Overview

overview

10

Static

static

10

9ebb60ada8...06.apk

android-9-x86

7

9ebb60ada8...06.apk

android-10-x64

7

9ebb60ada8...06.apk

android-11-x64

7

Analysis

  • max time kernel
    149s
  • max time network
    161s
  • platform
    android-11_x64
  • resource
    android-x64-arm64-20240910-en
  • resource tags

    arch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20240910-enlocale:en-usos:android-11-x64system
  • submitted
    11-11-2024 11:25

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    9ebb60ada8b19e06a92fc8c868959626deee355aef796c16f9e233f6d52c0306.apk

  • Size

    12.5MB

  • MD5

    12b92b000d9431c19864408c916e558b

  • SHA1

    79349cadfd9309806c398fba2dd6d5825f772a8a

  • SHA256

    9ebb60ada8b19e06a92fc8c868959626deee355aef796c16f9e233f6d52c0306

  • SHA512

    d11473dba6edba3a99cf732f90fc2b546321e4d137e023f065e74932b2d8d040593ea8c8f3fc2da9a8bf6d3b137bc2fdba83f0ac427795caf510de8372116bac

  • SSDEEP

    196608:Ia96xtqAw4Eo42eaAew7uySoImf7AMAr7+2LTaD2cUMYNkIuJtUZr2pvgXckYU:I1tVwD2tPoImEM92LTaKo7wipoMDU

Score
7/10
collectioncredential_accessevasionexecutionpersistence

Malware Config

Signatures

  • Makes use of the framework's Accessibility service 4 TTPs 1 IoCs

    Retrieves information displayed on the phone screen using AccessibilityService.

    collectionevasioncredential_access
  • Acquires the wake lock 1 IoCs
  • Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

    Application may abuse the framework's foreground service to continue running in the foreground.

    evasionpersistence
  • Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
    evasion
  • Schedules tasks to execute at a specified time 1 TTPs 1 IoCs

    Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.

    executionpersistence

Processes

  • com.tcmso.poms9000k
    1⤵
    • Makes use of the framework's Accessibility service
    • Acquires the wake lock
    • Makes use of the framework's foreground persistence service
    • Requests disabling of battery optimizations (often used to enable hiding in the background).
    • Schedules tasks to execute at a specified time
    PID:4598

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • /storage/emulated/0/Config/sys/apps/log/log-2024-11-11.txt
    Filesize

    20B

    MD5

    d6ea019461671ae729691261cbdb2e45

    SHA1

    980a183c51b94314887117d2d150883a42f83b84

    SHA256

    1ed4ca672c92b231ac046c50cb0b4f4b688104b9a318a48ae566cd2f0bf6d523

    SHA512

    d4329310857942f95628dedda7cf4d3f0e2c9f0dcaae56e048b40f803d940a0867d18f5f2f1931ffac45f179dccc3ad5fafdbf1ec9ae5fd0186ea64faf93fd91

    Download Submit