Analysis
-
max time kernel
149s -
max time network
151s -
platform
android_x86 -
resource
android-x86-arm-20240624-en -
resource tags
-
submitted
06-11-2024 04:19
General
-
Target
dcdf640e0eef93ff9708e73c461d98f30433770edd2a92f603c8e66f23cf77c1.apk
-
Size
4.4MB
-
MD5
bb08e80aec323b4d48fdab77cdb55e64
-
SHA1
4dfe47e30c12aa55916710595af5b4d9a566f7b8
-
SHA256
dcdf640e0eef93ff9708e73c461d98f30433770edd2a92f603c8e66f23cf77c1
-
SHA512
7fb11906ecb30b9965d2e62ec285375c2512c6b9d9258dd6f551bf963eeb91221f57249a19ae4fa72e00a7af8d35697ed332f4cb7bde18922b12df0f70df1e86
-
SSDEEP
98304:h+MmeDlnUvhrY8dvHgaffSm1jns0s1vYaMeZCmzVzBCTK0tIVwb3:HlnUvNYUvA3mdnPqYmtzyp93
Malware Config
Signatures
-
Makes use of the framework's Accessibility service 4 TTPs 1 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Acquires the wake lock 1 IoCs
-
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
-
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
-
Schedules tasks to execute at a specified time 1 TTPs 1 IoCs
Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.
Processes
-
muslim.begins.produced1⤵
- Makes use of the framework's Accessibility service
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Schedules tasks to execute at a specified time
Network
MITRE ATT&CK Mobile v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
13B
MD5de2c41a51ee9246eb1708f65b511add0
SHA12f442d634c8a18760a232c8829d4b5d74a52f074
SHA256ad2d914ca347cd1930e32f21c6d5448c34104bea181b93abc85ec518985653ab
SHA5127cdfbd001594503644e9ed80ae852f90ef9e841a8382e2eec6979e149a2c400a3b83055d205b4d1d66e1600e5127482932d5127eb5800d35a4ee5673fe34d84a
-
Filesize
21B
MD50de6a80ab77b4050a8a4363a240f6962
SHA1db860200fe4ed0acc53415efe4bdac0f827545d7
SHA256efadfde37f567c7bcb6272ff212c4a56c30d77f40d83b4af4d6f190f4e75d2a5
SHA512f098eca4922b320e5e0d46492c41f7c655c612a257f9cd0c433a96a0944aa01509b034c2255c142433dafd8e02c5630c8493703bd197f1f4d109670d5e7b1c79