Analysis
-
max time kernel
149s -
max time network
152s -
platform
android-10_x64 -
resource
android-x64-20240910-en -
resource tags
-
submitted
06-11-2024 02:11
General
-
Target
053f9ef5a6e5aa8716cc77cbd6f588c83a31f8f509a2891cf0ba35cbd7d5ce96.apk
-
Size
3.8MB
-
MD5
530a0b796267049251079ec88881b9d9
-
SHA1
0538c42b5c9d96ec523a93eca23e7eb18061d70a
-
SHA256
053f9ef5a6e5aa8716cc77cbd6f588c83a31f8f509a2891cf0ba35cbd7d5ce96
-
SHA512
c3888cc9809cf8e256aa8e304fb12cf4c0a677d91a8045133f570d5ade1c7479a8cb27b26d5c7f81f72b9a972e9f753574baa5dd2b8705880a341006b617fbfa
-
SSDEEP
98304:xBVgjHEvfER3sYvF3yy4BVnmzrzBFT50tdRwn:xBjvfS3sQF3y7TmzPWa
Malware Config
Signatures
-
Makes use of the framework's Accessibility service 4 TTPs 3 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs
Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
-
Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
-
Acquires the wake lock 1 IoCs
-
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
-
Performs UI accessibility actions on behalf of the user 1 TTPs 8 IoCs
Application may abuse the accessibility service to prevent their removal.
-
Queries information about active data network 1 TTPs 1 IoCs
-
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
-
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
-
Schedules tasks to execute at a specified time 1 TTPs 1 IoCs
Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.
-
Checks memory information 2 TTPs 1 IoCs
Processes
-
dial.meanwhile.dawn1⤵
- Makes use of the framework's Accessibility service
- Obtains sensitive information copied to the device clipboard
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Performs UI accessibility actions on behalf of the user
- Queries information about active data network
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Schedules tasks to execute at a specified time
- Checks memory information
Network
MITRE ATT&CK Mobile v15
Persistence
Event Triggered Execution
1Broadcast Receivers
1Foreground Persistence
1Scheduled Task/Job
1Defense Evasion
Foreground Persistence
1Impair Defenses
1Prevent Application Removal
1Input Injection
1Virtualization/Sandbox Evasion
1System Checks
1Credential Access
Clipboard Data
1Input Capture
2GUI Input Capture
1Keylogging
1Discovery
Software Discovery
1Security Software Discovery
1System Information Discovery
1System Network Configuration Discovery
1System Network Connections Discovery
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
33B
MD563ff54608c60109469c03f15bdbee578
SHA1c5312ff6bc9da890efe45c81d274aba193dbe74f
SHA2560debaf6b0700d7545e7685939be74ae756a73da8a9a4162db680ee2b1f244707
SHA5123b40048ac97c1dac85483be76c8b51905524a9922dcc0e4b6e70901198d3d540ce6c4eea72be515a238f082f0350abb4b32e4bd1d75becec1df9afcd6249245b
-
Filesize
33B
MD5849bb6447136edf2f24db2a26b6f31f8
SHA1c572b491b1edbdfeed86ebca1342c5daab35cbfb
SHA2567c5dceb2612c303f99a3df371b8954b1896d7ed8f6a645ec4a174177e3800f64
SHA512896fbfc9581c011050e5549341da0853ed7c91d0c1949c33fa738634c6fe3b3cf695dce03f3657915550bddb3f78105b93cf161edae311821c17609d5a7217e2
-
Filesize
25B
MD5ba30336bf53d54ed3c0ea69dd545de8c
SHA1ce99c6724c75b93b7448e2d9fac16ca702a5711f
SHA2562d6988fb5afdaafc4e33fa1f71d6f10c95ab5a49a8ec820add5b13eef05439af
SHA512eea34ca526e03349e746d3687ea660b4748f0174fe2ffdb65161e232e08630b345e03329614852ce881a71362ba68575e9dd08fa361a416e5b2fb231e21a0a3e
-
Filesize
284B
MD5570facf0e693919538c2fac06fd5a7ef
SHA13d7295b34c23fb6a57838de7b91a1ce4d4a0cba8
SHA2563be78dd289c16f7d8e2bf94e002c9bc06305fac75d1ee402fb65d976cd515813
SHA5120a490c4849cec5a70ea6a548ee8cbbdb7082dbbe0beb2385546ed7e27a5384cbb9275b00c3d07637f6b18ca1995ecfe78a046565b2e934de64478c3f091a8863