Analysis
-
max time kernel
59s -
max time network
50s -
platform
android-11_x64 -
resource
android-x64-arm64-20240910-en -
resource tags
-
submitted
31-10-2024 07:23
General
-
Target
ready (3).apk
-
Size
3.7MB
-
MD5
4118b47fd298da7aa3fe1de85797b5fd
-
SHA1
2d3c69ce917756d6e1e27cabc44648d401aeffe9
-
SHA256
a34c41ef70c23ab8e474ab940ff369971aa4538f7fe6a9f7e2ecc7c7ae4c329e
-
SHA512
2f0adc12d64ddc3fbe29968b275c750697d2009bcf5bf3101d696ba806cc07816701c8004adca367d62ad02b3dd5398db9a9b6b137e7c559202538e1273a1a05
-
SSDEEP
98304:rVpx3/LBRqCrFFJ8yB2oU6mz/zBjTI0twvWFl:JpRvqCXJVQoU1zZzh
Malware Config
Signatures
-
Makes use of the framework's Accessibility service 4 TTPs 3 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
-
Acquires the wake lock 1 IoCs
-
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
-
Performs UI accessibility actions on behalf of the user 1 TTPs 12 IoCs
Application may abuse the accessibility service to prevent their removal.
-
Queries information about active data network 1 TTPs 1 IoCs
-
Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
-
Schedules tasks to execute at a specified time 1 TTPs 1 IoCs
Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.
Processes
-
hint.polish.moderators1⤵
- Makes use of the framework's Accessibility service
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Performs UI accessibility actions on behalf of the user
- Queries information about active data network
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Schedules tasks to execute at a specified time
Network
MITRE ATT&CK Mobile v15
Defense Evasion
Foreground Persistence
1Hide Artifacts
1User Evasion
1Impair Defenses
1Prevent Application Removal
1Input Injection
1Discovery
Software Discovery
1Security Software Discovery
1System Network Connections Discovery
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
17B
MD5889d54079132f8fae2149f597f742ba8
SHA156d631f17cb9cdf7033c6ac4847320ec79c64b7a
SHA256be6c089b544dfb9fb2de63bbc690ba3438b15d3612c61388dae2a8863fae152e
SHA51285d1d295f3dd69a9084f724f57f836b0164aaa3aa26afde6d046b148b81f1c1faeba4e97c94d2bdacdeda11e847933d670a6a452824ab3e836443961321e8c89
-
Filesize
25B
MD5ba30336bf53d54ed3c0ea69dd545de8c
SHA1ce99c6724c75b93b7448e2d9fac16ca702a5711f
SHA2562d6988fb5afdaafc4e33fa1f71d6f10c95ab5a49a8ec820add5b13eef05439af
SHA512eea34ca526e03349e746d3687ea660b4748f0174fe2ffdb65161e232e08630b345e03329614852ce881a71362ba68575e9dd08fa361a416e5b2fb231e21a0a3e
-
Filesize
272B
MD5b3aee7295ef529ff7010824974c7b41d
SHA1125e44e1b7f60aeb0013e12bd0a34fc2d513f860
SHA2564720dc45a7aef828c68143b91638d6ca947b00f3f37b3397780d386a07f9d2e4
SHA5121850de2e24b2fc620c9aa55360e7445c19778169024057b613b2680a4fa37e459f19d5165256b6d0a7fd5bf86024b56bb62abd5de3ed32ae12a3c6d026d5b81b
-
Filesize
57B
MD54c009d7fc0ac3a0e7a73d3c2b6e49155
SHA19e54f6752fac61f619d7e3fdf0f847c55417f28c
SHA256a3d45e00fc0fe0cedfd8ab2cc1077126df204bd8f329527ace7abb72d67f9479
SHA51205680efe3808580a741b00579afd97d1cc61a0629643222fd22ff489aafcafee2d6d16f9be324cfcf56d7afbe5ff8e72f4cc29510d19332c822fd160450ccc2c