62b002528c334cec9d29d6126ef1b935d10f3b1796cb6380254045189553185d

Analysis

max time kernel
149s
max time network
131s
platform
android_x86
resource
android-x86-arm-20240624-en
resource tags

androidarch:armarch:x86image:android-x86-arm-20240624-enlocale:en-usos:android-9-x86system
submitted
22/10/2024, 14:02 UTC

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ready.apk
Size

6.2MB
MD5

24d0f3802c0891d625fac917a940936c
SHA1

36ad393f4687a676efb2fc0d62a6532c17eb89ab
SHA256

62b002528c334cec9d29d6126ef1b935d10f3b1796cb6380254045189553185d
SHA512

23f65fbce631f3f97eb65f4dbb01b0495ef84a50de5bbfe4bffbfc66040b83480678b1071e2c9d49ba4681a972dc04304e81570f68669be507b93c4607029fd7
SSDEEP

24576:lXvLvTSt4jfa4zBj2mFXs8WFuiWUFutbF:lXvFO4zBKmFaFuHtp

Score

7^/10

collection credential_access discovery evasion execution persistence

Malware Config

Signatures

Makes use of the framework's Accessibility service 4 TTPs 1 IoCs

Retrieves information displayed on the phone screen using AccessibilityService.

collection evasion credential_access

Input Injection

T1516

Screen Capture

T1513

Keylogging

T1417.001

GUI Input Capture

T1417.002

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	vessel.wax.phrases

Acquires the wake lock 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	vessel.wax.phrases

Queries information about active data network 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	vessel.wax.phrases

Queries the mobile country code (MCC) 1 TTPs 1 IoCs

discovery

System Network Configuration Discovery

T1422

description	ioc	Process
Framework service call	com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone	vessel.wax.phrases

Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs

evasion

User Evasion

T1628.002

description	ioc	Process
Intent action	android.settings.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS	vessel.wax.phrases

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs

persistence

Broadcast Receivers

T1624.001

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	vessel.wax.phrases

Schedules tasks to execute at a specified time 1 TTPs 1 IoCs

Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.

execution persistence

Scheduled Task/Job

T1603

description	ioc	Process
Framework service call	android.app.job.IJobScheduler.schedule	vessel.wax.phrases

Checks CPU information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	vessel.wax.phrases

Checks memory information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	vessel.wax.phrases

vessel.wax.phrases
1⤵
- Makes use of the framework's Accessibility service
- Acquires the wake lock
- Queries information about active data network
- Queries the mobile country code (MCC)
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Schedules tasks to execute at a specified time
- Checks CPU information
- Checks memory information
PID:4252

Network

DNS

semanticlocation-pa.googleapis.com

Remote address:

1.1.1.1:53

Request

semanticlocation-pa.googleapis.com

IN A

Response

semanticlocation-pa.googleapis.com

IN A

142.250.180.10

semanticlocation-pa.googleapis.com

IN A

172.217.169.42

semanticlocation-pa.googleapis.com

IN A

216.58.201.106

semanticlocation-pa.googleapis.com

IN A

216.58.212.202

semanticlocation-pa.googleapis.com

IN A

142.250.187.234

semanticlocation-pa.googleapis.com

IN A

172.217.16.234

semanticlocation-pa.googleapis.com

IN A

216.58.204.74

semanticlocation-pa.googleapis.com

IN A

142.250.178.10

semanticlocation-pa.googleapis.com

IN A

142.250.179.234

semanticlocation-pa.googleapis.com

IN A

142.250.187.202

semanticlocation-pa.googleapis.com

IN A

142.250.200.10

semanticlocation-pa.googleapis.com

IN A

142.250.200.42
DNS

kasatonicsyntax.ddns.net

Remote address:

1.1.1.1:53

Request

kasatonicsyntax.ddns.net

IN A

Response
DNS

www.youtube.com

Remote address:

1.1.1.1:53

Request

www.youtube.com

IN A

Response

www.youtube.com

IN CNAME

youtube-ui.l.google.com

youtube-ui.l.google.com

IN A

172.217.169.14

youtube-ui.l.google.com

IN A

216.58.204.78

youtube-ui.l.google.com

IN A

172.217.169.78

youtube-ui.l.google.com

IN A

142.250.200.46

youtube-ui.l.google.com

IN A

142.250.178.14

youtube-ui.l.google.com

IN A

172.217.16.238

youtube-ui.l.google.com

IN A

142.250.179.238

youtube-ui.l.google.com

IN A

216.58.201.110

youtube-ui.l.google.com

IN A

142.250.180.14

youtube-ui.l.google.com

IN A

142.250.187.238

youtube-ui.l.google.com

IN A

216.58.212.238

youtube-ui.l.google.com

IN A

216.58.212.206

youtube-ui.l.google.com

IN A

172.217.169.46

youtube-ui.l.google.com

IN A

142.250.187.206

youtube-ui.l.google.com

IN A

142.250.200.14
DNS

m.youtube.com

Remote address:

1.1.1.1:53

Request

m.youtube.com

IN A

Response

m.youtube.com

IN A

142.250.179.238
DNS

accounts.google.com

Remote address:

1.1.1.1:53

Request

accounts.google.com

IN A

Response

accounts.google.com

IN A

74.125.206.84
DNS

gstatic.com

Remote address:

1.1.1.1:53

Request

gstatic.com

IN A

Response

gstatic.com

IN A

216.58.201.99
DNS

jnn-pa.googleapis.com

Remote address:

1.1.1.1:53

Request

jnn-pa.googleapis.com

IN A

Response

jnn-pa.googleapis.com

IN A

172.217.169.74

jnn-pa.googleapis.com

IN A

216.58.212.234

jnn-pa.googleapis.com

IN A

142.250.200.42

jnn-pa.googleapis.com

IN A

142.250.187.202

jnn-pa.googleapis.com

IN A

142.250.200.10

jnn-pa.googleapis.com

IN A

142.250.179.234

jnn-pa.googleapis.com

IN A

142.250.178.10

jnn-pa.googleapis.com

IN A

142.250.187.234

jnn-pa.googleapis.com

IN A

172.217.16.234

jnn-pa.googleapis.com

IN A

216.58.201.106

jnn-pa.googleapis.com

IN A

216.58.204.74

jnn-pa.googleapis.com

IN A

142.250.180.10

jnn-pa.googleapis.com

IN A

216.58.213.10

jnn-pa.googleapis.com

IN A

216.58.212.202
DNS

play.google.com

Remote address:

1.1.1.1:53

Request

play.google.com

IN A

Response

play.google.com

IN A

142.250.200.46
DNS

www.google.com

Remote address:

1.1.1.1:53

Request

www.google.com

IN A

Response

www.google.com

IN A

142.250.178.4
DNS

android.apis.google.com

Remote address:

1.1.1.1:53

Request

android.apis.google.com

IN A

Response

android.apis.google.com

IN CNAME

clients.l.google.com

clients.l.google.com

IN A

142.250.180.14

142.250.187.202:443

tls, https

202 B
40 B
1
1
172.217.169.14:443

www.youtube.com

tls

3.0kB
38.7kB
33
46
142.250.179.238:443

m.youtube.com

tls

47.1kB
1.4MB
468
1082
74.125.206.84:443

accounts.google.com

tls

5.9kB
144.5kB
81
123
216.58.201.99:443

gstatic.com

tls

1.6kB
5.9kB
15
15
172.217.169.74:443

jnn-pa.googleapis.com

tls

6.1kB
53.9kB
43
62
142.250.200.46:443

play.google.com

tls

1.7kB
8.2kB
16
17
142.250.200.46:443

play.google.com

tls

887 B
7.4kB
12
10
142.250.200.46:443

play.google.com

tls

5.9kB
10.7kB
28
37
142.250.178.4:443

www.google.com

tls

1.7kB
30.9kB
20
27
142.250.200.46:443

play.google.com

tls, https

858 B
40 B
1
1
142.250.180.14:443

android.apis.google.com

tls

4.7kB
8.5kB
14
20
216.58.201.106:443

jnn-pa.googleapis.com

tls, https

1.2kB
40 B
1
1

224.0.0.251:5353

3.7kB
11
1.1.1.1:53

semanticlocation-pa.googleapis.com

dns

80 B
272 B
1
1

DNS Request

semanticlocation-pa.googleapis.com

DNS Response

142.250.180.10

172.217.169.42

216.58.201.106

216.58.212.202

142.250.187.234

172.217.16.234

216.58.204.74

142.250.178.10

142.250.179.234

142.250.187.202

142.250.200.10

142.250.200.42
1.1.1.1:53

kasatonicsyntax.ddns.net

dns

70 B
130 B
1
1

DNS Request

kasatonicsyntax.ddns.net
1.1.1.1:53

www.youtube.com

dns

61 B
335 B
1
1

DNS Request

www.youtube.com

DNS Response

172.217.169.14

216.58.204.78

172.217.169.78

142.250.200.46

142.250.178.14

172.217.16.238

142.250.179.238

216.58.201.110

142.250.180.14

142.250.187.238

216.58.212.238

216.58.212.206

172.217.169.46

142.250.187.206

142.250.200.14
1.1.1.1:53

m.youtube.com

dns

59 B
75 B
1
1

DNS Request

m.youtube.com

DNS Response

142.250.179.238
1.1.1.1:53

accounts.google.com

dns

65 B
81 B
1
1

DNS Request

accounts.google.com

DNS Response

74.125.206.84
1.1.1.1:53

gstatic.com

dns

57 B
73 B
1
1

DNS Request

gstatic.com

DNS Response

216.58.201.99
1.1.1.1:53

jnn-pa.googleapis.com

dns

67 B
291 B
1
1

DNS Request

jnn-pa.googleapis.com

DNS Response

172.217.169.74

216.58.212.234

142.250.200.42

142.250.187.202

142.250.200.10

142.250.179.234

142.250.178.10

142.250.187.234

172.217.16.234

216.58.201.106

216.58.204.74

142.250.180.10

216.58.213.10

216.58.212.202
1.1.1.1:53

play.google.com

dns

61 B
77 B
1
1

DNS Request

play.google.com

DNS Response

142.250.200.46
1.1.1.1:53

www.google.com

dns

60 B
76 B
1
1

DNS Request

www.google.com

DNS Response

142.250.178.4
1.1.1.1:53

android.apis.google.com

dns

69 B
109 B
1
1

DNS Request

android.apis.google.com

DNS Response

142.250.180.14

MITRE ATT&CK Mobile v15

Initial Access

Execution

Scheduled Task/Job

T1603

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Scheduled Task/Job

T1603

Privilege Escalation

Defense Evasion

Hide Artifacts

T1628

User Evasion

T1628.002

Input Injection

T1516

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Input Capture

T1417

GUI Input Capture

T1417.002

Keylogging

T1417.001

Discovery

System Information Discovery

T1426

System Network Configuration Discovery

T1422

System Network Connections Discovery

T1421

Lateral Movement

Collection

Input Capture

T1417

GUI Input Capture

T1417.002

Keylogging

T1417.001

Screen Capture

T1513

Command and Control

Exfiltration

Impact

Input Injection

T1516

Replay Monitor

Loading Replay Monitor...

Downloads

/storage/emulated/0/Config/sys/apps/log/log-2024-10-22.txt

Filesize
33B

MD5
da25c7bff55a2936a9cb811d9fe27d93

SHA1
87711aa4a1ee842a6d0cf50a254c742e853b48a5

SHA256
49ecccba597e47651a3dc051292ed5b1c89a9c36a0e85bff287c2127b3330be5

SHA512
51d114639fee48a61618964fb064562b7cf3b1dc29accce57ab1e99f9fb6593c4727671ee4a23caba7f157adf294ef5734ec6f910f596f35b4c2ed7231f76c6c

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

DNS Request

DNS Response

DNS Request

DNS Request

DNS Response

DNS Request

DNS Response

DNS Request

DNS Response

DNS Request

DNS Response

DNS Request

DNS Response

DNS Request

DNS Response

DNS Request

DNS Response

DNS Request

DNS Response

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads

We care about your privacy.