Analysis
-
max time kernel
149s -
max time network
156s -
platform
android_x86 -
resource
android-x86-arm-20240624-en -
resource tags
-
submitted
11-11-2024 11:25
General
-
Target
97cf6752734816208ff03eea523825bcfc7270d52d8c5f0f02951236885e0403.apk
-
Size
12.5MB
-
MD5
42ad0ff73e0b4295a4ae2ca600b9e5fa
-
SHA1
7dd9260843bb1ee8613fc2eb913e776b4c0fcbb4
-
SHA256
97cf6752734816208ff03eea523825bcfc7270d52d8c5f0f02951236885e0403
-
SHA512
59efd73b3eb3ff2a17bf88b42575d142fd54c9eda6eb5316444efa14c1980991e11e1780ea3f71d082d5bef7ec74fe023d221ed962b083650ed9f4c6ffc766ee
-
SSDEEP
196608:mAgbdVg7aNmVAcIro36mugUFcs1Pohd2r7+2Lejjd/1dTWr2pRCYgY8:mAg5N8Atro78cskT2LijZHWipRFP8
Malware Config
Signatures
-
Makes use of the framework's Accessibility service 4 TTPs 1 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Acquires the wake lock 1 IoCs
-
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
-
Requests changing the default SMS application. 2 TTPs 1 IoCs
-
Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
-
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
-
Schedules tasks to execute at a specified time 1 TTPs 1 IoCs
Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.
Processes
-
com.shes.maox3000k1⤵
- Makes use of the framework's Accessibility service
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Requests changing the default SMS application.
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Schedules tasks to execute at a specified time
Network
MITRE ATT&CK Mobile v15
Persistence
Event Triggered Execution
1Broadcast Receivers
1Foreground Persistence
1Scheduled Task/Job
1Defense Evasion
Foreground Persistence
1Hide Artifacts
1User Evasion
1Input Injection
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
20B
MD5d6ea019461671ae729691261cbdb2e45
SHA1980a183c51b94314887117d2d150883a42f83b84
SHA2561ed4ca672c92b231ac046c50cb0b4f4b688104b9a318a48ae566cd2f0bf6d523
SHA512d4329310857942f95628dedda7cf4d3f0e2c9f0dcaae56e048b40f803d940a0867d18f5f2f1931ffac45f179dccc3ad5fafdbf1ec9ae5fd0186ea64faf93fd91
-
Filesize
32B
MD520fffed30ecb3ec5ea70890102794d2e
SHA1ff473654083ad1ec6444990b25e5f77134c3988f
SHA2566a268c3d92af3e4e1891a8a9ba1d41511f206803f45c127eca04b046a7e55a74
SHA51260345333f408868a60b991d9b24f02006123c6a0c0bcd467ce4d9d27b2799afffdf769ff0d5414cbb8a768092609ddc6c16e454ac765b5db1d2fcfd0f7f27545