Analysis
-
max time kernel
149s -
max time network
150s -
platform
android_x86 -
resource
android-x86-arm-20240624-en -
resource tags
-
submitted
06-11-2024 03:22
General
-
Target
ab0f060436d72273ca8fe20dcadb157b4aa908ee09920d591f9a408c5e9b44f5.apk
-
Size
3.7MB
-
MD5
5a3be6fc5770833a89dd161f99a8524d
-
SHA1
bc2a646e7c9a434deaec6b0557d28550ec43d29f
-
SHA256
ab0f060436d72273ca8fe20dcadb157b4aa908ee09920d591f9a408c5e9b44f5
-
SHA512
adca2e008265e654753545b00e62540a015df7d1a5a67b66592a74e99d774f6b8a5a94432c5c37fb7fbe72d7e338e6aee74087d42f43f69a06033207bbca8539
-
SSDEEP
49152:J4ikEUeQTOeYqIzdGGaoX0cgZz3v1Yq0loidiJWpL6gMTVyRyR0fumz49:OTEzBlX0tZBYq0GikSL5MxT0fumz49
Malware Config
Signatures
-
Makes use of the framework's Accessibility service 4 TTPs 3 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
-
Acquires the wake lock 1 IoCs
-
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
-
Performs UI accessibility actions on behalf of the user 1 TTPs 4 IoCs
Application may abuse the accessibility service to prevent their removal.
-
Queries information about active data network 1 TTPs 1 IoCs
-
Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
-
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
-
Schedules tasks to execute at a specified time 1 TTPs 1 IoCs
Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.
Processes
-
jacob.mary.commission1⤵
- Makes use of the framework's Accessibility service
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Performs UI accessibility actions on behalf of the user
- Queries information about active data network
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Schedules tasks to execute at a specified time
Network
MITRE ATT&CK Mobile v15
Persistence
Event Triggered Execution
1Broadcast Receivers
1Foreground Persistence
1Scheduled Task/Job
1Defense Evasion
Foreground Persistence
1Hide Artifacts
1User Evasion
1Impair Defenses
1Prevent Application Removal
1Input Injection
1Discovery
Software Discovery
1Security Software Discovery
1System Network Connections Discovery
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
41B
MD5283d3e1443110ee329aecd39d143ff75
SHA1ee1f22f01c5dea2a24cca332ddcff2b1e7eaf3e9
SHA256b465008ec6b3ee32030c0f8be3792ece674cafe4722375bc5f7a8bd32fae430b
SHA5121eb320c6eb041df53d4bde8bec8c9e73617804faee59452b24b3489604e2bb1860751c698027154c1c790781f3c4fe467b14e325a8427ebbbed346a21e281852
-
Filesize
25B
MD5ba30336bf53d54ed3c0ea69dd545de8c
SHA1ce99c6724c75b93b7448e2d9fac16ca702a5711f
SHA2562d6988fb5afdaafc4e33fa1f71d6f10c95ab5a49a8ec820add5b13eef05439af
SHA512eea34ca526e03349e746d3687ea660b4748f0174fe2ffdb65161e232e08630b345e03329614852ce881a71362ba68575e9dd08fa361a416e5b2fb231e21a0a3e
-
Filesize
292B
MD5c7e915362b1e8f152b5e0f85447a3450
SHA127067aae8971e9481ebd56002f775200875aa8a8
SHA2562af813ac15f2b5883ee24ecef20cef19f072204b115b45b65bbab38ab25d19b0
SHA51213c737ce62623c92524fbd9f334fa6195231bfd94703898478b1cd7f1a37e159b2bfdc9f5e1b5db742df231e06c45c33a5b0216a0d537cd1e9638845d0bbe583
-
Filesize
57B
MD53af69119804d1d999d56d230338ffd36
SHA169350826205583c8acc385ee0a6e3fc2673ee2ca
SHA25610994862cb263ab6b1e4428cc24cc9c585458fc67544fe0f5dfea81a5a7a115c
SHA5124a41b19d28f637b397d9dff225621694c44c750a9bd65f3e6ad5d3b9acf0d118910ddf53d4618213f9e14c61e0fb154f33f2747dd3b8d50459990767f42fc8cb