Analysis
-
max time kernel
59s -
max time network
67s -
platform
android_x64 -
resource
android-x64-arm64-20240624-en -
resource tags
-
submitted
31-10-2024 07:45
General
-
Target
ready_1.apk
-
Size
3.7MB
-
MD5
82b8b96904dfde915d2608468b8908d2
-
SHA1
4b7f4c27700031225590a5e8027e3eec1401ac3a
-
SHA256
1841e8606b464685bb24440f01b96a0d8b7d310654e6c14b6418e93a16d12c52
-
SHA512
86bdd9413f918d2c0a4c124885e6e384ab63b14b3968b6670f382ec681cba8f3419252f910e2e7a2e41493a50dd2197fef8ddc5ab4b991041035c65c386e10c7
-
SSDEEP
49152:KzikDYzdGG9QTOimzETaYql0cgWwUyw3/Xq7EnDnjgllEN3kXJ/IczmCgV6RjaVt:+YzByTFmzETY0tE1DHpmQczrg0Iv
Malware Config
Signatures
-
Removes its main activity from the application launcher 1 TTPs 1 IoCs
-
Makes use of the framework's Accessibility service 4 TTPs 3 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
-
Acquires the wake lock 1 IoCs
-
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
-
Performs UI accessibility actions on behalf of the user 1 TTPs 4 IoCs
Application may abuse the accessibility service to prevent their removal.
-
Queries information about active data network 1 TTPs 1 IoCs
-
Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
-
Schedules tasks to execute at a specified time 1 TTPs 1 IoCs
Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.
Processes
-
mess.mcdonald.contests1⤵
- Removes its main activity from the application launcher
- Makes use of the framework's Accessibility service
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Performs UI accessibility actions on behalf of the user
- Queries information about active data network
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Schedules tasks to execute at a specified time
Network
MITRE ATT&CK Mobile v15
Defense Evasion
Foreground Persistence
1Hide Artifacts
2Suppress Application Icon
1User Evasion
1Impair Defenses
1Prevent Application Removal
1Input Injection
1Discovery
Software Discovery
1Security Software Discovery
1System Network Connections Discovery
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
29B
MD5ea2cd29c192da6b91c2d9c5ab7871659
SHA1fbc2f5f7cba4581aa7788645826fc56b542f88e8
SHA256f33d22e972838b1c4322a0bd77e1b0abe1b1a01bec7454fac71a698154749301
SHA5127078fa705af06cff9072101120e9c6ff7454785bd564cafeb6f15825c3373887154a6ab2a18d2823ce0fc1d042d04de6aad87e7f682f246ca498b2fe5cf8cdfa
-
Filesize
25B
MD5ba30336bf53d54ed3c0ea69dd545de8c
SHA1ce99c6724c75b93b7448e2d9fac16ca702a5711f
SHA2562d6988fb5afdaafc4e33fa1f71d6f10c95ab5a49a8ec820add5b13eef05439af
SHA512eea34ca526e03349e746d3687ea660b4748f0174fe2ffdb65161e232e08630b345e03329614852ce881a71362ba68575e9dd08fa361a416e5b2fb231e21a0a3e
-
Filesize
280B
MD50fe2175cebbfa5838ba9aedd873e3f62
SHA13657f5418c8499df9ffe7121b98f535103ac451c
SHA256112c4edbd77fe022d3f8276dd856f290fa1956de23fa146384382a49b274cd6e
SHA51260d3903724554d4fd8146059ac50e5cccee33c250f561adfd6e6e9b1dd6e1ffbc37b62cb698880e2acc74c6af71cebcc2472260e5897163924b76b0c65a25497
-
Filesize
57B
MD53af69119804d1d999d56d230338ffd36
SHA169350826205583c8acc385ee0a6e3fc2673ee2ca
SHA25610994862cb263ab6b1e4428cc24cc9c585458fc67544fe0f5dfea81a5a7a115c
SHA5124a41b19d28f637b397d9dff225621694c44c750a9bd65f3e6ad5d3b9acf0d118910ddf53d4618213f9e14c61e0fb154f33f2747dd3b8d50459990767f42fc8cb