Analysis
-
max time kernel
149s -
max time network
149s -
platform
android-10_x64 -
resource
android-x64-20240910-en -
resource tags
-
submitted
06-11-2024 03:49
General
-
Target
e23f0cc174648fc57ab64d6f63f63c5a77c3307798cc3aeadba5ef1753bd3815.apk
-
Size
3.7MB
-
MD5
cf5d143826ef6d50a184c6e5d06349c4
-
SHA1
5467de524cc720f6144586c1ce93776fa8306aac
-
SHA256
e23f0cc174648fc57ab64d6f63f63c5a77c3307798cc3aeadba5ef1753bd3815
-
SHA512
a8f030729f8436d47bda2eb1609714b3a3ec6f6906cf65624743899a072ee7e9eb094146796e57940cea5fbd4752181144fabbeaecb855279b2a460ea4e199a2
-
SSDEEP
98304:VE00uJ+xP+p4uyn0P0y8DRIoXnRmmzvzBtT+0tMK2:y006P2nKJ8NI6zrle
Malware Config
Signatures
-
Makes use of the framework's Accessibility service 4 TTPs 3 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs
Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
-
Acquires the wake lock 1 IoCs
-
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
-
Queries information about active data network 1 TTPs 1 IoCs
-
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
-
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
-
Schedules tasks to execute at a specified time 1 TTPs 1 IoCs
Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.
-
Checks CPU information 2 TTPs 1 IoCs
-
Checks memory information 2 TTPs 1 IoCs
Processes
-
rick.ima.prompt1⤵
- Makes use of the framework's Accessibility service
- Obtains sensitive information copied to the device clipboard
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Queries information about active data network
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Schedules tasks to execute at a specified time
- Checks CPU information
- Checks memory information
Network
MITRE ATT&CK Mobile v15
Persistence
Event Triggered Execution
1Broadcast Receivers
1Foreground Persistence
1Scheduled Task/Job
1Defense Evasion
Foreground Persistence
1Input Injection
1Virtualization/Sandbox Evasion
2System Checks
2Credential Access
Clipboard Data
1Input Capture
2GUI Input Capture
1Keylogging
1Discovery
System Information Discovery
2System Network Configuration Discovery
1System Network Connections Discovery
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
37B
MD5018b3d77f1d2e610b73da67b99b2e8ac
SHA161a86e311d7112cf80b019b3c7eae7e609147354
SHA256aaed5282ca8510aa2917d7854cd3f3df6c8810729d7e9ea074ca1fff3d896805
SHA51215dbc60b472d44ca00a64abf65339e25e3f68b62fc4c8a3b6286c648ac6ffcd9e454484a3e06bd013a04e91b5ab3e6b586a5fa8077e46570a4eda15553faa347
-
Filesize
25B
MD5ba30336bf53d54ed3c0ea69dd545de8c
SHA1ce99c6724c75b93b7448e2d9fac16ca702a5711f
SHA2562d6988fb5afdaafc4e33fa1f71d6f10c95ab5a49a8ec820add5b13eef05439af
SHA512eea34ca526e03349e746d3687ea660b4748f0174fe2ffdb65161e232e08630b345e03329614852ce881a71362ba68575e9dd08fa361a416e5b2fb231e21a0a3e
-
Filesize
288B
MD58d214ae704bc0c44da7c65015d5595d3
SHA18da188f6115cba250d2bbd26afb21dda18c48ed0
SHA2560baf8be087d2905f6353a6cb77f5cc3b9844efeb93b83e27a7264a7a96090e56
SHA5122d74077ef3f3ae3f4970d3af9e8d00d9770afeaf6ea64902626b423f3795887f007866a9b6859d7489c1a1b97d4ed85555164843fd9d48a8bf5aeb9f3c5a3fe0
-
Filesize
57B
MD5784b7a0452be214bc49d40266e1490c5
SHA10fd66c07e25c7bfd3183697fa080c5375bfb0ebf
SHA256b2ade053f1423b8026e191933217cee950d5e534581879e9e2985e80688d49cd
SHA51221dad8aa77ef868f6ff0230afcba3546d6874bc6654033e5eac2e1456834d0ee45140d8dc986a889081c76ecfd6054598ce63828986ce57ff0438911721f5e41