Analysis

  • max time kernel
    143s
  • max time network
    159s
  • platform
    android_x64
  • resource
    android-33-x64-arm64-20240624-en
  • resource tags

    androidarch:arm64arch:x64image:android-33-x64-arm64-20240624-enlocale:en-usos:android-13-x64system
  • submitted
    04/11/2024, 20:32

General

  • Target

    baf5bd5d99a20b1581db2a999a40a98a833b12fb1a6fe5eedf9ca34e8a93e8f6.apk

  • Size

    8.1MB

  • MD5

    aa38fa826b9ee13fb036d64eabfa7ea9

  • SHA1

    6e7ac2466b955695d9101fe3c67cbe8cc70dc88f

  • SHA256

    baf5bd5d99a20b1581db2a999a40a98a833b12fb1a6fe5eedf9ca34e8a93e8f6

  • SHA512

    a42c6baa281886f94bfced0e4c3894d1f9eedf97ff7f5842840b7651eb2df8a58b8517b6e70074c88f53e7a55a1b4e202f2a9ef2c7030b380cb9030c1c37d55f

  • SSDEEP

    196608:k5DSkcg1MKk+TwUREMVpy9oQl2Fs0G/acZZoXP8:kUg1MlAvEOyyQlx04ZZd

Malware Config

Signatures

  • Makes use of the framework's Accessibility service 4 TTPs 1 IoCs

    Retrieves information displayed on the phone screen using AccessibilityService.

  • Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs

    Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.

  • Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

    Application may abuse the framework's foreground service to continue running in the foreground.

  • Performs UI accessibility actions on behalf of the user 1 TTPs 11 IoCs

    Application may abuse the accessibility service to prevent their removal.

  • Checks CPU information 2 TTPs 1 IoCs
  • Checks memory information 2 TTPs 1 IoCs

Processes

  • com.support.litework
    1⤵
    • Makes use of the framework's Accessibility service
    • Obtains sensitive information copied to the device clipboard
    • Makes use of the framework's foreground persistence service
    • Performs UI accessibility actions on behalf of the user
    • Checks CPU information
    • Checks memory information
    PID:4331

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/data/com.support.litework/files/profileInstalled

    Filesize

    24B

    MD5

    dde37892ee72ab6357f71480b8e6220f

    SHA1

    6105063f107e639ee83976859af28a2564dddcc5

    SHA256

    1349473ebc1da38fbf2353febaa89669c3e193b602f7ae653d7dc26236b64530

    SHA512

    695222f72c85ddf3e66e335e97005d556fe6264bf581c1cc7a220614266278e26e589725c9fa34574611f6995f40e3ec808f36b9a8bac2c26abe14fd71f0ecd7