Analysis
-
max time kernel
59s -
max time network
68s -
platform
android_x64 -
resource
android-x64-arm64-20240624-en -
resource tags
-
submitted
31-10-2024 06:10
General
-
Target
Linken Sphere.apk
-
Size
3.8MB
-
MD5
8169d13048beb90590fa5a9dcb3c40b6
-
SHA1
94be8da1f709560dfaae4ea4c557ac7128f087fc
-
SHA256
77277306eee10a779f8e9747e036fbc37cf4ab04dccb605e5a5f07291f102199
-
SHA512
d9d89fd911e95316a84ae8258e1096897aee5f26f0f8b37f7bed26f3a7363437fd403e08b61a5a504dc7d719f4c76ced2a5a99c7e3b3fb414def9229520f8995
-
SSDEEP
49152:gpvwLtu3iuk4nFnQwVjaO6jyLzqqWXhmzJzdGGeQTOPpUWYq90cg67Uoik5jW:gBYtuSu5PwjezFWXhmzJzBxT60t67zC
Malware Config
Signatures
-
Makes use of the framework's Accessibility service 4 TTPs 3 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
-
Acquires the wake lock 1 IoCs
-
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
-
Performs UI accessibility actions on behalf of the user 1 TTPs 12 IoCs
Application may abuse the accessibility service to prevent their removal.
-
Queries information about active data network 1 TTPs 1 IoCs
-
Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
-
Schedules tasks to execute at a specified time 1 TTPs 1 IoCs
Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.
Processes
-
yemen.ef.evidence1⤵
- Makes use of the framework's Accessibility service
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Performs UI accessibility actions on behalf of the user
- Queries information about active data network
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Schedules tasks to execute at a specified time
Network
MITRE ATT&CK Mobile v15
Defense Evasion
Foreground Persistence
1Hide Artifacts
1User Evasion
1Impair Defenses
1Prevent Application Removal
1Input Injection
1Discovery
Software Discovery
1Security Software Discovery
1System Network Connections Discovery
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
33B
MD5b9e1f78f11d30dafda9257b148762020
SHA1b9975a13355c48bafca7e9a24c0bba6c726b72d8
SHA256b7f8610b97aa55681f31cdba26c97a37799b7f5924d52114b02c27b37eed2434
SHA512599c5056a2f6066b7d4bcb471fd6d3b8b82db4f3caaa59c463db6ece440bbc2bbdfc04c926bf024241e1910c3acf0c35f5a91cab4a0db09159f00ca136afb385
-
Filesize
29B
MD504749fa54ae57c46c0d26fa15c0eae2e
SHA18253e3a830da982e23afb229f247f3c32166676c
SHA2563d0abf2d4c27fbabe603e407de6616a0e17fc02c63e2cd6e88f67685204769b1
SHA5120097d1e54df6d7e1d9236cde33dafc9212ed9b1d6841102e4b76fa922e060f764baa6e407158a48b8796b64dac12adcab54e69b274a6230c42e6efaa012547b2
-
Filesize
25B
MD5ba30336bf53d54ed3c0ea69dd545de8c
SHA1ce99c6724c75b93b7448e2d9fac16ca702a5711f
SHA2562d6988fb5afdaafc4e33fa1f71d6f10c95ab5a49a8ec820add5b13eef05439af
SHA512eea34ca526e03349e746d3687ea660b4748f0174fe2ffdb65161e232e08630b345e03329614852ce881a71362ba68575e9dd08fa361a416e5b2fb231e21a0a3e
-
Filesize
284B
MD5b59073c264159ae68bf48d0212d9ad00
SHA17b50f205395c6a583229cbfa66571b10193f86c0
SHA256144f49b8ec13c5550ea78609c5c0a5c6d708d7083d0282b7aa5b4954cf36ce7f
SHA5127070d4a189ebb30ee8a9cc14baabd534c6511ae3cabf8cb1821ac15f081470b0ec7832a3db14d7d4ac39b99d370a13efd06c11c8f064671f5315f039207d1bbc