Analysis
-
max time kernel
149s -
max time network
150s -
platform
android-10_x64 -
resource
android-x64-20240910-en -
resource tags
-
submitted
10-11-2024 14:24
General
-
Target
com.baniiz.kedra.apk
-
Size
8.1MB
-
MD5
768c88c562e1c1c470811022f63084a6
-
SHA1
5899f34d5b3410215156a395f3431054a62d5821
-
SHA256
462c44e0dbd9b95cf3d33e284b72be2dbec175a174a5985b882d88614de50ad7
-
SHA512
eb90abb038bfa330716f059829b89512e0f66a0a5400cd22e110e44df8f09949f72875f5ffe4e8e79b3b94dfff7a6db2c6328f05a958ab0cca18ab726dbc32a0
-
SSDEEP
196608:Rl7z27o8h4otkBA4x2g8dxzhaLE++DGDeDgRi:Rlu084o4x2g8vIn+6y8I
Malware Config
Signatures
-
Makes use of the framework's Accessibility service 4 TTPs 1 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
-
Acquires the wake lock 1 IoCs
-
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
-
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
-
Schedules tasks to execute at a specified time 1 TTPs 1 IoCs
Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.
Processes
-
build.ledear.lycds1⤵
- Makes use of the framework's Accessibility service
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Schedules tasks to execute at a specified time
Network
MITRE ATT&CK Mobile v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
13B
MD5de2c41a51ee9246eb1708f65b511add0
SHA12f442d634c8a18760a232c8829d4b5d74a52f074
SHA256ad2d914ca347cd1930e32f21c6d5448c34104bea181b93abc85ec518985653ab
SHA5127cdfbd001594503644e9ed80ae852f90ef9e841a8382e2eec6979e149a2c400a3b83055d205b4d1d66e1600e5127482932d5127eb5800d35a4ee5673fe34d84a
-
Filesize
33B
MD54a6d8d7e309a7e0e57c43858d5808666
SHA1bcfefe9407b9b1464b3fdc5c2daf4d28006e31e8
SHA2561d3b3b700fb12533276cb469bd75ec44f6a5b6f6eb238824a8151e9286931460
SHA51265d414fc07d6b46a03c0dc2d513189a4ab29f87517086068eae5ca45dde0b4d61453edb89f2c123dd579945f0294451dc0d74d2a66652ee424e54356480faeb7
-
Filesize
29B
MD535029f704c2e9f54f09f7c4fcf958b6e
SHA1aa90baf4fed34a19f1f4ddfc5b6a19283b1e350a
SHA256e2bf173eec817dae170486929e35843a356b13c3e95a16d1e95a50251b8b8747
SHA51288fd229b2531bccc0f60a11440d8c700b518076351183640a69e4eb9a2c534d40a4d8a5f60f1e7d0788b4836b6311c0e6f9087229dd398d0a1a91e2623dccfd7
-
Filesize
57B
MD517c1690a4556b7b73496094bace3d9b3
SHA1f5a027ab7edfa20672f505bfb6d3da9c96103555
SHA2560e5a72e6d5a664254e007a8c564f8a4866b51b8928f5b0ab82b86d937a371b46
SHA5126628bd2adf078e4dd7c5cbc541c851bad34dd3bf974f557b823d392174a4cffabdbfbd0711a744c570945581363c0b4da0316c8e8f01aafba9961174c732ae14