Analysis

  • max time kernel
    149s
  • max time network
    147s
  • platform
    android_x64
  • resource
    android-x64-20240624-en
  • resource tags

    androidarch:x64arch:x86image:android-x64-20240624-enlocale:en-usos:android-10-x64system
  • submitted
    30-10-2024 18:29

General

  • Target

    Kepcontact.apk

  • Size

    5.5MB

  • MD5

    85cff4f3a4a05b3220599bdcccddefc6

  • SHA1

    711fe5af28fff04c433ef00990f2cf64389da74d

  • SHA256

    59fb44b5a4f24b5cc4e54da553d20806575825ac9fe56dcb2cf8c076172d82f3

  • SHA512

    b75e84ddc6ed8023f598cd7ac29098403994233e91d4b9f3c4b02e7a9433c98343742e2805f5d3ad2618d600d49b7b67e096be7685282dac5cf05ef59b5db061

  • SSDEEP

    98304:SgSziHNHfe6zDoNofr7T03lJX3hYYIwbNVehVwmz5zBDTI0tBGLk:CMHm6zki43LnbbreHPzDzr

Malware Config

Signatures

  • Makes use of the framework's Accessibility service 4 TTPs 3 IoCs

    Retrieves information displayed on the phone screen using AccessibilityService.

  • Acquires the wake lock 1 IoCs
  • Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

    Application may abuse the framework's foreground service to continue running in the foreground.

  • Performs UI accessibility actions on behalf of the user 1 TTPs 8 IoCs

    Application may abuse the accessibility service to prevent their removal.

  • Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
  • Schedules tasks to execute at a specified time 1 TTPs 1 IoCs

    Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.

Processes

  • boston.combined.mpg
    1⤵
    • Makes use of the framework's Accessibility service
    • Acquires the wake lock
    • Makes use of the framework's foreground persistence service
    • Performs UI accessibility actions on behalf of the user
    • Registers a broadcast receiver at runtime (usually for listening for system events)
    • Schedules tasks to execute at a specified time
    PID:4963

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • /storage/emulated/0/Config/sys/apps/log/log-2024-10-30.txt

    Filesize

    25B

    MD5

    f6cd120bfa83c4c60079cda6544a6298

    SHA1

    624efaca2d8b89f6f0fbe8407ac805f6c05c4938

    SHA256

    2506b9602a9d3ac6628c7bc9596671fc6ca6b152da40658d71a1fe8ccbc623bf

    SHA512

    1037ae596ee04b4c12164168d470326e16c0011171d2d6d4cc9f09b9c6b5f6e520cf75b7ae41b3c95898eb2231e323a0c82c1c26a681837467f9daafaac46c3d

  • /storage/emulated/0/Config/sys/apps/log/log-2024-10-30.txt

    Filesize

    25B

    MD5

    ba30336bf53d54ed3c0ea69dd545de8c

    SHA1

    ce99c6724c75b93b7448e2d9fac16ca702a5711f

    SHA256

    2d6988fb5afdaafc4e33fa1f71d6f10c95ab5a49a8ec820add5b13eef05439af

    SHA512

    eea34ca526e03349e746d3687ea660b4748f0174fe2ffdb65161e232e08630b345e03329614852ce881a71362ba68575e9dd08fa361a416e5b2fb231e21a0a3e

  • /storage/emulated/0/Config/sys/apps/log/log-2024-10-30.txt

    Filesize

    280B

    MD5

    6187c8ac2ad8253ede26021be4e46542

    SHA1

    962ecf49b67ee7d0d1dbe08e9ec682ebd34b5631

    SHA256

    1af08dd89d59715d57fc80c1b2209c2a415e273c9e6ea6cf8d17d5cf4bb6ab19

    SHA512

    5f3efb6871a8247c0cf659fbf8498f4dff2467fba7974f669ff3853c629ba10802d18269ea0b4ca5299772a601ce7c6613efdff1c891c2c4782c7ed63c7d2166

  • /storage/emulated/0/Config/sys/apps/log/log-2024-10-30.txt

    Filesize

    57B

    MD5

    3af69119804d1d999d56d230338ffd36

    SHA1

    69350826205583c8acc385ee0a6e3fc2673ee2ca

    SHA256

    10994862cb263ab6b1e4428cc24cc9c585458fc67544fe0f5dfea81a5a7a115c

    SHA512

    4a41b19d28f637b397d9dff225621694c44c750a9bd65f3e6ad5d3b9acf0d118910ddf53d4618213f9e14c61e0fb154f33f2747dd3b8d50459990767f42fc8cb