Analysis
-
max time kernel
149s -
max time network
145s -
platform
android_x86 -
resource
android-x86-arm-20240624-en -
resource tags
-
submitted
30-10-2024 18:44
General
-
Target
Pixel Art.apk
-
Size
5.5MB
-
MD5
33dc08a89280839d5ebe61f8ba3c5b83
-
SHA1
6b9ba586147691f86a1318007d35408085a384b7
-
SHA256
2d5b6806d9ad74062f2cc6cf2dc5e0f6545639a1b3e6c00ca2f5528f09612783
-
SHA512
836b2d0c30a34ef2ec544326bac9e605881aedc4d61fcefbbc81ee92919904148e493f76fc26c9a9fecacc9b12ec327c44cb5cec9f3a4f35f53bee39823ea845
-
SSDEEP
98304:959As3Vg0JZ6hzQTs7dyxcP3FtzoNEV5mzMzBiTs0txFzI3:9gai0JZ3Ts7dy6P3ciVMzx/2
Malware Config
Signatures
-
Makes use of the framework's Accessibility service 4 TTPs 3 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Acquires the wake lock 1 IoCs
-
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
-
Performs UI accessibility actions on behalf of the user 1 TTPs 8 IoCs
Application may abuse the accessibility service to prevent their removal.
-
Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
-
Requests enabling of the accessibility settings. 1 IoCs
-
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
-
Schedules tasks to execute at a specified time 1 TTPs 1 IoCs
Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.
Processes
-
criticism.searchcom.looks1⤵
- Makes use of the framework's Accessibility service
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Performs UI accessibility actions on behalf of the user
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Requests enabling of the accessibility settings.
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Schedules tasks to execute at a specified time
Network
MITRE ATT&CK Mobile v15
Persistence
Event Triggered Execution
1Broadcast Receivers
1Foreground Persistence
1Scheduled Task/Job
1Defense Evasion
Foreground Persistence
1Hide Artifacts
1User Evasion
1Impair Defenses
1Prevent Application Removal
1Input Injection
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
41B
MD573ca8d6af8fdcb567754847440dbfa88
SHA1b1472b764ff81d8165ddfd2958a67aa0d4abddf4
SHA2562296954497d649bc19a7b3213d05d51fc1a68ff71e7de01a7edd56ca0828f14d
SHA5127fb52bb85e0e34f6a3ba928d5e88c2f004344bbd6ae3c163088e6aaaa59b5ce60484c78f93c10deabc6051323f7bbc0c87983ad260ebcb03cc42e49dc7b0019f
-
Filesize
256B
MD5c36f325a97187fd40e682f73d2760f68
SHA19026cbbd008958d899682bd19c59371487420a1c
SHA256292b1936cf271fe450439a6160fd6d75365893f57680955b35f6a658b008c83f
SHA512c88709245a1b2384b2929718085e56fcdf8310516dbefe3a1d86f47d4b2c20036ebb949b22724905e8e3c22109d1959817bc88bfbc6cb4ef3c3ee60bd65f29fd
-
Filesize
25B
MD5ba30336bf53d54ed3c0ea69dd545de8c
SHA1ce99c6724c75b93b7448e2d9fac16ca702a5711f
SHA2562d6988fb5afdaafc4e33fa1f71d6f10c95ab5a49a8ec820add5b13eef05439af
SHA512eea34ca526e03349e746d3687ea660b4748f0174fe2ffdb65161e232e08630b345e03329614852ce881a71362ba68575e9dd08fa361a416e5b2fb231e21a0a3e
-
Filesize
280B
MD51764e93b2746190e78ef138acf1473c3
SHA13a56d0993540c39957f99fb544dfeaf370ac5eb9
SHA256a456e812d8f7fde11bebf644fb0d09b3f0932a6edf37d9dfb7cd217bedaf9aaf
SHA512f59316867309b30b393cde0d03dd75a10e3e21e4e34946ce383e906c4f0f0d3b510f90076dce79e7b4d0f70f3e73b39dc74e36353041cc8be5ff26ad2335aeb6