Analysis
- max time kernel
131s - max time network
150s - platform
android-11_x64 - resource
android-x64-arm64-20240910-en - resource tags
arch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20240910-enlocale:en-usos:android-11-x64system - submitted
08/11/2024, 22:47
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
9ae6d9b2af4dfa5de6859c987fcd7fc95910135d503c0efac8e7efd31f869862.apk
Resource
android-x86-arm-20240910-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
9ae6d9b2af4dfa5de6859c987fcd7fc95910135d503c0efac8e7efd31f869862.apk
Resource
android-x64-20240624-en
4 signatures
150 seconds
Behavioral task
behavioral3
Sample
9ae6d9b2af4dfa5de6859c987fcd7fc95910135d503c0efac8e7efd31f869862.apk
Resource
android-x64-arm64-20240910-en
3 signatures
150 seconds
General
- Target 9ae6d9b2af4dfa5de6859c987fcd7fc95910135d503c0efac8e7efd31f869862.apk
- Size 4.0MB
- Sample241108-2q2s1straq
- SHA256 9ae6d9b2af4dfa5de6859c987fcd7fc95910135d503c0efac8e7efd31f869862
- MD5 df00613fff72fe43c0f36b5e34851d83
- SHA1 d6bf9c76f016ef228dc2da676853f0dda447d811
- SHA512 503221bb695e97f4852468f4b74a806a0ffd9cacb8f3cf276fed92fe572e208feb273372aa542d8c662e286dfc98cbcd3517b605d0e7097c942fe264b927e67d
- SSDEEP 98304:FT0nGD8yi4nDcavEir9IBYCt5Je96I0HBY8ct2vsCeods:FAGwyVwgSBwUI0HktYXds
- MD5 SHA1 SHA512 SSDEEP
Score
7/10
Malware Config
Signatures
- Loads dropped Dex/Jar 1 TTPs 1 IoCs
Runs executable file dropped to the device during analysis.
ioc pid Process /data/user/0/com.will.govern/app_alert/pt.json 4795 com.will.govern - Acquires the wake lock 1 IoCs
description ioc Process Framework service call android.os.IPowerManager.acquireWakeLock com.will.govern - Performs UI accessibility actions on behalf of the user 1 TTPs 1 IoCs
Application may abuse the accessibility service to prevent their removal.
ioc Process android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction com.will.govern
Processes
Network
MITRE ATT&CK Mobile v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path /data/data/com.will.govern/app_alert/oat/pt.json.cur.prof
- Size 4KB
- SHA256 02138c58b4b825b4e3bf05f73f90a4d0d65270b3b2db0179bb64c2365637143b
- MD5 9b7c82e2e6cff3b05745f63d6c7a8f50
- SHA1 bf9556c9049f12af58823df168077c4ea81d451b
- SHA512 e6a58663f0dccf3a0cbf131a32b9b9b90cbd360f1eefd0b367e8078fb4e048ed49bfd5005550b9d281d2b51c5c3aacf2533966223eccf1beed772b9ff96824f7
- SSDEEP 96:Rxf+5Zh1K2mgd/v3L91eA/lLdD2djLoNLsSjYicrXcNw:rQh82mM3L9dBDoLm5EioXQw
- MD5 SHA1 SHA512 SSDEEP
- Path /data/data/com.will.govern/app_alert/pt.json
- Size 1.8MB
- SHA256 cdb583e4aa7cabc15e676e76865276a21973fde7f604df4d6f375ee9385c2ac9
- MD5 29a2fbb86f7026bf38a93d3c57a5279f
- SHA1 f8d1a529649e815d527e48512fc371cf9d92e773
- SHA512 bddcec6548e9912f57cff896e1be8e9dc6c04bd815f14df2a857b0c6fbd3abbd7ea65ebe2b131f7ad6dcec14cdf7134ee37b603ae423b6f51590673d21558f3f
- SSDEEP 49152:U+aFYkkYS322JOxGY8SuE0TrC0617B+uU8N0GkMsuVsX:kFYNYS3zJGTOE0TrC0IdUxIsX
- MD5 SHA1 SHA512 SSDEEP
- Path /data/data/com.will.govern/app_alert/pt.json
- Size 1.8MB
- SHA256 f9dcb0ff2157e9aedfbe865db025a575995e20e764642868f123d228b03a8b5e
- MD5 56a7266d00dee1a73e5076bc097a9f86
- SHA1 e9e6b56cad83f4ee60dc1c8255b614125c732bf2
- SHA512 1168631fb8cfc48dd24d43450bafd9c4247e776feaf910741abb887ca7665f10e55bf0b858637c727235110400f0ae342e6ccbdf45fe5f880c387afdd6845500
- SSDEEP 49152:20Z9xgan2iJbiDoPk4ZcBfEdmX8qc4sjROqps/reXBl2BO46i:20ZYan2ebpL+idkDhs/2632BO46i
- MD5 SHA1 SHA512 SSDEEP
- Path /data/user/0/com.will.govern/app_alert/pt.json
- Size 4.8MB
- SHA256 703dce273b76951339c3adfc7d01464f06ce05cd30b0f8f821e004e7a0ce794c
- MD5 a5f760e0e613f93d07a145d731d57b87
- SHA1 b1467e8dd5a4f24f050759aa4a31383100015a94
- SHA512 e127b9e8c38331e6bf241d81121e46086588a36dea7f64a4d1751286ee28c552dba618e9c96d07f25e9d02ed69a4fe59e2ddaa810c5f3d2d85ab470f924c6597
- SSDEEP 49152:BRTMjrEVhyft3EaqukHyxzfLY88pCLVFJnRgk5TExEDEDOHSImhWMFiJ1RPWNLq6:TTc+yfEUhR4xEDEDOHpm9Fo4
- MD5 SHA1 SHA512 SSDEEP