Analysis
-
max time kernel
59s -
max time network
51s -
platform
android_x64 -
resource
android-x64-arm64-20240624-en -
resource tags
-
submitted
31-10-2024 06:54
General
-
Target
Phone-Poisk (3).apk
-
Size
3.7MB
-
MD5
ffabe5577ea725619071ceca4ec2393a
-
SHA1
8645abbf7d6760f6a0aa6961d18aed5638a1253f
-
SHA256
56a38cc613580ed12ccb2a5a03ad5ca9fae01e0f8175b3a00b31335324309c84
-
SHA512
1bb4a661705ec00a75c36bbb9827d2cbed03bee8e9325ad26aa8939ed2320c902b05623b487b3bfba6f33a0b921bbbdb8c16f08d86169f8820e9995422ccc886
-
SSDEEP
98304:NUXgrCby20QvBMyqBxE1xfx4amzXzB7Tk0toolg33:NN2by2HvHHp4VzBXy3
Malware Config
Signatures
-
Makes use of the framework's Accessibility service 4 TTPs 3 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
-
Acquires the wake lock 1 IoCs
-
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
-
Performs UI accessibility actions on behalf of the user 1 TTPs 8 IoCs
Application may abuse the accessibility service to prevent their removal.
-
Queries information about active data network 1 TTPs 1 IoCs
-
Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
-
Schedules tasks to execute at a specified time 1 TTPs 1 IoCs
Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.
Processes
-
ontario.contemporary.knowledge1⤵
- Makes use of the framework's Accessibility service
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Performs UI accessibility actions on behalf of the user
- Queries information about active data network
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Schedules tasks to execute at a specified time
Network
MITRE ATT&CK Mobile v15
Defense Evasion
Foreground Persistence
1Hide Artifacts
1User Evasion
1Impair Defenses
1Prevent Application Removal
1Input Injection
1Discovery
Software Discovery
1Security Software Discovery
1System Network Connections Discovery
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
29B
MD5e7f0573f080521e148d149253a2f0866
SHA1c929a8b2cfb96177168bb6cf1ee76390296a5a0b
SHA256f41136912480e8282a98115b403e704e5e648a8a27905210286be3835e5ee76c
SHA512568ac16a5fb7989392073a6d700e1033207c9e912b9f5b430120caf0ca050ebc47bf521508cb9eea3bf61d987c591382dd6b33b0ab914d47b9319098ddfcf1bd
-
Filesize
29B
MD530866f03e91769468ea37ec42a7d36c8
SHA19ff1ef07806bc107587f26c1acd7c5d83dd460c5
SHA256f6a76566acd5f103e575f3c1177ca14e157634bf436f9c103abd20034dd1bc07
SHA51262c70f8ff82e2b6dc9fe3ea7db288d37dafacc1c6d8452e576789cc2577a39b3081398dfe92abad140632ef4cbe858a31e03fbc49d63ce8b06c568c46707ac36
-
Filesize
25B
MD5ba30336bf53d54ed3c0ea69dd545de8c
SHA1ce99c6724c75b93b7448e2d9fac16ca702a5711f
SHA2562d6988fb5afdaafc4e33fa1f71d6f10c95ab5a49a8ec820add5b13eef05439af
SHA512eea34ca526e03349e746d3687ea660b4748f0174fe2ffdb65161e232e08630b345e03329614852ce881a71362ba68575e9dd08fa361a416e5b2fb231e21a0a3e
-
Filesize
280B
MD5d99eed993689360d861ba373c42193ce
SHA1d915c6b06e6762d2ce15dbd4fdddd19fa80aee66
SHA256ef2379f858e387347fb9d393f3a303d2101dc1e377352e52677a432aecced5b5
SHA512d493390a5c5147b38070c32f9f497ca43622e949668ea977d576b1e7d50a39db554a8922f18725b8ee0ca5caefab6f160c8b602318ca0ee6d4c9b25e26c1d069