Analysis
-
max time kernel
149s -
max time network
153s -
platform
android_x64 -
resource
android-33-x64-arm64-20240624-en -
resource tags
androidarch:arm64arch:x64image:android-33-x64-arm64-20240624-enlocale:en-usos:android-13-x64system -
submitted
05-11-2024 06:56
Behavioral task
behavioral1
Sample
список 03.06.apk
Resource
android-x64-arm64-20240624-en
Behavioral task
behavioral2
Sample
список 03.06.apk
Resource
android-33-x64-arm64-20240624-en
General
-
Target
список 03.06.apk
-
Size
3.7MB
-
MD5
af12992e603a2d3d9345d178913e2374
-
SHA1
4d2e70b3d084d0b727ae955265b0007846fcdaac
-
SHA256
c6102762ac58fd23908a3068c12856dd175ab20e22ccf92989218c1c0c6955be
-
SHA512
c5483db8c55ad46742ca534094935eaf523269b52760266d970e9850a426d1359e8eb729dd640a1a6cf3735328631884efd6c5da3dc5ef32ff32b8fa420adc1d
-
SSDEEP
49152:iUXoikD0zdGGfQTOFmzOnkYqo0cgeTU7MJBVs5s492+5J8Y1f6YnG5Wq+Y:iB0zB4TmmzOnH0tiJ3a2+5J8OEc2
Malware Config
Signatures
-
Makes use of the framework's Accessibility service 4 TTPs 3 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
description ioc Process Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByText generating.w.languages Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId generating.w.languages Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId generating.w.languages -
Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
-
Acquires the wake lock 1 IoCs
description ioc Process Framework service call android.os.IPowerManager.acquireWakeLock generating.w.languages -
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
description ioc Process Framework service call android.app.IActivityManager.setServiceForeground generating.w.languages -
Performs UI accessibility actions on behalf of the user 1 TTPs 8 IoCs
Application may abuse the accessibility service to prevent their removal.
ioc Process android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction generating.w.languages android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction generating.w.languages android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction generating.w.languages android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction generating.w.languages android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction generating.w.languages android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction generating.w.languages android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction generating.w.languages android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction generating.w.languages -
Queries information about active data network 1 TTPs 1 IoCs
description ioc Process Framework service call android.net.IConnectivityManager.getActiveNetworkInfo generating.w.languages -
Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
description ioc Process Intent action android.settings.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS generating.w.languages -
Schedules tasks to execute at a specified time 1 TTPs 1 IoCs
Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.
description ioc Process Framework service call android.app.job.IJobScheduler.schedule generating.w.languages
Processes
-
generating.w.languages1⤵
- Makes use of the framework's Accessibility service
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Performs UI accessibility actions on behalf of the user
- Queries information about active data network
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Schedules tasks to execute at a specified time
PID:4352
Network
MITRE ATT&CK Mobile v15
Defense Evasion
Foreground Persistence
1Hide Artifacts
1User Evasion
1Impair Defenses
1Prevent Application Removal
1Input Injection
1Discovery
Software Discovery
1Security Software Discovery
1System Network Connections Discovery
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
29B
MD5ea2cd29c192da6b91c2d9c5ab7871659
SHA1fbc2f5f7cba4581aa7788645826fc56b542f88e8
SHA256f33d22e972838b1c4322a0bd77e1b0abe1b1a01bec7454fac71a698154749301
SHA5127078fa705af06cff9072101120e9c6ff7454785bd564cafeb6f15825c3373887154a6ab2a18d2823ce0fc1d042d04de6aad87e7f682f246ca498b2fe5cf8cdfa
-
Filesize
25B
MD5ba30336bf53d54ed3c0ea69dd545de8c
SHA1ce99c6724c75b93b7448e2d9fac16ca702a5711f
SHA2562d6988fb5afdaafc4e33fa1f71d6f10c95ab5a49a8ec820add5b13eef05439af
SHA512eea34ca526e03349e746d3687ea660b4748f0174fe2ffdb65161e232e08630b345e03329614852ce881a71362ba68575e9dd08fa361a416e5b2fb231e21a0a3e
-
Filesize
260B
MD50f2f6f3f282c97f226aafe3929c2cb4e
SHA126baf028182b2d92b13060fdd9f808798d2ce60c
SHA2564ca883cb5101cd51208fb9f810a431d0b1013090d96b63cbda43ef4355ad9286
SHA512a12fb0247fdfe5710ac1fb74e5fcf1240f4b00d2558fff5769a6e399670d96cabb49e96dda20a4bc2a0d7d81b5fa4d76be2c95d6b2e6de43ca22b613431c41f9
-
Filesize
94B
MD531bf789a558d7d90b128bccd94eb9dd2
SHA1da6180d0ff91ce9eba91ea84cd9037b086b97f72
SHA2562fe896ff5b6d2a6b25f39f97eea5aab8cfb7da6a77e661911026715f3990b471
SHA512a12eec49c2ce165bd4344966a7c16a96b97f6279c57c725ecb24c5c56cb04a02e3d307bf7007e74f69899a2690419621c9f08ae6d492e090020babba7c09f287