Analysis
-
max time kernel
149s -
max time network
151s -
platform
android-11_x64 -
resource
android-x64-arm64-20240910-en -
resource tags
arch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20240910-enlocale:en-usos:android-11-x64system -
submitted
10/11/2024, 14:24 UTC
Behavioral task
behavioral1
Sample
com.baniiz.kedra.apk
Resource
android-x64-20240910-en
Behavioral task
behavioral2
Sample
com.baniiz.kedra.apk
Resource
android-x64-arm64-20240910-en
Behavioral task
behavioral3
Sample
com.baniiz.kedra.apk
Resource
android-33-x64-arm64-20240624-en
Behavioral task
behavioral4
Sample
com.baniiz.kedra.apk
Resource
android-x86-arm-20240910-en
Behavioral task
behavioral5
Sample
com.baniiz.kedra.apk
Resource
ubuntu2204-amd64-20240611-en
General
-
Target
com.baniiz.kedra.apk
-
Size
8.1MB
-
MD5
768c88c562e1c1c470811022f63084a6
-
SHA1
5899f34d5b3410215156a395f3431054a62d5821
-
SHA256
462c44e0dbd9b95cf3d33e284b72be2dbec175a174a5985b882d88614de50ad7
-
SHA512
eb90abb038bfa330716f059829b89512e0f66a0a5400cd22e110e44df8f09949f72875f5ffe4e8e79b3b94dfff7a6db2c6328f05a958ab0cca18ab726dbc32a0
-
SSDEEP
196608:Rl7z27o8h4otkBA4x2g8dxzhaLE++DGDeDgRi:Rlu084o4x2g8vIn+6y8I
Malware Config
Signatures
-
Makes use of the framework's Accessibility service 4 TTPs 1 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
description ioc Process Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId build.ledear.lycds -
Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
-
Acquires the wake lock 1 IoCs
description ioc Process Framework service call android.os.IPowerManager.acquireWakeLock build.ledear.lycds -
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
description ioc Process Framework service call android.app.IActivityManager.setServiceForeground build.ledear.lycds -
Schedules tasks to execute at a specified time 1 TTPs 1 IoCs
Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.
description ioc Process Framework service call android.app.job.IJobScheduler.schedule build.ledear.lycds
Processes
Network
-
Remote address:1.1.1.1:53Requestandroid.apis.google.comIN AResponseandroid.apis.google.comIN CNAMEclients.l.google.comclients.l.google.comIN A142.250.178.14
-
Remote address:1.1.1.1:53Requestwww.youtube.comIN AResponsewww.youtube.comIN CNAMEyoutube-ui.l.google.comyoutube-ui.l.google.comIN A142.250.179.238youtube-ui.l.google.comIN A216.58.213.14youtube-ui.l.google.comIN A216.58.212.206youtube-ui.l.google.comIN A142.250.178.14youtube-ui.l.google.comIN A172.217.16.238youtube-ui.l.google.comIN A142.250.200.46youtube-ui.l.google.comIN A142.250.180.14youtube-ui.l.google.comIN A142.250.187.238youtube-ui.l.google.comIN A172.217.169.14youtube-ui.l.google.comIN A216.58.201.110youtube-ui.l.google.comIN A142.250.200.14youtube-ui.l.google.comIN A142.250.187.206youtube-ui.l.google.comIN A216.58.204.78youtube-ui.l.google.comIN A216.58.212.238youtube-ui.l.google.comIN A172.217.169.46
-
Remote address:1.1.1.1:53Requestwww.google.comIN AResponsewww.google.comIN A142.250.178.4
-
695 B 40 B 1 1
-
1.1kB 4.5kB 9 7
-
3.7kB 6.8kB 16 14
-
2.6kB 6.2kB 12 11
-
2.0kB 8.2kB 16 13
-
128 B 40 B 2 1
-
360 B 6
-
360 B 6
-
300 B 5
-
1.4kB 5.4kB 11 10
-
135 B 40 B 2 1
-
128 B 40 B 2 1
-
135 B 40 B 2 1
-
128 B 40 B 2 1
-
3.8kB 12
-
69 B 109 B 1 1
DNS Request
android.apis.google.com
DNS Response
142.250.178.14
-
61 B 335 B 1 1
DNS Request
www.youtube.com
DNS Response
142.250.179.238216.58.213.14216.58.212.206142.250.178.14172.217.16.238142.250.200.46142.250.180.14142.250.187.238172.217.169.14216.58.201.110142.250.200.14142.250.187.206216.58.204.78216.58.212.238172.217.169.46
-
1.4kB 54 B 1 1
-
60 B 76 B 1 1
DNS Request
www.google.com
DNS Response
142.250.178.4
MITRE ATT&CK Mobile v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
13B
MD5de2c41a51ee9246eb1708f65b511add0
SHA12f442d634c8a18760a232c8829d4b5d74a52f074
SHA256ad2d914ca347cd1930e32f21c6d5448c34104bea181b93abc85ec518985653ab
SHA5127cdfbd001594503644e9ed80ae852f90ef9e841a8382e2eec6979e149a2c400a3b83055d205b4d1d66e1600e5127482932d5127eb5800d35a4ee5673fe34d84a
-
Filesize
33B
MD54a6d8d7e309a7e0e57c43858d5808666
SHA1bcfefe9407b9b1464b3fdc5c2daf4d28006e31e8
SHA2561d3b3b700fb12533276cb469bd75ec44f6a5b6f6eb238824a8151e9286931460
SHA51265d414fc07d6b46a03c0dc2d513189a4ab29f87517086068eae5ca45dde0b4d61453edb89f2c123dd579945f0294451dc0d74d2a66652ee424e54356480faeb7