Analysis
-
max time kernel
148s -
max time network
139s -
platform
android_x86 -
resource
android-x86-arm-20240624-en -
resource tags
androidarch:armarch:x86image:android-x86-arm-20240624-enlocale:en-usos:android-9-x86system -
submitted
07/11/2024, 04:36 UTC
Behavioral task
behavioral1
Sample
ทางรัฐ_2024-09-09.apk
Resource
android-x86-arm-20240624-en
General
-
Target
ทางรัฐ_2024-09-09.apk
-
Size
12.2MB
-
MD5
55c730ee53c5219d5560f0458f597b0c
-
SHA1
0502f8da6cdb72e4219d1419283822770e2f5dcb
-
SHA256
b7f463544f358f027da0fdb27632d8f6a693bb6dc1eebd452267573a675d3e2d
-
SHA512
3ee2fa06955d55b2689a25c5925efd87749db328c9330d90dcd99d51cbc6b5e7f46ea1969c065572a3aa0d44a08e830a71dbfeb5f355428f1ba2c645ab6b8ab1
-
SSDEEP
196608:RjnYPwZmu4xX7EJIHWC3+oGxLVnu/6EL5ko1iF+EiCOGBvE2XHU7gGt6BZXKE:RmrxX7EuHWsTmRny6ELT1/1UvdWgnXn
Malware Config
Signatures
-
Makes use of the framework's Accessibility service 4 TTPs 1 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
description ioc Process Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId com.easy.rometelchnology -
Queries account information for other applications stored on the device 1 TTPs 3 IoCs
Application may abuse the framework's APIs to collect account information stored on the device.
description ioc Process Framework service call android.accounts.IAccountManager.getAccountsAsUser com.easy.rometelchnology Framework service call android.accounts.IAccountManager.getAccountsAsUser com.easy.rometelchnology:main Framework service call android.accounts.IAccountManager.getAccountsAsUser com.easy.rometelchnology:s1 -
Queries information about running processes on the device 1 TTPs 3 IoCs
Application may abuse the framework's APIs to collect information about running processes on the device.
description ioc Process Framework service call android.app.IActivityManager.getRunningAppProcesses com.easy.rometelchnology Framework service call android.app.IActivityManager.getRunningAppProcesses com.easy.rometelchnology:main Framework service call android.app.IActivityManager.getRunningAppProcesses com.easy.rometelchnology:s1 -
Acquires the wake lock 1 IoCs
description ioc Process Framework service call android.os.IPowerManager.acquireWakeLock com.easy.rometelchnology -
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
description ioc Process Framework service call android.app.IActivityManager.setServiceForeground com.easy.rometelchnology -
Queries information about active data network 1 TTPs 1 IoCs
description ioc Process Framework service call android.net.IConnectivityManager.getActiveNetworkInfo com.easy.rometelchnology -
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
description ioc Process Framework service call android.app.IActivityManager.registerReceiver com.easy.rometelchnology -
Schedules tasks to execute at a specified time 1 TTPs 2 IoCs
Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.
description ioc Process Framework service call android.app.job.IJobScheduler.schedule com.easy.rometelchnology:main Framework service call android.app.job.IJobScheduler.schedule com.easy.rometelchnology -
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 3 IoCs
description ioc Process Framework API call javax.crypto.Cipher.doFinal com.easy.rometelchnology:s1 Framework API call javax.crypto.Cipher.doFinal com.easy.rometelchnology Framework API call javax.crypto.Cipher.doFinal com.easy.rometelchnology:main
Processes
-
com.easy.rometelchnology1⤵
- Makes use of the framework's Accessibility service
- Queries account information for other applications stored on the device
- Queries information about running processes on the device
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Queries information about active data network
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Schedules tasks to execute at a specified time
- Uses Crypto APIs (Might try to encrypt user data)
PID:4407 -
getprop ro.build.display.id2⤵PID:4826
-
-
getprop ro.build.display.id2⤵PID:4907
-
-
getprop ro.build.display.id2⤵PID:4938
-
-
getprop ro.build.display.id2⤵PID:4970
-
-
getprop ro.build.display.id2⤵PID:4990
-
-
getprop ro.build.display.id2⤵PID:5040
-
-
getprop ro.build.display.id2⤵PID:5068
-
-
getprop ro.build.display.id2⤵PID:5164
-
-
getprop ro.build.display.id2⤵PID:5224
-
-
getprop ro.build.display.id2⤵PID:5261
-
-
getprop ro.build.display.id2⤵PID:5281
-
-
getprop ro.build.display.id2⤵PID:5319
-
-
getprop ro.build.display.id2⤵PID:5351
-
-
getprop ro.build.display.id2⤵PID:5381
-
-
getprop ro.build.display.id2⤵PID:5427
-
-
getprop ro.build.display.id2⤵PID:5456
-
-
getprop ro.build.display.id2⤵PID:5475
-
-
getprop ro.build.display.id2⤵PID:5517
-
-
getprop ro.build.display.id2⤵PID:5546
-
-
getprop ro.build.display.id2⤵PID:5568
-
-
getprop ro.build.display.id2⤵PID:5607
-
-
getprop ro.build.display.id2⤵PID:5637
-
-
getprop ro.build.display.id2⤵PID:5656
-
-
getprop ro.build.display.id2⤵PID:5694
-
-
getprop ro.build.display.id2⤵PID:5728
-
-
getprop ro.build.display.id2⤵PID:5750
-
-
getprop ro.build.display.id2⤵PID:5789
-
-
getprop ro.build.display.id2⤵PID:5820
-
-
getprop ro.build.display.id2⤵PID:5839
-
-
com.easy.rometelchnology:main1⤵
- Queries account information for other applications stored on the device
- Queries information about running processes on the device
- Schedules tasks to execute at a specified time
- Uses Crypto APIs (Might try to encrypt user data)
PID:4646
-
com.easy.rometelchnology:s11⤵
- Queries account information for other applications stored on the device
- Queries information about running processes on the device
- Uses Crypto APIs (Might try to encrypt user data)
PID:4680
Network
-
Remote address:1.1.1.1:53Requestsemanticlocation-pa.googleapis.comIN AResponsesemanticlocation-pa.googleapis.comIN A142.250.178.10semanticlocation-pa.googleapis.comIN A142.250.180.10semanticlocation-pa.googleapis.comIN A172.217.169.42semanticlocation-pa.googleapis.comIN A172.217.16.234semanticlocation-pa.googleapis.comIN A142.250.179.234semanticlocation-pa.googleapis.comIN A142.250.200.42semanticlocation-pa.googleapis.comIN A216.58.204.74semanticlocation-pa.googleapis.comIN A142.250.187.234semanticlocation-pa.googleapis.comIN A142.250.200.10semanticlocation-pa.googleapis.comIN A216.58.212.202semanticlocation-pa.googleapis.comIN A172.217.169.74semanticlocation-pa.googleapis.comIN A216.58.212.234semanticlocation-pa.googleapis.comIN A216.58.201.106semanticlocation-pa.googleapis.comIN A142.250.187.202semanticlocation-pa.googleapis.comIN A216.58.213.10
-
Remote address:1.1.1.1:53Requestwww.baidu.comIN AResponsewww.baidu.comIN CNAMEwww.a.shifen.comwww.a.shifen.comIN CNAMEwww.wshifen.comwww.wshifen.comIN A103.235.46.96www.wshifen.comIN A103.235.47.188
-
Remote address:103.235.46.96:80RequestGET / HTTP/1.1
User-Agent: Dalvik/2.1.0 (Linux; U; Android 9; AOSP on IA Emulator Build/PSR1.180720.122)
Host: www.baidu.com
Connection: Keep-Alive
Accept-Encoding: gzip
ResponseHTTP/1.1 200 OK
Content-Length: 1108
Content-Type: text/html
Server: bfe
Date: Thu, 07 Nov 2024 04:36:58 GMT
-
Remote address:103.235.46.96:80RequestGET / HTTP/1.1
User-Agent: Dalvik/2.1.0 (Linux; U; Android 9; Pixel 2 Build/PSR1.180720.122)
Host: www.baidu.com
Connection: Keep-Alive
Accept-Encoding: gzip
ResponseHTTP/1.1 200 OK
Content-Length: 1108
Content-Type: text/html
Server: bfe
Date: Thu, 07 Nov 2024 04:37:00 GMT
-
Remote address:1.1.1.1:53Requestandroid.apis.google.comIN AResponseandroid.apis.google.comIN CNAMEclients.l.google.comclients.l.google.comIN A142.250.200.14
-
Remote address:103.235.46.96:80RequestGET / HTTP/1.1
User-Agent: Dalvik/2.1.0 (Linux; U; Android 9; Pixel 2 Build/PSR1.180720.122)
Host: www.baidu.com
Connection: Keep-Alive
Accept-Encoding: gzip
ResponseHTTP/1.1 200 OK
Content-Length: 1108
Content-Type: text/html
Server: bfe
Date: Thu, 07 Nov 2024 04:37:03 GMT
-
Remote address:103.235.46.96:80RequestGET / HTTP/1.1
User-Agent: Dalvik/2.1.0 (Linux; U; Android 9; Pixel 2 Build/PSR1.180720.122)
Host: www.baidu.com
Connection: Keep-Alive
Accept-Encoding: gzip
ResponseHTTP/1.1 200 OK
Content-Length: 1108
Content-Type: text/html
Server: bfe
Date: Thu, 07 Nov 2024 04:37:04 GMT
-
Remote address:1.1.1.1:53Requestrpc.dzky3.xyzIN AResponserpc.dzky3.xyzIN A54.255.6.196
-
Remote address:54.255.6.196:443RequestPOST /x/command-report?state=0&ty=3 HTTP/2.0
host: rpc.dzky3.xyz
version: 08310554-Rebuild
type: encryption
content-type: application/json; charset=UTF-8
content-length: 55
accept-encoding: gzip
user-agent: okhttp/4.11.0
ResponseHTTP/2.0 200
date: Thu, 07 Nov 2024 04:38:10 GMT
content-type: application/json; charset=UTF-8
content-length: 185
content-encoding: gzip
vary: Accept-Encoding
x-content-type-options: nosniff
x-frame-options: SAMEORIGIN
x-request-id: 1WGLYIB3IWg70rZBv8YrbHYXAKzaCBZQ
x-xss-protection: 1; mode=block
strict-transport-security: max-age=31536000
-
Remote address:54.255.6.196:443RequestPOST /x/command-report?state=0&ty=0 HTTP/2.0
host: rpc.dzky3.xyz
version: 08310554-Rebuild
type: encryption
content-type: application/json; charset=UTF-8
content-length: 55
accept-encoding: gzip
user-agent: okhttp/4.11.0
ResponseHTTP/2.0 200
date: Thu, 07 Nov 2024 04:38:10 GMT
content-type: application/json; charset=UTF-8
content-length: 185
content-encoding: gzip
vary: Accept-Encoding
x-content-type-options: nosniff
x-frame-options: SAMEORIGIN
x-request-id: BLVpe6HqWWWjl6M84sp1viC5ONkRhlGr
x-xss-protection: 1; mode=block
strict-transport-security: max-age=31536000
-
Remote address:54.255.6.196:443RequestPOST /x/command-report?state=0&ty=0 HTTP/2.0
host: rpc.dzky3.xyz
version: 08310554-Rebuild
type: encryption
content-type: application/json; charset=UTF-8
content-length: 55
accept-encoding: gzip
user-agent: okhttp/4.11.0
ResponseHTTP/2.0 200
date: Thu, 07 Nov 2024 04:38:39 GMT
content-type: application/json; charset=UTF-8
content-length: 185
content-encoding: gzip
vary: Accept-Encoding
x-content-type-options: nosniff
x-frame-options: SAMEORIGIN
x-request-id: 9NPDPEbky8h6pw2eauaBlWzD4a6GgK1v
x-xss-protection: 1; mode=block
strict-transport-security: max-age=31536000
-
Remote address:54.255.6.196:443RequestPOST /x/command-report?state=0&ty=3 HTTP/2.0
host: rpc.dzky3.xyz
version: 08310554-Rebuild
type: encryption
content-type: application/json; charset=UTF-8
content-length: 55
accept-encoding: gzip
user-agent: okhttp/4.11.0
ResponseHTTP/2.0 200
date: Thu, 07 Nov 2024 04:38:39 GMT
content-type: application/json; charset=UTF-8
content-length: 185
content-encoding: gzip
vary: Accept-Encoding
x-content-type-options: nosniff
x-frame-options: SAMEORIGIN
x-request-id: CtG3qDwUGhSOMtLtc40usU5i0eHYdYHe
x-xss-protection: 1; mode=block
strict-transport-security: max-age=31536000
-
Remote address:54.255.6.196:443RequestPOST /x/command-report?state=0&ty=0 HTTP/2.0
host: rpc.dzky3.xyz
version: 08310554-Rebuild
type: encryption
content-type: application/json; charset=UTF-8
content-length: 55
accept-encoding: gzip
user-agent: okhttp/4.11.0
ResponseHTTP/2.0 200
date: Thu, 07 Nov 2024 04:39:09 GMT
content-type: application/json; charset=UTF-8
content-length: 185
content-encoding: gzip
vary: Accept-Encoding
x-content-type-options: nosniff
x-frame-options: SAMEORIGIN
x-request-id: 0wvPyWj3B5Oi4Z10OWBuVXOpVx2xB7F0
x-xss-protection: 1; mode=block
strict-transport-security: max-age=31536000
-
Remote address:54.255.6.196:443RequestPOST /x/command-report?state=0&ty=3 HTTP/2.0
host: rpc.dzky3.xyz
version: 08310554-Rebuild
type: encryption
content-type: application/json; charset=UTF-8
content-length: 55
accept-encoding: gzip
user-agent: okhttp/4.11.0
ResponseHTTP/2.0 200
date: Thu, 07 Nov 2024 04:39:09 GMT
content-type: application/json; charset=UTF-8
content-length: 185
content-encoding: gzip
vary: Accept-Encoding
x-content-type-options: nosniff
x-frame-options: SAMEORIGIN
x-request-id: VO6jd2VLbFnt73dNZeAKj35PLoAufZDq
x-xss-protection: 1; mode=block
strict-transport-security: max-age=31536000
-
661 B 3.0kB 11 11
HTTP Request
GET http://www.baidu.com/HTTP Response
200 -
701 B 3.6kB 12 11
HTTP Request
GET http://www.baidu.com/HTTP Response
200 -
902 B 40 B 1 1
-
6.6kB 9.8kB 17 27
-
1.9kB 6.0kB 8 11
-
701 B 3.6kB 12 12
HTTP Request
GET http://www.baidu.com/HTTP Response
200 -
741 B 3.1kB 13 12
HTTP Request
GET http://www.baidu.com/HTTP Response
200 -
520 B 10
-
870 B 3.7kB 10 8
-
2.2kB 7.1kB 18 17
HTTP Request
POST https://rpc.dzky3.xyz/x/command-report?state=0&ty=3HTTP Request
POST https://rpc.dzky3.xyz/x/command-report?state=0&ty=0HTTP Response
200HTTP Response
200HTTP Request
POST https://rpc.dzky3.xyz/x/command-report?state=0&ty=0HTTP Request
POST https://rpc.dzky3.xyz/x/command-report?state=0&ty=3HTTP Response
200HTTP Response
200HTTP Request
POST https://rpc.dzky3.xyz/x/command-report?state=0&ty=0HTTP Request
POST https://rpc.dzky3.xyz/x/command-report?state=0&ty=3HTTP Response
200HTTP Response
200
-
3.7kB 11
-
80 B 320 B 1 1
DNS Request
semanticlocation-pa.googleapis.com
DNS Response
142.250.178.10142.250.180.10172.217.169.42172.217.16.234142.250.179.234142.250.200.42216.58.204.74142.250.187.234142.250.200.10216.58.212.202172.217.169.74216.58.212.234216.58.201.106142.250.187.202216.58.213.10
-
59 B 144 B 1 1
DNS Request
www.baidu.com
DNS Response
103.235.46.96103.235.47.188
-
69 B 109 B 1 1
DNS Request
android.apis.google.com
DNS Response
142.250.200.14
-
59 B 75 B 1 1
DNS Request
rpc.dzky3.xyz
DNS Response
54.255.6.196
MITRE ATT&CK Mobile v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
100KB
MD543d852535b91ed4570a3e754e56da094
SHA1dde469498b12e372b9aefee8c8141492351f8c87
SHA25650c4d4f814f7c897aeedd7ecfe75ffe86bfa7c2c07294ce870ed905da855e56f
SHA5124278f1822b7b193fc20296218f6a65c3af5cdd5b6accdeb2cdb9dd7451a6dce30fc96f4198a25c2a95e1ea316fe2a6fc3d7d905f99fc397410553bb26c6f774c
-
Filesize
32KB
MD5bb7df04e1b0a2570657527a7e108ae23
SHA15188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA256c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
SHA512768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012
-
Filesize
402KB
MD57e96659314d617916fba5fb3315b5f65
SHA15e16f6ed78ba928be36abf354c0bd6bc6249c598
SHA256524e369636c8f6ea894c0f18f5b7ddcca57fd11958d533795f00b72930077002
SHA512788935bbf87408575a8ecb5771c43966ec7b8239950b01b0c1ca11a662114c3afc5449e306b5b2c0d2d6885500bee57fc40b4f40d0d3238f82291dbf8d1834ed