Analysis
-
max time kernel
149s -
max time network
158s -
platform
android_x64 -
resource
android-x64-arm64-20240624-en -
resource tags
-
submitted
21-10-2024 18:11
General
-
Target
CapCut Editor Pro.apk
-
Size
8.5MB
-
MD5
0ec8314eba27165048ff7c6d703280a3
-
SHA1
7286edd7f30e30db3e166a3582fb973015684e6e
-
SHA256
996b8d31c118e8a7fa21a0d75aa46a2c40fdc9153d9387d399c0ad529207a2b3
-
SHA512
56efd96aa161f62d5ff350cd7614a863d5fac36d3d275ac1f5d116a1216930c7581ba9a7a49d56d358522c1f054173f12794de78c28cedfde88408f8b7a04400
-
SSDEEP
98304:hLMCu5JhoeeGxusdL65Vvlun/mzDzB0T/0tsE:hLMCQhcsd8vlYuzKwL
Malware Config
Signatures
-
Makes use of the framework's Accessibility service 4 TTPs 3 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs
Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
-
Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
-
Acquires the wake lock 1 IoCs
-
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
-
Queries information about active data network 1 TTPs 1 IoCs
-
Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
-
Schedules tasks to execute at a specified time 1 TTPs 1 IoCs
Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.
-
Checks CPU information 2 TTPs 1 IoCs
-
Checks memory information 2 TTPs 1 IoCs
Processes
-
services.developed.sellers1⤵
- Makes use of the framework's Accessibility service
- Obtains sensitive information copied to the device clipboard
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Queries information about active data network
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Schedules tasks to execute at a specified time
- Checks CPU information
- Checks memory information
Network
MITRE ATT&CK Mobile v15
Defense Evasion
Foreground Persistence
1Hide Artifacts
1User Evasion
1Input Injection
1Virtualization/Sandbox Evasion
2System Checks
2Credential Access
Clipboard Data
1Input Capture
2GUI Input Capture
1Keylogging
1Discovery
Software Discovery
1Security Software Discovery
1System Information Discovery
2System Network Connections Discovery
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
21B
MD5a4c61b0ee4a996e6d469bfc35a6d9e42
SHA1cce97f96796759ca0a62aaefd47c49b4fbf425c5
SHA25656435df185a14b785daff397a06e80d0487f3c62d26e63df23d89abf3b2ad794
SHA5129cdeed84e99d9ede29d88f2af7f80bf2a77f5d6de08073cd43a58564317f84773fbe8874fa955a902956a43274ce374d6d26f31add64434f95951c3a9b78e1be
-
Filesize
29B
MD5b9b530e2448252311640bbecb69b796a
SHA1215ede46fb42a68a7ae84c3019acb3019668a46c
SHA2565a290151305de1ec4f790cd8ada8bd68c076a2c4ed497c40a519509659b65150
SHA5125834499307946d130887067b2f837ddfef7fdfe3a7e5ed8977eb14c2dc1ab328334da35ed4c978e20b3e6b28ff30dbd12f0430f4b7c831481f339d360c260919
-
Filesize
29B
MD5a442592e332b26186c00d87e52d3dda6
SHA1325a37d09ad64ea69610b6b745e5203a84208961
SHA2569067346c2bf6c8d48336f646535995abcd1ade3168b6f6dab50b40e75c11c081
SHA5122ea62fae946ccebb62aae6f7719fd66b6891734375a4f39cfe520b2ae013d79ea9bbf3ea911555a2337a68084e56e349e57310efa5742d932d38123780fd0976