Analysis
-
max time kernel
149s -
max time network
154s -
platform
android_x64 -
resource
android-x64-arm64-20240624-en -
resource tags
-
submitted
06-11-2024 03:22
General
-
Target
ab0f060436d72273ca8fe20dcadb157b4aa908ee09920d591f9a408c5e9b44f5.apk
-
Size
3.7MB
-
MD5
5a3be6fc5770833a89dd161f99a8524d
-
SHA1
bc2a646e7c9a434deaec6b0557d28550ec43d29f
-
SHA256
ab0f060436d72273ca8fe20dcadb157b4aa908ee09920d591f9a408c5e9b44f5
-
SHA512
adca2e008265e654753545b00e62540a015df7d1a5a67b66592a74e99d774f6b8a5a94432c5c37fb7fbe72d7e338e6aee74087d42f43f69a06033207bbca8539
-
SSDEEP
49152:J4ikEUeQTOeYqIzdGGaoX0cgZz3v1Yq0loidiJWpL6gMTVyRyR0fumz49:OTEzBlX0tZBYq0GikSL5MxT0fumz49
Malware Config
Signatures
-
Removes its main activity from the application launcher 1 TTPs 1 IoCs
-
Makes use of the framework's Accessibility service 4 TTPs 3 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
-
Acquires the wake lock 1 IoCs
-
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
-
Performs UI accessibility actions on behalf of the user 1 TTPs 8 IoCs
Application may abuse the accessibility service to prevent their removal.
-
Queries information about active data network 1 TTPs 1 IoCs
-
Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
-
Schedules tasks to execute at a specified time 1 TTPs 1 IoCs
Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.
Processes
-
jacob.mary.commission1⤵
- Removes its main activity from the application launcher
- Makes use of the framework's Accessibility service
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Performs UI accessibility actions on behalf of the user
- Queries information about active data network
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Schedules tasks to execute at a specified time
Network
MITRE ATT&CK Mobile v15
Defense Evasion
Foreground Persistence
1Hide Artifacts
2Suppress Application Icon
1User Evasion
1Impair Defenses
1Prevent Application Removal
1Input Injection
1Discovery
Software Discovery
1Security Software Discovery
1System Network Connections Discovery
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
41B
MD55ce34f170f2e7e424adfb91563ed3789
SHA1e7ffbfd66ac3dce87adb33a5948dd484ec2c1487
SHA256115e0d12c9bee432210e46acb1e8f5a4521da80deeef2cd674531283baa8ed50
SHA512a47d89b76ff82a53e38a4698868f529058f45d86a4e8594d3c69bb4ff1aa1763dee4ac5d0b459f0b6e0e05dfe98ae5ae575627015129632a9dbe941243a74f57
-
Filesize
41B
MD5283d3e1443110ee329aecd39d143ff75
SHA1ee1f22f01c5dea2a24cca332ddcff2b1e7eaf3e9
SHA256b465008ec6b3ee32030c0f8be3792ece674cafe4722375bc5f7a8bd32fae430b
SHA5121eb320c6eb041df53d4bde8bec8c9e73617804faee59452b24b3489604e2bb1860751c698027154c1c790781f3c4fe467b14e325a8427ebbbed346a21e281852
-
Filesize
25B
MD5ba30336bf53d54ed3c0ea69dd545de8c
SHA1ce99c6724c75b93b7448e2d9fac16ca702a5711f
SHA2562d6988fb5afdaafc4e33fa1f71d6f10c95ab5a49a8ec820add5b13eef05439af
SHA512eea34ca526e03349e746d3687ea660b4748f0174fe2ffdb65161e232e08630b345e03329614852ce881a71362ba68575e9dd08fa361a416e5b2fb231e21a0a3e
-
Filesize
292B
MD51bb224fac5d86b1ce7086cf0ce313868
SHA16b44e6b1cd608d62bceb2ee4ab78048c8a0b15dd
SHA256e6c638bf46468b7ced9ddb208d02a3dbc3852c29487d9bca2e9f6b92087ffd78
SHA5121706be7a413bf23c3aacd298a0f9e2ae19670efd19b35d11a793ac360b3ae009d8e8f8c34de09a70e95987990798876b93546b6d4a592d5cc47f1d43f95b9bdd