Analysis
-
max time kernel
149s -
max time network
150s -
platform
android_x64 -
resource
android-33-x64-arm64-20240624-en -
resource tags
-
submitted
21-10-2024 18:11
General
-
Target
CapCut Editor Pro.apk
-
Size
8.5MB
-
MD5
0ec8314eba27165048ff7c6d703280a3
-
SHA1
7286edd7f30e30db3e166a3582fb973015684e6e
-
SHA256
996b8d31c118e8a7fa21a0d75aa46a2c40fdc9153d9387d399c0ad529207a2b3
-
SHA512
56efd96aa161f62d5ff350cd7614a863d5fac36d3d275ac1f5d116a1216930c7581ba9a7a49d56d358522c1f054173f12794de78c28cedfde88408f8b7a04400
-
SSDEEP
98304:hLMCu5JhoeeGxusdL65Vvlun/mzDzB0T/0tsE:hLMCQhcsd8vlYuzKwL
Malware Config
Signatures
-
Makes use of the framework's Accessibility service 4 TTPs 3 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs
Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
-
Acquires the wake lock 1 IoCs
-
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
-
Queries information about active data network 1 TTPs 1 IoCs
-
Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
-
Schedules tasks to execute at a specified time 1 TTPs 1 IoCs
Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.
-
Checks CPU information 2 TTPs 1 IoCs
-
Checks memory information 2 TTPs 1 IoCs
Processes
-
services.developed.sellers1⤵
- Makes use of the framework's Accessibility service
- Obtains sensitive information copied to the device clipboard
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Queries information about active data network
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Schedules tasks to execute at a specified time
- Checks CPU information
- Checks memory information
Network
MITRE ATT&CK Mobile v15
Defense Evasion
Foreground Persistence
1Hide Artifacts
1User Evasion
1Input Injection
1Virtualization/Sandbox Evasion
2System Checks
2Credential Access
Clipboard Data
1Input Capture
2GUI Input Capture
1Keylogging
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
21B
MD5a4c61b0ee4a996e6d469bfc35a6d9e42
SHA1cce97f96796759ca0a62aaefd47c49b4fbf425c5
SHA25656435df185a14b785daff397a06e80d0487f3c62d26e63df23d89abf3b2ad794
SHA5129cdeed84e99d9ede29d88f2af7f80bf2a77f5d6de08073cd43a58564317f84773fbe8874fa955a902956a43274ce374d6d26f31add64434f95951c3a9b78e1be
-
Filesize
29B
MD5b9b530e2448252311640bbecb69b796a
SHA1215ede46fb42a68a7ae84c3019acb3019668a46c
SHA2565a290151305de1ec4f790cd8ada8bd68c076a2c4ed497c40a519509659b65150
SHA5125834499307946d130887067b2f837ddfef7fdfe3a7e5ed8977eb14c2dc1ab328334da35ed4c978e20b3e6b28ff30dbd12f0430f4b7c831481f339d360c260919
-
Filesize
29B
MD5a442592e332b26186c00d87e52d3dda6
SHA1325a37d09ad64ea69610b6b745e5203a84208961
SHA2569067346c2bf6c8d48336f646535995abcd1ade3168b6f6dab50b40e75c11c081
SHA5122ea62fae946ccebb62aae6f7719fd66b6891734375a4f39cfe520b2ae013d79ea9bbf3ea911555a2337a68084e56e349e57310efa5742d932d38123780fd0976