Overview

overview

10

Static

static

10

33be0d70b0...1c.apk

android-9-x86

8

33be0d70b0...1c.apk

android-10-x64

8

33be0d70b0...1c.apk

android-11-x64

8

Analysis

  • max time kernel
    140s
  • max time network
    151s
  • platform
    android-11_x64
  • resource
    android-x64-arm64-20240910-en
  • resource tags

    arch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20240910-enlocale:en-usos:android-11-x64system
  • submitted
    06-11-2024 02:25

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    33be0d70b080e48f4dfb63a0e36c81633cdd4c767ebcd462f1b1515f494a2e1c.apk

  • Size

    1.9MB

  • MD5

    9136721b5fa07efb8f326eca03e7534e

  • SHA1

    0c93e6264aa644347f4d1166a97139268b88c875

  • SHA256

    33be0d70b080e48f4dfb63a0e36c81633cdd4c767ebcd462f1b1515f494a2e1c

  • SHA512

    fae73b9431df9ba4d73b7a2e585e9c393e00e2d09f7faea42f0eda63397fa9ee9742cae78e5b075a576fc883fefd3c1718d7a20979ebea90bb9e697a2230430d

  • SSDEEP

    12288:5GHQyuFIRTgMWb0hLeZ3ob5OuM5WrFFMK1YnU/:j3IRTgMWELeCb5OujMK1uU/

Score
8/10
collectioncredential_accessevasionexecutionpersistencestealthtrojan

Malware Config

Signatures

  • Removes its main activity from the application launcher 1 TTPs 1 IoCs
    stealthtrojanevasion
  • Makes use of the framework's Accessibility service 4 TTPs 1 IoCs

    Retrieves information displayed on the phone screen using AccessibilityService.

    collectionevasioncredential_access
  • Acquires the wake lock 1 IoCs
  • Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

    Application may abuse the framework's foreground service to continue running in the foreground.

    evasionpersistence
  • Schedules tasks to execute at a specified time 1 TTPs 1 IoCs

    Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.

    executionpersistence

Processes

  • rush.heroes.cattle
    1⤵
    • Removes its main activity from the application launcher
    • Makes use of the framework's Accessibility service
    • Acquires the wake lock
    • Makes use of the framework's foreground persistence service
    PID:4741
  • rush.heroes.cattle:remote
    1⤵
    • Schedules tasks to execute at a specified time
    PID:4888

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • /storage/emulated/0/Config/sys/apps/log/log-2024-11-06.txt
    Filesize

    29B

    MD5

    a63d0262702fb598cbf1dc7d48574025

    SHA1

    198309958c6707f92fb848fd3dd7c349667cf009

    SHA256

    78d0c3273f64c10a89600d16955873a4e0d95d9957c60b64f625c64eaab646bc

    SHA512

    546b8b343dfa9f9fcb0988f51d5c97f6686c52f5023f8dfd46006f237c326d72871845fdf67afd6711f114a5e75dec615378c028f1fd1493a4e4cf97658ad7b0

    Download Submit