Analysis
-
max time kernel
38s -
max time network
42s -
platform
android_x86 -
resource
android-x86-arm-20240624-en -
resource tags
androidarch:armarch:x86image:android-x86-arm-20240624-enlocale:en-usos:android-9-x86system -
submitted
12-11-2024 09:16
Static task
static1
Behavioral task
behavioral1
Sample
shriek.mooing.juggle.irk.apk
Resource
android-x86-arm-20240624-en
Behavioral task
behavioral2
Sample
shriek.mooing.juggle.irk.apk
Resource
android-x64-arm64-20240624-en
General
-
Target
shriek.mooing.juggle.irk.apk
-
Size
3.5MB
-
MD5
0e1976cfac762d0549235c349f5788cf
-
SHA1
07652c6fbabdf9c46f42d8eb0a1d0652a1607792
-
SHA256
d5a5914de25dc220e934d8bac4323de7a5af2ca4fe60996d3acefbc3467f41e5
-
SHA512
7887d0c2196611d4595fff293404767521ef7dae0c27cae0d924d03dabe3f907e91e846297677e60d31cdcbc8d4c4122a5c4c8369327b5120122962a68c2e714
-
SSDEEP
98304:WCA1g9vyxozyibezZK3ZkR6tC0gT0YUxCBUd6u:w1PxEx3ZkotCZJUSQ6u
Malware Config
Signatures
-
Processes:
shriek.mooing.juggle.irkpid Process 4253 shriek.mooing.juggle.irk -
Loads dropped Dex/Jar 1 TTPs 3 IoCs
Runs executable file dropped to the device during analysis.
Processes:
shriek.mooing.juggle.irk/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/data/shriek.mooing.juggle.irk/code_cache/decrypted.dex --output-vdex-fd=47 --oat-fd=48 --oat-location=/data/data/shriek.mooing.juggle.irk/code_cache/oat/x86/decrypted.odex --compiler-filter=quicken --class-loader-context=&ioc pid Process /data/data/shriek.mooing.juggle.irk/code_cache/decrypted.dex 4253 shriek.mooing.juggle.irk /data/data/shriek.mooing.juggle.irk/code_cache/decrypted.dex 4280 /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/data/shriek.mooing.juggle.irk/code_cache/decrypted.dex --output-vdex-fd=47 --oat-fd=48 --oat-location=/data/data/shriek.mooing.juggle.irk/code_cache/oat/x86/decrypted.odex --compiler-filter=quicken --class-loader-context=& /data/data/shriek.mooing.juggle.irk/code_cache/decrypted.dex 4253 shriek.mooing.juggle.irk -
Makes use of the framework's Accessibility service 4 TTPs 3 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
Processes:
shriek.mooing.juggle.irkdescription ioc Process Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId shriek.mooing.juggle.irk Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId shriek.mooing.juggle.irk Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByText shriek.mooing.juggle.irk -
Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
-
Queries the phone number (MSISDN for GSM devices) 1 TTPs
-
Performs UI accessibility actions on behalf of the user 1 TTPs 8 IoCs
Application may abuse the accessibility service to prevent their removal.
Processes:
shriek.mooing.juggle.irkioc Process android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction shriek.mooing.juggle.irk android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction shriek.mooing.juggle.irk android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction shriek.mooing.juggle.irk android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction shriek.mooing.juggle.irk android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction shriek.mooing.juggle.irk android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction shriek.mooing.juggle.irk android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction shriek.mooing.juggle.irk android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction shriek.mooing.juggle.irk -
Queries information about active data network 1 TTPs 1 IoCs
Processes:
shriek.mooing.juggle.irkdescription ioc Process Framework service call android.net.IConnectivityManager.getActiveNetworkInfo shriek.mooing.juggle.irk -
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
Processes:
shriek.mooing.juggle.irkdescription ioc Process Framework service call com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone shriek.mooing.juggle.irk -
Reads information about phone network operator. 1 TTPs
-
Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
Processes:
shriek.mooing.juggle.irkdescription ioc Process Intent action android.settings.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS shriek.mooing.juggle.irk -
Requests enabling of the accessibility settings. 1 IoCs
Processes:
shriek.mooing.juggle.irkdescription ioc Process Intent action android.settings.ACCESSIBILITY_SETTINGS shriek.mooing.juggle.irk -
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
Processes:
shriek.mooing.juggle.irkdescription ioc Process Framework service call android.app.IActivityManager.registerReceiver shriek.mooing.juggle.irk -
Schedules tasks to execute at a specified time 1 TTPs 1 IoCs
Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.
Processes:
shriek.mooing.juggle.irkdescription ioc Process Framework service call android.app.job.IJobScheduler.schedule shriek.mooing.juggle.irk -
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
Processes:
shriek.mooing.juggle.irkdescription ioc Process Framework API call javax.crypto.Cipher.doFinal shriek.mooing.juggle.irk -
Checks CPU information 2 TTPs 1 IoCs
Processes:
shriek.mooing.juggle.irkdescription ioc Process File opened for read /proc/cpuinfo shriek.mooing.juggle.irk -
Checks memory information 2 TTPs 1 IoCs
Processes:
shriek.mooing.juggle.irkdescription ioc Process File opened for read /proc/meminfo shriek.mooing.juggle.irk
Processes
-
shriek.mooing.juggle.irk1⤵
- Removes its main activity from the application launcher
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Performs UI accessibility actions on behalf of the user
- Queries information about active data network
- Queries the mobile country code (MCC)
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Requests enabling of the accessibility settings.
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Schedules tasks to execute at a specified time
- Uses Crypto APIs (Might try to encrypt user data)
- Checks CPU information
- Checks memory information
PID:4253 -
/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/data/shriek.mooing.juggle.irk/code_cache/decrypted.dex --output-vdex-fd=47 --oat-fd=48 --oat-location=/data/data/shriek.mooing.juggle.irk/code_cache/oat/x86/decrypted.odex --compiler-filter=quicken --class-loader-context=&2⤵
- Loads dropped Dex/Jar
PID:4280
-
Network
MITRE ATT&CK Mobile v15
Persistence
Event Triggered Execution
1Broadcast Receivers
1Scheduled Task/Job
1Defense Evasion
Download New Code at Runtime
1Hide Artifacts
2Suppress Application Icon
1User Evasion
1Impair Defenses
1Prevent Application Removal
1Input Injection
1Virtualization/Sandbox Evasion
2System Checks
2Discovery
Software Discovery
1Security Software Discovery
1System Information Discovery
2System Network Configuration Discovery
3System Network Connections Discovery
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.3MB
MD5fd3fb1759e2f5eaba8d44dd31f9e5ccf
SHA1adc257ff4df7466cd3ce1900314fc8919dc8a670
SHA25692ac568ddfb0b89bb1d67657ad9cec2e071a361f8c28630bb81cddfa1865c1d3
SHA5129a50d88c750a76f621032dfacf674953551589b3388db6d4e270529c96e52f3a0ace12dd4a9e1eb9bccafca53fae2e4e9fa5e46d5da8ed6868b0ed452bcccca5
-
Filesize
1.3MB
MD580a50796301291a5f17488fbcf787826
SHA1bd7a63f5c263b5c8dc8402125e8102a6a0929a0e
SHA2564cc3dedba47978209cee6280f823a9c6f7a4ac551dad834442cedd981c4540e8
SHA512103ecbfa388306d9023154e3f5542a9dec1e650e758afcdc225f670532f51d975646acd6b08843615f82abcd2ae72873133ef0f7d7fd0ea8070ed9dbba98d0a3
-
Filesize
1.3MB
MD5df5bc5c3b24029a53ee6f11c3f15b383
SHA1c7bbad9b54f6ab25d94350c8fb54ef9f757b3d0c
SHA256082cd0ec0c71c3536db53f3e1a2631bf1d34ce12f7c453525b84f66b7f25d3f4
SHA512f0c8da2b22bab6eb738b9a4909d0b6fb743f9dcdc8d2a92261b22ca6fca49e57275006855bcfa1a1b7c8e1318a5353ead7e332b6400e42defb2c2c8d4e7908bb
-
Filesize
104KB
MD55d672fc117cd0984d4fa842123e84875
SHA1638ee961947eae211eeb1bf4d20e764c8b037643
SHA256cdb2ed63e61f774434d03ad5fef3472f978239db05d63b1611e002036e40cd1b
SHA512e06530340f62602011ae07fe8ecd6c86b2df983d959dae0dd51dfec72ddb5c384dfc41bbaafd3d427c6563ab8e583e6c7b17b3ce1e882f2740cb07bdeed2accd
-
Filesize
512B
MD5b565e0b0bd708925980f487cc015faf8
SHA19a65e3a2fa1e56db87d5958a6e8cbae740d71c78
SHA2562853f6e5d271b27a3b6f4a13392fe19493e6efc0b8f3470e37b1438f0c750eb2
SHA5125e8e3ebcf4c9fbcd549204ed96779285439712cdb66f744d5a455b7021b2f45480673204a7d33cef87e7bfc59a8b6b21b693863772dc78069037086367df258d
-
Filesize
32KB
MD5bb7df04e1b0a2570657527a7e108ae23
SHA15188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA256c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
SHA512768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012
-
Filesize
16KB
MD57da8fe22825b5478a842be2ef1327fb8
SHA1d99280083f638321f547ecd4d8e5614bdd58887c
SHA2567cd1505843dc78648821f49a4c9e93b806a62c3772977ea17fee5da3c0a7e355
SHA512f39b52b7c61c931757830f1f84ffc1d4ffd7233e513107efee7fc1b641a13a5efd1124e22d702896a086f1df2419b0cb18846ae6f77d55c40c47a6afd7cd0603
-
Filesize
116KB
MD502e26b16b7aa2d1e093af2fa5c4fc1ae
SHA13c30338885569dbd12599604cc9c6467664c0e08
SHA256a994dcc3438c7366101e4b46add5ee74e9d073b86fa4debe8fbe451f3a57506d
SHA5124bc00bf393ddefce1b2befc7960de5daf4d771c0917ea1252198e3545cc8074c57769bf2b89e9d2a3a77d9dbef5237e85b58542df7d2f0e26e67d6c503c66d88
-
Filesize
402KB
MD52d13bee8cfafd969a220384dae4c5bfc
SHA14e40d4eac7dd13f5b04ef343f503b5f1ec2b9eaf
SHA256b57715f2cee1111db0d5ade7a567fc6b7087b1ce36947295b35477b8d0dd53aa
SHA51253ad6b72bd0cde97cc189f330b1918d4e045e8327344bd8c66c433ba860afa1d5e2d416f32474c340263327cf30b3406f55b7207f1b01df50b84bffa037943c9