Analysis
-
max time kernel
149s -
max time network
153s -
platform
android_x64 -
resource
android-x64-arm64-20240624-en -
resource tags
-
submitted
30-10-2024 18:29
General
-
Target
Kepcontact.apk
-
Size
5.5MB
-
MD5
85cff4f3a4a05b3220599bdcccddefc6
-
SHA1
711fe5af28fff04c433ef00990f2cf64389da74d
-
SHA256
59fb44b5a4f24b5cc4e54da553d20806575825ac9fe56dcb2cf8c076172d82f3
-
SHA512
b75e84ddc6ed8023f598cd7ac29098403994233e91d4b9f3c4b02e7a9433c98343742e2805f5d3ad2618d600d49b7b67e096be7685282dac5cf05ef59b5db061
-
SSDEEP
98304:SgSziHNHfe6zDoNofr7T03lJX3hYYIwbNVehVwmz5zBDTI0tBGLk:CMHm6zki43LnbbreHPzDzr
Malware Config
Signatures
-
Makes use of the framework's Accessibility service 4 TTPs 3 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Acquires the wake lock 1 IoCs
-
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
-
Performs UI accessibility actions on behalf of the user 1 TTPs 8 IoCs
Application may abuse the accessibility service to prevent their removal.
-
Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
-
Schedules tasks to execute at a specified time 1 TTPs 1 IoCs
Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.
Processes
-
boston.combined.mpg1⤵
- Makes use of the framework's Accessibility service
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Performs UI accessibility actions on behalf of the user
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Schedules tasks to execute at a specified time
Network
MITRE ATT&CK Mobile v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
29B
MD5cb59d5a4a2f7cbd498ce3370a90518a6
SHA1695c617d44f10c54b3a12fc9cc7c8cdd28499b3c
SHA25671d635b558972111d216eaeee750b40a15f9dd04be804c188f75c1581f8c8605
SHA512431b6c8f713fe899bea5e520858b43d688cf44e622571d85a98aabd5ac64d94ff883dfb1f2b07e2241ebd5b56835ddf6da773fe38355924ce3569cf45ff582ef
-
Filesize
25B
MD5f6cd120bfa83c4c60079cda6544a6298
SHA1624efaca2d8b89f6f0fbe8407ac805f6c05c4938
SHA2562506b9602a9d3ac6628c7bc9596671fc6ca6b152da40658d71a1fe8ccbc623bf
SHA5121037ae596ee04b4c12164168d470326e16c0011171d2d6d4cc9f09b9c6b5f6e520cf75b7ae41b3c95898eb2231e323a0c82c1c26a681837467f9daafaac46c3d
-
Filesize
25B
MD5ba30336bf53d54ed3c0ea69dd545de8c
SHA1ce99c6724c75b93b7448e2d9fac16ca702a5711f
SHA2562d6988fb5afdaafc4e33fa1f71d6f10c95ab5a49a8ec820add5b13eef05439af
SHA512eea34ca526e03349e746d3687ea660b4748f0174fe2ffdb65161e232e08630b345e03329614852ce881a71362ba68575e9dd08fa361a416e5b2fb231e21a0a3e
-
Filesize
280B
MD5037e8d7a905ca487184d62ff17ea606c
SHA14a0d2d390cd50a013ff4fca93896cad0d4b20845
SHA256dbe1aacdb288280951d01f75761d1bdc0d2e7928e1459c9eadb5e6df244becb7
SHA5124e20e187235b44d54184fb999dbe06f573f2516220baeef1815148fc4ec271fdc644d0209e91659bb1cd2301379b1a2dbee5b4a1f2f97ff831b252ea1c8fb8e7