4d8bb1bb46296f968181182372243a0fa2aaea80a4cf82f927922c337f478f32

Analysis

max time kernel
119s
max time network
115s
platform
android_x64
resource
android-x64-20240624-en
resource tags

androidarch:x64arch:x86image:android-x64-20240624-enlocale:en-usos:android-10-x64system
submitted
30-10-2024 22:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Porn Hab Premium.apk
Size

5.5MB
MD5

49e8a3bf2928dc8c5406fb7987232ed0
SHA1

51c9a283acdc27e45c8952f4b8c3b0f5c2981e4d
SHA256

4d8bb1bb46296f968181182372243a0fa2aaea80a4cf82f927922c337f478f32
SHA512

626c4cbaac1d5cd4e584b0101570a9b66c53d7dcc3a15506b43235f84e3065aa78e1982079f50fff3a2b921ad2fcc5a0f37d0f10b14e9619c0be4b3c481adb9c
SSDEEP

98304:IdoeRbxiuEvTvut0Hrd8+c9o74IoXMErhbEwHqMtBdh8FmzJzB0T20tR2q4:TeRbxBzCaAb8MJ42ozM9w

Score

7^/10

collection credential_access evasion execution persistence

Malware Config

Signatures

Makes use of the framework's Accessibility service 4 TTPs 3 IoCs

Retrieves information displayed on the phone screen using AccessibilityService.

collection evasion credential_access

Input Injection

T1516

Screen Capture

T1513

Keylogging

T1417.001

GUI Input Capture

T1417.002

Processes:

quad.viruses.selective

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId	quad.viruses.selective
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	quad.viruses.selective
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByText	quad.viruses.selective

Acquires the wake lock 1 IoCs

Processes:

quad.viruses.selective

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	quad.viruses.selective

Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

Application may abuse the framework's foreground service to continue running in the foreground.

evasion persistence

Foreground Persistence

T1541

Processes:

quad.viruses.selective

description	ioc	Process
Framework service call	android.app.IActivityManager.setServiceForeground	quad.viruses.selective

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs

persistence

Broadcast Receivers

T1624.001

Processes:

quad.viruses.selective

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	quad.viruses.selective

Schedules tasks to execute at a specified time 1 TTPs 1 IoCs

Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.

execution persistence

Scheduled Task/Job

T1603

Processes:

quad.viruses.selective

description	ioc	Process
Framework service call	android.app.job.IJobScheduler.schedule	quad.viruses.selective

quad.viruses.selective
1⤵
- Makes use of the framework's Accessibility service
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Schedules tasks to execute at a specified time
PID:4931

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Scheduled Task/Job

T1603

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Foreground Persistence

T1541

Scheduled Task/Job

T1603

Privilege Escalation

Defense Evasion

Foreground Persistence

T1541

Input Injection

T1516

Credential Access

Input Capture

T1417

GUI Input Capture

T1417.002

Keylogging

T1417.001

Discovery

Lateral Movement

Collection

Input Capture

T1417

GUI Input Capture

T1417.002

Keylogging

T1417.001

Screen Capture

T1513

Command and Control

Exfiltration

Impact

Input Injection

T1516

Replay Monitor

Loading Replay Monitor...

Downloads

/storage/emulated/0/Config/sys/apps/log/log-2024-10-30.txt

Filesize
37B

MD5
ab19537803e1f157481382919eda0efd

SHA1
24a2bd926fe0fe31f5e380d2a898a2287a3653dd

SHA256
a7910c4a9aa5f0cf3247e67ba20b38da9498c7f6d8e7c30376f9d34bdc3f1254

SHA512
6afa3dc2fd7f76e55abeda575d5d8b5c10ed481188030c60c5e10712571918a5412a51b9f12d36fedc8b205c230dc95afae369c1b2e8f463d35b0b57d1b09884

Download Submit
/storage/emulated/0/Config/sys/apps/log/log-2024-10-30.txt

Filesize
33B

MD5
d30c5b8b39269cda2676ef46b7d10f4f

SHA1
07171670a8156caed6ff6d0f67313a197f196650

SHA256
5829921ed3997704525a94e1d7ff9bd8f562c8cbd59ecd63e2dcf82519bded13

SHA512
142b05e527ec52d21832bbd927e36cd901bcc4c4bc8bfbdef554506b365b225cc5b1368a2f98fcf9f61ff60d4a929d4d7e443f877bb03d69235c46ba219570c6

Download Submit
/storage/emulated/0/Config/sys/apps/log/log-2024-10-30.txt

Filesize
25B

MD5
ba30336bf53d54ed3c0ea69dd545de8c

SHA1
ce99c6724c75b93b7448e2d9fac16ca702a5711f

SHA256
2d6988fb5afdaafc4e33fa1f71d6f10c95ab5a49a8ec820add5b13eef05439af

SHA512
eea34ca526e03349e746d3687ea660b4748f0174fe2ffdb65161e232e08630b345e03329614852ce881a71362ba68575e9dd08fa361a416e5b2fb231e21a0a3e

Download Submit
/storage/emulated/0/Config/sys/apps/log/log-2024-10-30.txt

Filesize
288B

MD5
1c9dbe4b41975ff6fa7ad43e3afbaa3e

SHA1
35fbd48d1c7c221937a3f88d8e172cc63de0d4f7

SHA256
434f2924fdf8b7bcc996ec1240d1f302350267863814ec279368bd2280ea3cd0

SHA512
12b144eb2b10e8666237fc57bd51acb127aed43f6cfa0de38f2f0cc390ed4be448012115e4f71c4ce86d18377583be9a69ed09373c06edb81135c3f20aba8137

Download Submit