64e5bb47b7c9f0e60787f1c8cb4433b340aea6547271475f4429b8f15ba5b617c9736552fc7173b38b63f4a56a06ccf45db7f373b8f459702f32faab0ec902
-
Filesize
58B
MD50d210bfb2a0e1f1b4c082a6a0f79de07
SHA1bb8ed9e364db79d1d9f2fcde3f15091893222faa
SHA256988722c23d78a46021d0e7ca9deee7aa8bb83288269174ffacb7316f381cca1d
SHA512536e9867b0df29b15b789f8949be6ab37fcdeccb9d39ded981da7dc2052c9533d0ec0e6f9a5444132977605d372e1463d91bdde41b528ff2ca3f65ab152325c1
-
Filesize
143KB
MD55dc1983554a88c2a224ee046bb7314ec
SHA15b09273776014bf32fd8aa7bca9ce151d2c7d98f
SHA2566a4d32e8ef673e70a8a4963124417be10eb09089f3aa049e1e3c7de515c69f21
SHA5125ce30ef36c25d33f3416006c103608057a9cc88f2d88fe37de3bd895d68a005644d74aca0abd5bef02f2ed17709a38ae249b0dabeaa16d1c46c8a8c9d85c7e88
-
Filesize
4KB
MD5f2b4b0190b9f384ca885f0c8c9b14700
SHA1934ff2646757b5b6e7f20f6a0aa76c7f995d9361
SHA2560a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514
SHA512ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1
-
Filesize
512B
MD5589a8f35138cf28530bc6e08966339fb
SHA141be4c3b9fdcaec634484ae2233b04e0a8ace6ef
SHA256a0b330b3c07b0acfc15588760f972f79fbc77d824384ad23299d5a4ab316912e
SHA51278b9e659627095e2d82ac946ed820fed5094e99a880a0452dd7948ba69b15b308023213dc0a89a2f9f2302d5d1d63b8dad76eefd46952ed9a8a64f76976ce486
-
Filesize
32KB
MD5bb7df04e1b0a2570657527a7e108ae23
SHA15188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA256c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
SHA512768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012
-
Filesize
257KB
MD54cb4b6e0d61be442ca855285adf5f3cf
SHA142abf3a4e3394514c0e868a537acce620f4439aa
SHA256eb6195e7aaa755a5ff44fd893c4c6eb3d966a789376c3186939b2a7bd9121b22
SHA5122f8b75d1b12d531f7c540f5d5abdaac7af34866b88ac38f424ef5d890d5c0e57eaf2fd986580f1c594764d6459b12400c6d1a7d841402b12cf5501d26a3e36be
-
Filesize
13B
MD59d077690d19202e7a6a65b69daca1f92
SHA173182879e4aafc22e00a4ceefee23cbbaf172885
SHA256ffd1ecb04a2b322e322988b31de9a94907d6a8a93b2a14427cbb6a58bb761478
SHA512dbc9d5c61cabbee661f9aecb32854185a582157b525da67aa8ec276f06bdc1b2b3e1396166dbbd3fc2f229738be61b6055abfaccf2cfa9325600bd48baa88c02
-
Filesize
4KB
MD5620f0b67a91f7f74151bc5be745b7110
SHA11ceaf73df40e531df3bfb26b4fb7cd95fb7bff1d
SHA256ad7facb2586fc6e966c004d7d1d16b024f5805ff7cb47c7a85dabd8b48892ca7
SHA5122d23913d3759ef01704a86b4bee3ac8a29002313ecc98a7424425a78170f219577822fd77e4ae96313547696ad7d5949b58e12d5063ef2ee063b595740a3a12d
-
Filesize
24B
MD5387a2b7157d54cec92a4aa9f6c59bf60
SHA1b054a5e76730307d567339705c710052cf10ebe0
SHA256ac40f06f392ffbb86811a1c83a55b7844b42b40133b0ede12eb933b0e82af669
SHA51269d89d32cba79c16a1830710c82cdf99a5f975145cf098698dac6ae1d9327d6b7fcb553949e9fa7dd531edbb354d620684d97909567c4b91b3a2f017a5a77834
-
Filesize
8B
MD541bb4150abffea032caee0e4400cd32a
SHA156d5b87135c1a7e0ebd829a666a5c82cd72b3965
SHA2567964d643b12ebe106034196330c1a7cdf572bd5f676d27b1d891dee0e1e36c71
SHA512227d4cc476468b325302f258692a41e68d50edf3e2bf4e13cd5e06354e2de32d86e75bfe2da9f8a5967aeb11ec6ba356268eee5a46b18d9af1d0a9b245965639
-
Filesize
1KB
MD5fa474c58358d4dfa85196500663efa46
SHA11c78af93550ad06119f6c27c6f31af3e5abf63b5
SHA256e6766c52faa9be83d391dbb9ca02ac87eaed04444c095d4639fe52afd9df4a10
SHA5128e32a830c8251e4c5ca14553a4842a54c9d09852ff886c1f7e6f76d22da3a2e049c549ceb17991995113c3f97baf629043f061fa0ae3deacbb6ad372f5229858
-
Filesize
13KB
MD56a702c1b2dc57de866cf8655b58c814e
SHA1217474061fe7fc98bfac6a0449dab1a8ba8eceea
SHA256b01943fe52b2d62f64f1e27bffd0010f7a545629b34269913aff03c94389801b
SHA512fc3f779d5d6cc18851090641672d270db150370c035f625489f3748803574d0a39f6e123c54fa299b3b1bb159ac89c86a10885af1d0a425f58d4858e50e81ebd
-
Filesize
1KB
MD58425526b68a6ef2918fdcec605c6ca0d
SHA1e4bfd12388eea89fdcd6ae320187c10314d9ce6f
SHA2560f3a77b618be781398238682b18ee6ed76448970002178dcfe012a5f6aec2a70
SHA512d26729c1ea2206213f68b3a64467f766deda25046d340ceff9c6e7f8334c248765de6b1dd6dc48e0314ff61a3464aed6994671b8e9d70dc54227865ab8b11abb
-
Filesize
28KB
MD5e3c411512352da582ca546c5324e6a11
SHA15e03b9a9287457d06c4ef6bffbe4e254c6fc8130
SHA25681b5a3594bc83c2edc9f3937215ab9b5c3956a019ff9d6737b9a9abca1708745
SHA512b1ba0f3a22f5ef461ef7b3cbed96c98cccf66de91897b30e42a04eea9ae51d5327b24292200b308784cb45ce72c4502f1a7bc36e030cf7d54e73dd7dbb0e7999
