0191d1e5b93f86788cbe12353e48759b881a46303bb5e0742737535552a7e478

Resubmissions

07-11-2024 02:58

241107-dgnm2asrcs 10

05-11-2024 22:06

241105-1z69eszgmm 10

Analysis

max time kernel
124s
max time network
152s
platform
android-9_x86
resource
android-x86-arm-20240910-en
resource tags

arch:armarch:x86image:android-x86-arm-20240910-enlocale:en-usos:android-9-x86system
submitted
05-11-2024 22:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

up.apk
Size

3.9MB
MD5

2ed7172c2d16942755e5c70843ab1a0b
SHA1

4d910437d7e43ab967b7ccf1a38bcc5343dc6dcf
SHA256

9f4fecd99a17e6a5edf6741921f0954542144e0803e11482be3e31c643bdc2d7
SHA512

460c986bce5729e4147b05f87676c8fa55333ff8ff7cd9ac92a47f8e3dacc355a8fe3c2dfe1c3d1bba3a076cc1869fac3b6a313ed541794f536572aa1e31be0f
SSDEEP

98304:mefcmgFINmsyjYS2cJHKJgFukMsgzS5Gya1/ewLuRF+LlX8YrNz0r:mTmgxsD6oJglgz3NbyREZ8Ezw

Score

7^/10

collection credential_access evasion impact persistence

Malware Config

Signatures

Makes use of the framework's Accessibility service 4 TTPs 2 IoCs

Retrieves information displayed on the phone screen using AccessibilityService.

collection evasion credential_access

Input Injection

T1516

Screen Capture

T1513

Keylogging

T1417.001

GUI Input Capture

T1417.002

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	com.omnibusriding.wallon
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId	com.omnibusriding.wallon

Acquires the wake lock 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.omnibusriding.wallon

Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

Application may abuse the framework's foreground service to continue running in the foreground.

evasion persistence

Foreground Persistence

T1541

description	ioc	Process
Framework service call	android.app.IActivityManager.setServiceForeground	com.omnibusriding.wallon

Performs UI accessibility actions on behalf of the user 1 TTPs 1 IoCs

Application may abuse the accessibility service to prevent their removal.

evasion

Prevent Application Removal

T1629.001

ioc	Process
android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction	com.omnibusriding.wallon

Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

impact

Data Encrypted for Impact

T1471

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	com.omnibusriding.wallon

com.omnibusriding.wallon
1⤵
- Makes use of the framework's Accessibility service
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Performs UI accessibility actions on behalf of the user
- Uses Crypto APIs (Might try to encrypt user data)
PID:4369