Analysis
-
max time kernel
149s -
max time network
157s -
platform
android_x64 -
resource
android-x64-arm64-20240624-en -
resource tags
-
submitted
06-11-2024 02:13
General
-
Target
20bfd2b2466fad95b88cf5067b29a0dbabf5016ccbffbb3a672c7366b8ec7dfb.apk
-
Size
3.8MB
-
MD5
42d05c75286bcfaff3d1721d813f182b
-
SHA1
e28b64dcfcd1f985e66557e9defa50893d3673e0
-
SHA256
20bfd2b2466fad95b88cf5067b29a0dbabf5016ccbffbb3a672c7366b8ec7dfb
-
SHA512
65cedc6f876bfd56b7dcc797cde5471a27aa5cdb83a1ed0e52265b5ba6b3e3a1a787587e1377f7cb4a5f51e45343a863493cbf07f25a57da0b5940f8638eac76
-
SSDEEP
98304:btyuPe0dVqg8144bQimzLzBATc0tUSaKz:htGrg81lQNzKvDR
Malware Config
Signatures
-
A potential corporate email address has been identified in the URL: [email protected]
-
Makes use of the framework's Accessibility service 4 TTPs 3 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs
Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
-
Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
-
Acquires the wake lock 1 IoCs
-
Performs UI accessibility actions on behalf of the user 1 TTPs 8 IoCs
Application may abuse the accessibility service to prevent their removal.
-
Queries information about active data network 1 TTPs 1 IoCs
-
Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
-
Schedules tasks to execute at a specified time 1 TTPs 1 IoCs
Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.
-
Checks CPU information 2 TTPs 1 IoCs
-
Checks memory information 2 TTPs 1 IoCs
Processes
-
guild.arts.seeking1⤵
- Makes use of the framework's Accessibility service
- Obtains sensitive information copied to the device clipboard
- Acquires the wake lock
- Performs UI accessibility actions on behalf of the user
- Queries information about active data network
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Schedules tasks to execute at a specified time
- Checks CPU information
- Checks memory information
Network
MITRE ATT&CK Mobile v15
Defense Evasion
Hide Artifacts
1User Evasion
1Impair Defenses
1Prevent Application Removal
1Input Injection
1Virtualization/Sandbox Evasion
2System Checks
2Credential Access
Clipboard Data
1Input Capture
2GUI Input Capture
1Keylogging
1Discovery
Software Discovery
1Security Software Discovery
1System Information Discovery
2System Network Connections Discovery
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
41B
MD5370d50ef193e9f2df30f311894f148cd
SHA1ea348f026e343cca7525f448a6c96849354f9eda
SHA2563be5e571c6599dd184cfb6905b4edc8d75d663c28e1d68cd51ad2c94f22b3cae
SHA51216fbc940bb0b252aa9dc989c51fb4668a02ff8538f920594f8cf27322290b776255563d9127c2ba75ac306201ee1b9e9a5d3e8babd053922ea91bc35f9f44a8f
-
Filesize
41B
MD5bc7a1de6d4dbada6b99f42fd40dd43e7
SHA116e7245a2b44d195c173d50cdc56de1a88857d24
SHA256416d5d568fc5038622f9c4fd39059cbca7309bf96ef769065d6d2776fd86e64c
SHA512ff9faedd6c4f57862de4eb241347b06724961130f8834f99881eed93c2a9d96f9e5e4d3aecb60276ae22c7cb59c34daee89c517cad67dda3342089573e7363c3
-
Filesize
25B
MD5ba30336bf53d54ed3c0ea69dd545de8c
SHA1ce99c6724c75b93b7448e2d9fac16ca702a5711f
SHA2562d6988fb5afdaafc4e33fa1f71d6f10c95ab5a49a8ec820add5b13eef05439af
SHA512eea34ca526e03349e746d3687ea660b4748f0174fe2ffdb65161e232e08630b345e03329614852ce881a71362ba68575e9dd08fa361a416e5b2fb231e21a0a3e
-
Filesize
296B
MD526e2a9f7690ca2d35a4f8a18a2f12b34
SHA1224bed05d477ed319aa9344cd2074967fc6f29eb
SHA25647ead3fa2b001cbdaa37c5ce53a6b55afa208242e05bbc99fe333e8456a2fb49
SHA5125d9c464f609c744866cfdab192ce20a42e8a0e05366fcb3afd9f041abccd04b92f848fed43ecbde13f32669ff048681d11300c59f957fda1fb8a88d4cdd3c85c