Analysis
-
max time kernel
149s -
max time network
147s -
platform
android_x64 -
resource
android-x64-20240624-en -
resource tags
-
submitted
22-10-2024 14:02
General
-
Target
ready.apk
-
Size
6.2MB
-
MD5
24d0f3802c0891d625fac917a940936c
-
SHA1
36ad393f4687a676efb2fc0d62a6532c17eb89ab
-
SHA256
62b002528c334cec9d29d6126ef1b935d10f3b1796cb6380254045189553185d
-
SHA512
23f65fbce631f3f97eb65f4dbb01b0495ef84a50de5bbfe4bffbfc66040b83480678b1071e2c9d49ba4681a972dc04304e81570f68669be507b93c4607029fd7
-
SSDEEP
24576:lXvLvTSt4jfa4zBj2mFXs8WFuiWUFutbF:lXvFO4zBKmFaFuHtp
Malware Config
Signatures
-
Makes use of the framework's Accessibility service 4 TTPs 1 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs
Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
-
Acquires the wake lock 1 IoCs
-
Queries information about active data network 1 TTPs 1 IoCs
-
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
-
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
-
Schedules tasks to execute at a specified time 1 TTPs 1 IoCs
Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.
-
Checks CPU information 2 TTPs 1 IoCs
-
Checks memory information 2 TTPs 1 IoCs
Processes
-
vessel.wax.phrases1⤵
- Makes use of the framework's Accessibility service
- Obtains sensitive information copied to the device clipboard
- Acquires the wake lock
- Queries information about active data network
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Schedules tasks to execute at a specified time
- Checks CPU information
- Checks memory information
Network
MITRE ATT&CK Mobile v15
Persistence
Event Triggered Execution
1Broadcast Receivers
1Scheduled Task/Job
1Defense Evasion
Input Injection
1Virtualization/Sandbox Evasion
2System Checks
2Credential Access
Clipboard Data
1Input Capture
2GUI Input Capture
1Keylogging
1Discovery
System Information Discovery
2System Network Configuration Discovery
1System Network Connections Discovery
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
33B
MD5da25c7bff55a2936a9cb811d9fe27d93
SHA187711aa4a1ee842a6d0cf50a254c742e853b48a5
SHA25649ecccba597e47651a3dc051292ed5b1c89a9c36a0e85bff287c2127b3330be5
SHA51251d114639fee48a61618964fb064562b7cf3b1dc29accce57ab1e99f9fb6593c4727671ee4a23caba7f157adf294ef5734ec6f910f596f35b4c2ed7231f76c6c