Analysis
-
max time kernel
148s -
max time network
155s -
platform
android_x86 -
resource
android-x86-arm-20240624-en -
resource tags
androidarch:armarch:x86image:android-x86-arm-20240624-enlocale:en-usos:android-9-x86system -
submitted
22/10/2024, 08:53
Behavioral task
behavioral1
Sample
PANDAWA-MOBILE.apk
Resource
android-x86-arm-20240624-en
General
-
Target
PANDAWA-MOBILE.apk
-
Size
13.0MB
-
MD5
abead79b1bc4ea76aae281078b71384f
-
SHA1
7df14e117872b5fbd2265f0c1ab3474c058e2f63
-
SHA256
3913acdbc1484d443a87853566800f6fe98e33bf5633f89349925210e2110f24
-
SHA512
007c242537b913095cdb2afbda520f9396935a318b1111249a93dd9916169cec63fbe217619b788eca060049c1607927eaf829456deb227e1e3d1db156636de3
-
SSDEEP
196608:dwBqgqaPpizsQuFxXmdUS7eRFQ8EQTeIVDqlTNHTrP2UJnc0N59jfvLUg0p5GcYm:dwQ4cUxXu789qlNruGLtYg05GcALagM
Malware Config
Signatures
-
Makes use of the framework's Accessibility service 4 TTPs 1 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
description ioc Process Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId com.sextest.test -
Queries account information for other applications stored on the device 1 TTPs 3 IoCs
Application may abuse the framework's APIs to collect account information stored on the device.
description ioc Process Framework service call android.accounts.IAccountManager.getAccountsAsUser com.sextest.test Framework service call android.accounts.IAccountManager.getAccountsAsUser com.sextest.test:s1 Framework service call android.accounts.IAccountManager.getAccountsAsUser com.sextest.test:main -
Queries information about running processes on the device 1 TTPs 3 IoCs
Application may abuse the framework's APIs to collect information about running processes on the device.
description ioc Process Framework service call android.app.IActivityManager.getRunningAppProcesses com.sextest.test:main Framework service call android.app.IActivityManager.getRunningAppProcesses com.sextest.test Framework service call android.app.IActivityManager.getRunningAppProcesses com.sextest.test:s1 -
Acquires the wake lock 1 IoCs
description ioc Process Framework service call android.os.IPowerManager.acquireWakeLock com.sextest.test -
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
description ioc Process Framework service call android.app.IActivityManager.setServiceForeground com.sextest.test -
Queries information about active data network 1 TTPs 1 IoCs
description ioc Process Framework service call android.net.IConnectivityManager.getActiveNetworkInfo com.sextest.test -
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
description ioc Process Framework service call android.app.IActivityManager.registerReceiver com.sextest.test -
Schedules tasks to execute at a specified time 1 TTPs 2 IoCs
Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.
description ioc Process Framework service call android.app.job.IJobScheduler.schedule com.sextest.test:main Framework service call android.app.job.IJobScheduler.schedule com.sextest.test -
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 3 IoCs
description ioc Process Framework API call javax.crypto.Cipher.doFinal com.sextest.test Framework API call javax.crypto.Cipher.doFinal com.sextest.test:s1 Framework API call javax.crypto.Cipher.doFinal com.sextest.test:main
Processes
-
com.sextest.test1⤵
- Makes use of the framework's Accessibility service
- Queries account information for other applications stored on the device
- Queries information about running processes on the device
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Queries information about active data network
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Schedules tasks to execute at a specified time
- Uses Crypto APIs (Might try to encrypt user data)
PID:4294 -
getprop ro.build.display.id2⤵PID:4720
-
-
getprop ro.build.display.id2⤵PID:4841
-
-
getprop ro.build.display.id2⤵PID:4866
-
-
getprop ro.build.display.id2⤵PID:4896
-
-
getprop ro.build.display.id2⤵PID:4919
-
-
getprop ro.build.display.id2⤵PID:4954
-
-
getprop ro.build.display.id2⤵PID:4980
-
-
getprop ro.build.display.id2⤵PID:5015
-
-
getprop ro.build.display.id2⤵PID:5119
-
-
getprop ro.build.display.id2⤵PID:5150
-
-
getprop ro.build.display.id2⤵PID:5174
-
-
getprop ro.build.display.id2⤵PID:5209
-
-
getprop ro.build.display.id2⤵PID:5236
-
-
getprop ro.build.display.id2⤵PID:5269
-
-
getprop ro.build.display.id2⤵PID:5314
-
-
getprop ro.build.display.id2⤵PID:5338
-
-
getprop ro.build.display.id2⤵PID:5359
-
-
getprop ro.build.display.id2⤵PID:5396
-
-
getprop ro.build.display.id2⤵PID:5426
-
-
getprop ro.build.display.id2⤵PID:5444
-
-
getprop ro.build.display.id2⤵PID:5486
-
-
getprop ro.build.display.id2⤵PID:5514
-
-
getprop ro.build.display.id2⤵PID:5535
-
-
getprop ro.build.display.id2⤵PID:5575
-
-
getprop ro.build.display.id2⤵PID:5605
-
-
getprop ro.build.display.id2⤵PID:5623
-
-
getprop ro.build.display.id2⤵PID:5660
-
-
getprop ro.build.display.id2⤵PID:5687
-
-
getprop ro.build.display.id2⤵PID:5710
-
-
com.sextest.test:main1⤵
- Queries account information for other applications stored on the device
- Queries information about running processes on the device
- Schedules tasks to execute at a specified time
- Uses Crypto APIs (Might try to encrypt user data)
PID:4388
-
com.sextest.test:s11⤵
- Queries account information for other applications stored on the device
- Queries information about running processes on the device
- Uses Crypto APIs (Might try to encrypt user data)
PID:4426
Network
MITRE ATT&CK Mobile v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
100KB
MD580517c51d9b5b8509ea0051aa75a0c9a
SHA1c929853f0678d7d9c9e0ed6af62e41d3ebfcd7ef
SHA2569be64220293f79495cfc62f02fd0f1057f9e0867a276a860abc098f88807c7e6
SHA5126766a285965d5b8a72098b0daa16f5584278b35725c72eef1d5f439f7ad695e6ab449837f0ddd5ec5e6a3794b613346008ebfb09e8d7c895ad06db142161bb17
-
Filesize
32KB
MD5bb7df04e1b0a2570657527a7e108ae23
SHA15188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA256c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
SHA512768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012
-
Filesize
402KB
MD5133567d9d8415bd320a309ee018e0cf4
SHA1bb7ffa0208790faabbb187765e7a653281648d0e
SHA25688359178654dcb6595592a5da91aafee53942f60dbaf031b9ed0189dd7466031
SHA512e1061289593581b01b8ae13f40c3dbcbfcd472c83a6205cdf4c2226b5c21d752d92f22dd832ce03971237e80060ed1da17d3418e69c576e871bf884b79efca97