Analysis
-
max time kernel
138s -
max time network
145s -
platform
android_x64 -
resource
android-x64-20240624-en -
resource tags
androidarch:x64arch:x86image:android-x64-20240624-enlocale:en-usos:android-10-x64system -
submitted
03/11/2024, 21:44
Static task
static1
Behavioral task
behavioral1
Sample
target.apk
Resource
android-x86-arm-20240624-en
Behavioral task
behavioral2
Sample
target.apk
Resource
android-x64-20240624-en
Behavioral task
behavioral3
Sample
target.apk
Resource
android-x64-arm64-20240624-en
General
-
Target
target.apk
-
Size
3.5MB
-
MD5
0d4a272052b87d098271ddfb6f4ea191
-
SHA1
c1b3db52e0aa1798b9193ea7f1a2c8d7747aeec8
-
SHA256
a25bf4bdb2ed9872456af0057eb21ce31fd03d680d63a9da469519060b4814bc
-
SHA512
b891f95ea0aee3b04ffd62714a17e5c9c25491a51934ab0642dfd5c7c8ead2558b3f29a37c0b2a45b45a19113a28cf1b2d47115d8b2a8cf00067d7daa5316deb
-
SSDEEP
98304:t91OL1lrWdyaMKcPr0clWlAP8r8VMZmARB9exM:t91OJlrWYf3lKAkroARB9exM
Malware Config
Signatures
-
pid Process 4960 artwork.differ.kitchen -
Loads dropped Dex/Jar 1 TTPs 4 IoCs
Runs executable file dropped to the device during analysis.
ioc pid Process /data/user/0/artwork.differ.kitchen/app_DynamicOptDex/wumso.json 4960 artwork.differ.kitchen /data/user/0/artwork.differ.kitchen/app_DynamicOptDex/wumso.json 4960 artwork.differ.kitchen /data/user/0/artwork.differ.kitchen/app_DynamicOptDex/wumso.json 4995 artwork.differ.kitchen:cproc /data/user/0/artwork.differ.kitchen/app_DynamicOptDex/wumso.json 4995 artwork.differ.kitchen:cproc -
Makes use of the framework's Accessibility service 4 TTPs 1 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
description ioc Process Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId artwork.differ.kitchen -
Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
-
Acquires the wake lock 1 IoCs
description ioc Process Framework service call android.os.IPowerManager.acquireWakeLock artwork.differ.kitchen -
Schedules tasks to execute at a specified time 1 TTPs 1 IoCs
Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.
description ioc Process Framework service call android.app.job.IJobScheduler.schedule artwork.differ.kitchen:cproc -
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
description ioc Process Framework API call javax.crypto.Cipher.doFinal artwork.differ.kitchen:cproc
Processes
-
artwork.differ.kitchen1⤵
- Removes its main activity from the application launcher
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Acquires the wake lock
PID:4960
-
artwork.differ.kitchen:cproc1⤵
- Loads dropped Dex/Jar
- Schedules tasks to execute at a specified time
- Uses Crypto APIs (Might try to encrypt user data)
PID:4995
Network
MITRE ATT&CK Mobile v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
454KB
MD5697f9bc2aaa121bb62bd391658ca297b
SHA10877f5cf03074aa0bcf4ef08a1c1e49603d9d95e
SHA25605e067405d0652cecbbd7efe627958de7e61b4bbaf925818acef58bfa4337336
SHA5121533880d87096c1a8bd721cc87a3ec804b42e4e9244d3a6bb430e895b7b3eddbcf60e1dda6b50589700a7498eb3158f5d591e91b845d67e439f3f00e6149f923
-
Filesize
454KB
MD5477ff918c411653ea081fadffcf1b616
SHA122596bd0ac2add86520fe4c1baac0ec2d1883128
SHA2568bd7dcc276bcd620054d13de928606eac85102bb32e1544eb3fae3a198adc71c
SHA51256854f9ed86406f8dc3ce50adfae3824def1b0de95d0ff7b5b78e5cb0388f51a95d8df125340e8f58299c72f83a6d52a0c8c297d2fda241a5cb76b6a9e355ac2