Analysis
-
max time kernel
122s -
max time network
154s -
platform
android-11_x64 -
resource
android-x64-arm64-20240910-en -
resource tags
-
submitted
29/10/2024, 22:08
General
-
Target
5a7a4173220faab2749448d7841107c19c8ca1de5fe28b2c44c350c08ad890fa.apk
-
Size
3.9MB
-
MD5
095949779888f66b733dbcc238d7e183
-
SHA1
ce54b5aea00bc1177c1f4a5dc71747f381285038
-
SHA256
5a7a4173220faab2749448d7841107c19c8ca1de5fe28b2c44c350c08ad890fa
-
SHA512
c2a807791ec475a87b7d4d925763bb16213a2fb86b7971cbb7020b36faf5a8354c8be9590bac2739a800162bc113a1674ad5e6e9d3112120470853ad32229261
-
SSDEEP
98304:uyR6vm+i2c2f3qyeImQ65QUL1s7ASym7M8YiIHzk9F0K:us6vm+zTfBeImTB1YhLgkII92K
Score
7/10
Malware Config
Signatures
-
Makes use of the framework's Accessibility service 4 TTPs 2 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Acquires the wake lock 1 IoCs
-
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
-
Performs UI accessibility actions on behalf of the user 1 TTPs 1 IoCs
Application may abuse the accessibility service to prevent their removal.
-
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
Processes
-
com.postable.conchylium1⤵
- Makes use of the framework's Accessibility service
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Performs UI accessibility actions on behalf of the user
- Uses Crypto APIs (Might try to encrypt user data)