Analysis
-
max time kernel
119s -
max time network
119s -
platform
android_x64 -
resource
android-x64-arm64-20240624-en -
resource tags
-
submitted
30-10-2024 23:26
General
-
Target
Sliv Filmov 2024 (2).apk
-
Size
3.8MB
-
MD5
1b872894fae0b278e8dbfc86b561a195
-
SHA1
31a05bbb9e62a410206d4c3a0d7fd82099e7c48a
-
SHA256
7f2468ce973bfb603e981c0568bff9b836d43498f6293fd500878c541401aa88
-
SHA512
92367c2a1565fe1809c4125f0e3385d5cf4468987dcc8cdfabb3fa94691ee8fcd75b6be40d74a31326abe90e26b189f924e6b39cd7d78a2d5e4acecfea331fc6
-
SSDEEP
98304:WW7DazdCHPUVJU0UQIQtQCUmzhzBmT80tZFM9I0P:WWvoVUhQtrTz6Ps9N
Malware Config
Signatures
-
Makes use of the framework's Accessibility service 4 TTPs 3 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
-
Acquires the wake lock 1 IoCs
-
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
-
Performs UI accessibility actions on behalf of the user 1 TTPs 8 IoCs
Application may abuse the accessibility service to prevent their removal.
-
Queries information about active data network 1 TTPs 1 IoCs
-
Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
-
Schedules tasks to execute at a specified time 1 TTPs 1 IoCs
Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.
Processes
-
employer.seat.ooo1⤵
- Makes use of the framework's Accessibility service
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Performs UI accessibility actions on behalf of the user
- Queries information about active data network
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Schedules tasks to execute at a specified time
Network
MITRE ATT&CK Mobile v15
Defense Evasion
Foreground Persistence
1Hide Artifacts
1User Evasion
1Impair Defenses
1Prevent Application Removal
1Input Injection
1Discovery
Software Discovery
1Security Software Discovery
1System Network Connections Discovery
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
33B
MD50484932f540ec94bd4ed0955f350c393
SHA148048cfb75bd3145452844721101b12e6ed0c0e9
SHA2566347f147358a6839e23adc0ebfce298ebe82b0c5e5a194cf2f17216a1009f9c5
SHA512678f4aabc0542f3cc068a1c257bd41ffd342973e0f362afccd85c75fe08078b90e7f3cce583ddc2e1224e5127b2cd554e01d4c40cd4bccb15bb74a43820e8971
-
Filesize
25B
MD5ba30336bf53d54ed3c0ea69dd545de8c
SHA1ce99c6724c75b93b7448e2d9fac16ca702a5711f
SHA2562d6988fb5afdaafc4e33fa1f71d6f10c95ab5a49a8ec820add5b13eef05439af
SHA512eea34ca526e03349e746d3687ea660b4748f0174fe2ffdb65161e232e08630b345e03329614852ce881a71362ba68575e9dd08fa361a416e5b2fb231e21a0a3e
-
Filesize
288B
MD5b53df6cae31880df79f02845a37a3a32
SHA166454e56a3b35e524770c10786d8094197b6be4f
SHA2560e74a2d19fcc5299b81881a17e22d48fd98b042537714dc619765c8e1717801f
SHA5121f242770fa02d45103a6a1c4bd31089e130da14f0c5285e111c16e87889156bcbbcfb952931520d5cf9085772f6efb78aa9ac9ae85f7d0292f6502c43eca40f1
-
Filesize
57B
MD53af69119804d1d999d56d230338ffd36
SHA169350826205583c8acc385ee0a6e3fc2673ee2ca
SHA25610994862cb263ab6b1e4428cc24cc9c585458fc67544fe0f5dfea81a5a7a115c
SHA5124a41b19d28f637b397d9dff225621694c44c750a9bd65f3e6ad5d3b9acf0d118910ddf53d4618213f9e14c61e0fb154f33f2747dd3b8d50459990767f42fc8cb