6db38d31b7d4161d6481d36d63beb4c4334af0ab052215b7e7b00cb1b4ca29d9

Analysis

max time kernel
148s
max time network
139s
platform
android_x86
resource
android-x86-arm-20240624-en
resource tags

androidarch:armarch:x86image:android-x86-arm-20240624-enlocale:en-usos:android-9-x86system
submitted
06/11/2024, 02:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
6db38d31b7d4161d6481d36d63beb4c4334af0ab052215b7e7b00cb1b4ca29d9.apk
Size 12.4MB
Sample241106-dbwfpasnhx
SHA256 6db38d31b7d4161d6481d36d63beb4c4334af0ab052215b7e7b00cb1b4ca29d9
MD5 52ccf4cbfcc91f7b2a3bdb9802fc8bc1
SHA1 834825ff5f0e18c6f460f21e952e211089a06f7f
SHA512 63d958da4f1ee8bbcb617f3d61b30a0c14832320c2f2ade2d48668880c818614d43ceea371b86788412e0f6c4398a93017dc08c5940d696ab1af54f8e9dbafa3
SSDEEP 196608:8AEP4dDuuFxXkM9U2WWGJ22TFlgfsi8EtYCa+Az99mrCVTkpdAq0KcF3KMOgbZST:yQ3xXkMDWruYIY7+Az9f8deZGg9QX7
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

collection credential_access discovery evasion execution impact persistence

Malware Config

Signatures

Makes use of the framework's Accessibility service 4 TTPs 1 IoCs

Retrieves information displayed on the phone screen using AccessibilityService.

collection evasion credential_access

Input Injection

T1516

Screen Capture

T1513

Keylogging

T1417.001

GUI Input Capture

T1417.002

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	com.sextest.test

Queries account information for other applications stored on the device 1 TTPs 3 IoCs

Application may abuse the framework's APIs to collect account information stored on the device.

collection

Stored Application Data

T1409

description	ioc	Process
Framework service call	android.accounts.IAccountManager.getAccountsAsUser	com.sextest.test:main
Framework service call	android.accounts.IAccountManager.getAccountsAsUser	com.sextest.test:s1
Framework service call	android.accounts.IAccountManager.getAccountsAsUser	com.sextest.test

Queries information about running processes on the device 1 TTPs 3 IoCs

Application may abuse the framework's APIs to collect information about running processes on the device.

discovery

Process Discovery

T1424

description	ioc	Process
Framework service call	android.app.IActivityManager.getRunningAppProcesses	com.sextest.test
Framework service call	android.app.IActivityManager.getRunningAppProcesses	com.sextest.test:main
Framework service call	android.app.IActivityManager.getRunningAppProcesses	com.sextest.test:s1

Acquires the wake lock 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.sextest.test

Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

Application may abuse the framework's foreground service to continue running in the foreground.

evasion persistence

Foreground Persistence

T1541

description	ioc	Process
Framework service call	android.app.IActivityManager.setServiceForeground	com.sextest.test

Queries information about active data network 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.sextest.test

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs

persistence

Broadcast Receivers

T1624.001

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	com.sextest.test

Schedules tasks to execute at a specified time 1 TTPs 2 IoCs

Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.

execution persistence

Scheduled Task/Job

T1603

description	ioc	Process
Framework service call	android.app.job.IJobScheduler.schedule	com.sextest.test:main
Framework service call	android.app.job.IJobScheduler.schedule	com.sextest.test

Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 3 IoCs

impact

Data Encrypted for Impact

T1471

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	com.sextest.test:main
Framework API call	javax.crypto.Cipher.doFinal	com.sextest.test:s1
Framework API call	javax.crypto.Cipher.doFinal	com.sextest.test

com.sextest.test
1⤵
- Makes use of the framework's Accessibility service
- Queries account information for other applications stored on the device
- Queries information about running processes on the device
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Queries information about active data network
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Schedules tasks to execute at a specified time
- Uses Crypto APIs (Might try to encrypt user data)
PID:4307
- getprop ro.build.display.id
  2⤵
  PID:4717
- getprop ro.build.display.id
  2⤵
  PID:4831
- getprop ro.build.display.id
  2⤵
  PID:4862
- getprop ro.build.display.id
  2⤵
  PID:4894
- getprop ro.build.display.id
  2⤵
  PID:4916
- getprop ro.build.display.id
  2⤵
  PID:4955
- getprop ro.build.display.id
  2⤵
  PID:4980
- getprop ro.build.display.id
  2⤵
  PID:5010
- getprop ro.build.display.id
  2⤵
  PID:5127
- getprop ro.build.display.id
  2⤵
  PID:5156
- getprop ro.build.display.id
  2⤵
  PID:5176
- getprop ro.build.display.id
  2⤵
  PID:5215
- getprop ro.build.display.id
  2⤵
  PID:5241
- getprop ro.build.display.id
  2⤵
  PID:5267
- getprop ro.build.display.id
  2⤵
  PID:5314
- getprop ro.build.display.id
  2⤵
  PID:5339
- getprop ro.build.display.id
  2⤵
  PID:5360
- getprop ro.build.display.id
  2⤵
  PID:5399
- getprop ro.build.display.id
  2⤵
  PID:5430
- getprop ro.build.display.id
  2⤵
  PID:5448
- getprop ro.build.display.id
  2⤵
  PID:5487
- getprop ro.build.display.id
  2⤵
  PID:5520
- getprop ro.build.display.id
  2⤵
  PID:5543
- getprop ro.build.display.id
  2⤵
  PID:5578
- getprop ro.build.display.id
  2⤵
  PID:5617
- getprop ro.build.display.id
  2⤵
  PID:5635
- getprop ro.build.display.id
  2⤵
  PID:5681
- getprop ro.build.display.id
  2⤵
  PID:5721
- getprop ro.build.display.id
  2⤵
  PID:5742

com.sextest.test:main
1⤵
- Queries account information for other applications stored on the device
- Queries information about running processes on the device
- Schedules tasks to execute at a specified time
- Uses Crypto APIs (Might try to encrypt user data)
PID:4401

com.sextest.test:s1
1⤵
- Queries account information for other applications stored on the device
- Queries information about running processes on the device
- Uses Crypto APIs (Might try to encrypt user data)
PID:4423

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Scheduled Task/Job

T1603

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Foreground Persistence

T1541

Scheduled Task/Job

T1603

Privilege Escalation

Defense Evasion

Foreground Persistence

T1541

Input Injection

T1516

Credential Access

Input Capture

T1417

GUI Input Capture

T1417.002

Keylogging

T1417.001

Discovery

Process Discovery

T1424

System Network Connections Discovery

T1421

Lateral Movement

Collection

Input Capture

T1417

GUI Input Capture

T1417.002

Keylogging

T1417.001

Screen Capture

T1513

Stored Application Data

T1409

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

T1471

Input Injection

T1516

Replay Monitor

Loading Replay Monitor...

Downloads

androidx.work.workdb

Path /data/data/com.sextest.test/no_backup/androidx.work.workdb
Size 100KB
SHA256 73b3e14a7f97d072a3a4c63ad83ad272d860629cc08c59a9aecf01715c4d6e49
MD5 0d8545b489aa548bea8c1ec7bac4315f
SHA1 2c72d4f54f7f3e44703bcf6fac77f02bb6c06f4b
SHA512 38551fa2723b67c147119092e34104990bc79e9d7795374bd30dd9c502a491fd4aaaa190ba3914403a24282d0313c5feafb945eb0488e4304b36d60dad3bb9bb
SSDEEP 384:nH1DtYa1DtYM1DtYO1DtYVndjnHt9S/f8JzSk6D86T0ED:nVDtYkDtYaDtYIDtYVxHSsJzSk6D86ZD
MD5 SHA1 SHA512 SSDEEP

Submit Download

androidx.work.workdb-shm

Path /data/data/com.sextest.test/no_backup/androidx.work.workdb-shm
Size 32KB
SHA256 c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
MD5 bb7df04e1b0a2570657527a7e108ae23
SHA1 5188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA512 768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012
SSDEEP 3::
MD5 SHA1 SHA512 SSDEEP

Submit Download

androidx.work.workdb-wal

Path /data/data/com.sextest.test/no_backup/androidx.work.workdb-wal
Size 402KB
SHA256 6206b90cf9cdbd894abe5d03ffc97635381bef35012cd46bb23b5ab3b32f4440
MD5 bc19ab9cb815c8762574491e4eed8f94
SHA1 a1d0a844362fd8033c5dbbaa68692e15bc46fe98
SHA512 2b390c8346b4761d4115e0229f2a4fa57889cbed45f6f3740c1f2bebd6a5ca44fa8d4262a241f930dbd31505299678063e352df55f1f028649e143d9b00f9baf
SSDEEP 6144:ccHhHh3HhH03HhHX3HhHBm3HhHCy3HhHoy3HhH8y3HhH6Fy3HhHjly3HhHaly3HY:L
MD5 SHA1 SHA512 SSDEEP

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads