bf1de121cca70ee568a3c446049bbb547f09273579c58b0c30ec837d06f8209b

Analysis

max time kernel
119s
max time network
116s
platform
android_x64
resource
android-x64-20240624-en
resource tags

androidarch:x64arch:x86image:android-x64-20240624-enlocale:en-usos:android-10-x64system
submitted
30-10-2024 22:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Porn Hub Premium.apk
Size

5.5MB
MD5

ca5829c89ba101b447f7c99b0fea784b
SHA1

c57968863f8a882d18554d613d0afa29c52e5123
SHA256

bf1de121cca70ee568a3c446049bbb547f09273579c58b0c30ec837d06f8209b
SHA512

a7eafeb082b74888f24d29906a2cd20a7c8c82738b1e846738b4cb3e533e0afafcc01216c1e9f1d6e82908dac4d34eaf35f1aecee75aff2ddf514b87a74f51c2
SSDEEP

98304:a4KNbkyi02grv5x7+SKT8hrhpxwmzhzBaTa0tGvbB:KN7i0rlYTAFpxPzG56

Score

7^/10

collection credential_access evasion execution persistence

Malware Config

Signatures

Makes use of the framework's Accessibility service 4 TTPs 3 IoCs

Retrieves information displayed on the phone screen using AccessibilityService.

collection evasion credential_access

Input Injection

T1516

Screen Capture

T1513

Keylogging

T1417.001

GUI Input Capture

T1417.002

Processes:

infrastructure.identical.jets

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	infrastructure.identical.jets
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByText	infrastructure.identical.jets
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId	infrastructure.identical.jets

Acquires the wake lock 1 IoCs

Processes:

infrastructure.identical.jets

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	infrastructure.identical.jets

Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

Application may abuse the framework's foreground service to continue running in the foreground.

evasion persistence

Foreground Persistence

T1541

Processes:

infrastructure.identical.jets

description	ioc	Process
Framework service call	android.app.IActivityManager.setServiceForeground	infrastructure.identical.jets

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs

persistence

Broadcast Receivers

T1624.001

Processes:

infrastructure.identical.jets

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	infrastructure.identical.jets

Schedules tasks to execute at a specified time 1 TTPs 1 IoCs

Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.

execution persistence

Scheduled Task/Job

T1603

Processes:

infrastructure.identical.jets

description	ioc	Process
Framework service call	android.app.job.IJobScheduler.schedule	infrastructure.identical.jets

infrastructure.identical.jets
1⤵
- Makes use of the framework's Accessibility service
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Schedules tasks to execute at a specified time
PID:5063

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Scheduled Task/Job

T1603

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Foreground Persistence

T1541

Scheduled Task/Job

T1603

Privilege Escalation

Defense Evasion

Foreground Persistence

T1541

Input Injection

T1516

Credential Access

Input Capture

T1417

GUI Input Capture

T1417.002

Keylogging

T1417.001

Discovery

Lateral Movement

Collection

Input Capture

T1417

GUI Input Capture

T1417.002

Keylogging

T1417.001

Screen Capture

T1513

Command and Control

Exfiltration

Impact

Input Injection

T1516

Replay Monitor

Loading Replay Monitor...

Downloads

/storage/emulated/0/Config/sys/apps/log/log-2024-10-30.txt

Filesize
37B

MD5
2ea244fb08570cc2633fc56bdd7b4f58

SHA1
e62264711e4caaaf99917c63807ea9d38a72a032

SHA256
5172f058d6000b0b18c2474b4c83357b5de845534ea0a92f4a850e9e3bca0a05

SHA512
975f1430c8f02ccb04e64e590832acfe80b38344743d0c59d767189daf2d489db22a565b9cfbf04a2da553907833743876dea729e1f74ddfd484429b01ed57d9

Download Submit
/storage/emulated/0/Config/sys/apps/log/log-2024-10-30.txt

Filesize
33B

MD5
aca45ee735f07aad59605f94de02544b

SHA1
6feee8f180a641b098d489d3b9977c2e20287f02

SHA256
65d64450b76fb509a871e082a1edf14dbe4715ea0853c690c566c193a653e593

SHA512
5294f4b0850572838f86ef7adfb479a912464a705407c18662ba0fe6a8fc2bea06fe77127c5e2fdc416d272980802b8ea3b6ad15f392d8de25f6776da7c2055f

Download Submit
/storage/emulated/0/Config/sys/apps/log/log-2024-10-30.txt

Filesize
25B

MD5
ba30336bf53d54ed3c0ea69dd545de8c

SHA1
ce99c6724c75b93b7448e2d9fac16ca702a5711f

SHA256
2d6988fb5afdaafc4e33fa1f71d6f10c95ab5a49a8ec820add5b13eef05439af

SHA512
eea34ca526e03349e746d3687ea660b4748f0174fe2ffdb65161e232e08630b345e03329614852ce881a71362ba68575e9dd08fa361a416e5b2fb231e21a0a3e

Download Submit
/storage/emulated/0/Config/sys/apps/log/log-2024-10-30.txt

Filesize
288B

MD5
c1979906abfb1d068c3e1c48791819df

SHA1
134a851ca62fd9412f4710ff2f3f4167a3b4f8f2

SHA256
1c784647ad86152c8a0d85deea35c95d466231243707888f45d0c3f5114e8e14

SHA512
c9795c0e41f34db594f5a52320bcca7d5ad6ebd9d4db11cd40cf1f9ce7289998249512017106281fc8d34224b5da61b74de4a0c6806295ea15a49c7a33bc5877

Download Submit