a6a184dfb4591547818c5ae3a0975b36267b8c4e1e0d3cfb1aefb655da316e09

Analysis

max time kernel
120s
max time network
151s
platform
android-9_x86
resource
android-x86-arm-20240910-en
resource tags

arch:armarch:x86image:android-x86-arm-20240910-enlocale:en-usos:android-9-x86system
submitted
01-11-2024 17:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

update.apk
Size

8.1MB
MD5

4a2a8507583ce69ab265d7a042dbac62
SHA1

112148013a7cd0edffc21b0eec3addace9f96988
SHA256

4b98c2682cf0a97ad67c2c9e57048882b56477ecf966edac26352f2a52d4d7d4
SHA512

bf55a38e22cf8776e8dedf01047eed56d3d0875687cf71fec610206c4c9e0433468fd4f7532ce1d36a1babad9bd2d1f6a3692a6ad4f3af5dc0cf2e793313d5ec
SSDEEP

196608:k5DSkcg1MKk+TwUREMVpy9oQl2FsJe9UacZZoKV60T:kUg1MlAvEOyyQlxJtZZ5

Score

7^/10

collection credential_access discovery evasion persistence

Malware Config

Signatures

Makes use of the framework's Accessibility service 4 TTPs 1 IoCs

Retrieves information displayed on the phone screen using AccessibilityService.

collection evasion credential_access

Input Injection

T1516

Screen Capture

T1513

Keylogging

T1417.001

GUI Input Capture

T1417.002

Processes:

com.support.litework

description	ioc	process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	com.support.litework

Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
evasion persistence

Foreground Persistence
T1541

Processes:

com.support.litework

description ioc process

Framework service call android.app.IActivityManager.setServiceForeground com.support.litework
Performs UI accessibility actions on behalf of the user 1 TTPs 1 IoCs
Application may abuse the accessibility service to prevent their removal.
evasion

Prevent Application Removal
T1629.001

Processes:

com.support.litework

ioc process

android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction com.support.litework
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
discovery

System Network Configuration Discovery
T1422

Processes:

com.support.litework

description ioc process

Framework service call com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone com.support.litework
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
persistence

Broadcast Receivers
T1624.001

Processes:

com.support.litework

description ioc process

Framework service call android.app.IActivityManager.registerReceiver com.support.litework
Checks memory information 2 TTPs 1 IoCs

System Checks
T1633.001

System Information Discovery
T1426

Processes:

com.support.litework

description ioc process

File opened for read /proc/meminfo com.support.litework

description	ioc	process
Framework service call	android.app.IActivityManager.setServiceForeground	com.support.litework

ioc	process
android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction	com.support.litework

description	ioc	process
Framework service call	com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone	com.support.litework

description	ioc	process
Framework service call	android.app.IActivityManager.registerReceiver	com.support.litework

description	ioc	process
File opened for read	/proc/meminfo	com.support.litework

com.support.litework
1⤵
- Makes use of the framework's Accessibility service
- Makes use of the framework's foreground persistence service
- Performs UI accessibility actions on behalf of the user
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Checks memory information
PID:4251

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Foreground Persistence

T1541

Privilege Escalation

Defense Evasion

Foreground Persistence

T1541

Impair Defenses

T1629

Prevent Application Removal

T1629.001

Input Injection

T1516

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Input Capture

T1417

GUI Input Capture

T1417.002

Keylogging

T1417.001

Discovery

System Information Discovery

T1426

System Network Configuration Discovery

T1422

Lateral Movement

Collection

Input Capture

T1417

GUI Input Capture

T1417.002

Keylogging

T1417.001

Screen Capture

T1513

Command and Control

Exfiltration

Impact

Input Injection

T1516

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.support.litework/files/profileInstalled

Filesize
24B

MD5
71ae2d517df842c2b06f3ac8cc67653f

SHA1
44db1f53ee76a7b19dae251f1c052686e875f8ca

SHA256
e6a4b4774606e942b70c8a2d14363bda3181781328a66a45b3fca8b46f79e8bd

SHA512
90de5cf8df83ff43c26885ff95636d18b35b1aa0c321486a16a5e07869d6a02d7ed80cec09b33e18ffb21aba7eba3f1edf16cab2b50407b94a350e499ef499ef

Download Submit