Analysis

  • max time kernel
    38s
  • max time network
    42s
  • platform
    android_x86
  • resource
    android-x86-arm-20240624-en
  • resource tags

    androidarch:armarch:x86image:android-x86-arm-20240624-enlocale:en-usos:android-9-x86system
  • submitted
    12-11-2024 09:16

General

  • Target

    shriek.mooing.juggle.irk.apk

  • Size

    3.5MB

  • MD5

    0e1976cfac762d0549235c349f5788cf

  • SHA1

    07652c6fbabdf9c46f42d8eb0a1d0652a1607792

  • SHA256

    d5a5914de25dc220e934d8bac4323de7a5af2ca4fe60996d3acefbc3467f41e5

  • SHA512

    7887d0c2196611d4595fff293404767521ef7dae0c27cae0d924d03dabe3f907e91e846297677e60d31cdcbc8d4c4122a5c4c8369327b5120122962a68c2e714

  • SSDEEP

    98304:WCA1g9vyxozyibezZK3ZkR6tC0gT0YUxCBUd6u:w1PxEx3ZkotCZJUSQ6u

Malware Config

Signatures

  • Removes its main activity from the application launcher 1 TTPs 1 IoCs
  • Loads dropped Dex/Jar 1 TTPs 3 IoCs

    Runs executable file dropped to the device during analysis.

  • Makes use of the framework's Accessibility service 4 TTPs 3 IoCs

    Retrieves information displayed on the phone screen using AccessibilityService.

  • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
  • Queries the phone number (MSISDN for GSM devices) 1 TTPs
  • Performs UI accessibility actions on behalf of the user 1 TTPs 8 IoCs

    Application may abuse the accessibility service to prevent their removal.

  • Queries information about active data network 1 TTPs 1 IoCs
  • Queries the mobile country code (MCC) 1 TTPs 1 IoCs
  • Reads information about phone network operator. 1 TTPs
  • Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
  • Requests enabling of the accessibility settings. 1 IoCs
  • Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
  • Schedules tasks to execute at a specified time 1 TTPs 1 IoCs

    Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.

  • Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
  • Checks CPU information 2 TTPs 1 IoCs
  • Checks memory information 2 TTPs 1 IoCs

Processes

  • shriek.mooing.juggle.irk
    1⤵
    • Removes its main activity from the application launcher
    • Loads dropped Dex/Jar
    • Makes use of the framework's Accessibility service
    • Performs UI accessibility actions on behalf of the user
    • Queries information about active data network
    • Queries the mobile country code (MCC)
    • Requests disabling of battery optimizations (often used to enable hiding in the background).
    • Requests enabling of the accessibility settings.
    • Registers a broadcast receiver at runtime (usually for listening for system events)
    • Schedules tasks to execute at a specified time
    • Uses Crypto APIs (Might try to encrypt user data)
    • Checks CPU information
    • Checks memory information
    PID:4253
    • /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/data/shriek.mooing.juggle.irk/code_cache/decrypted.dex --output-vdex-fd=47 --oat-fd=48 --oat-location=/data/data/shriek.mooing.juggle.irk/code_cache/oat/x86/decrypted.odex --compiler-filter=quicken --class-loader-context=&
      2⤵
      • Loads dropped Dex/Jar
      PID:4280

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/data/shriek.mooing.juggle.irk/code_cache/decrypted.dex

    Filesize

    1.3MB

    MD5

    fd3fb1759e2f5eaba8d44dd31f9e5ccf

    SHA1

    adc257ff4df7466cd3ce1900314fc8919dc8a670

    SHA256

    92ac568ddfb0b89bb1d67657ad9cec2e071a361f8c28630bb81cddfa1865c1d3

    SHA512

    9a50d88c750a76f621032dfacf674953551589b3388db6d4e270529c96e52f3a0ace12dd4a9e1eb9bccafca53fae2e4e9fa5e46d5da8ed6868b0ed452bcccca5

  • /data/data/shriek.mooing.juggle.irk/code_cache/decrypted.dex

    Filesize

    1.3MB

    MD5

    80a50796301291a5f17488fbcf787826

    SHA1

    bd7a63f5c263b5c8dc8402125e8102a6a0929a0e

    SHA256

    4cc3dedba47978209cee6280f823a9c6f7a4ac551dad834442cedd981c4540e8

    SHA512

    103ecbfa388306d9023154e3f5542a9dec1e650e758afcdc225f670532f51d975646acd6b08843615f82abcd2ae72873133ef0f7d7fd0ea8070ed9dbba98d0a3

  • /data/data/shriek.mooing.juggle.irk/code_cache/decrypted.dex

    Filesize

    1.3MB

    MD5

    df5bc5c3b24029a53ee6f11c3f15b383

    SHA1

    c7bbad9b54f6ab25d94350c8fb54ef9f757b3d0c

    SHA256

    082cd0ec0c71c3536db53f3e1a2631bf1d34ce12f7c453525b84f66b7f25d3f4

    SHA512

    f0c8da2b22bab6eb738b9a4909d0b6fb743f9dcdc8d2a92261b22ca6fca49e57275006855bcfa1a1b7c8e1318a5353ead7e332b6400e42defb2c2c8d4e7908bb

  • /data/data/shriek.mooing.juggle.irk/no_backup/androidx.work.workdb

    Filesize

    104KB

    MD5

    5d672fc117cd0984d4fa842123e84875

    SHA1

    638ee961947eae211eeb1bf4d20e764c8b037643

    SHA256

    cdb2ed63e61f774434d03ad5fef3472f978239db05d63b1611e002036e40cd1b

    SHA512

    e06530340f62602011ae07fe8ecd6c86b2df983d959dae0dd51dfec72ddb5c384dfc41bbaafd3d427c6563ab8e583e6c7b17b3ce1e882f2740cb07bdeed2accd

  • /data/data/shriek.mooing.juggle.irk/no_backup/androidx.work.workdb-journal

    Filesize

    512B

    MD5

    b565e0b0bd708925980f487cc015faf8

    SHA1

    9a65e3a2fa1e56db87d5958a6e8cbae740d71c78

    SHA256

    2853f6e5d271b27a3b6f4a13392fe19493e6efc0b8f3470e37b1438f0c750eb2

    SHA512

    5e8e3ebcf4c9fbcd549204ed96779285439712cdb66f744d5a455b7021b2f45480673204a7d33cef87e7bfc59a8b6b21b693863772dc78069037086367df258d

  • /data/data/shriek.mooing.juggle.irk/no_backup/androidx.work.workdb-shm

    Filesize

    32KB

    MD5

    bb7df04e1b0a2570657527a7e108ae23

    SHA1

    5188431849b4613152fd7bdba6a3ff0a4fd6424b

    SHA256

    c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479

    SHA512

    768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

  • /data/data/shriek.mooing.juggle.irk/no_backup/androidx.work.workdb-wal

    Filesize

    16KB

    MD5

    7da8fe22825b5478a842be2ef1327fb8

    SHA1

    d99280083f638321f547ecd4d8e5614bdd58887c

    SHA256

    7cd1505843dc78648821f49a4c9e93b806a62c3772977ea17fee5da3c0a7e355

    SHA512

    f39b52b7c61c931757830f1f84ffc1d4ffd7233e513107efee7fc1b641a13a5efd1124e22d702896a086f1df2419b0cb18846ae6f77d55c40c47a6afd7cd0603

  • /data/data/shriek.mooing.juggle.irk/no_backup/androidx.work.workdb-wal

    Filesize

    116KB

    MD5

    02e26b16b7aa2d1e093af2fa5c4fc1ae

    SHA1

    3c30338885569dbd12599604cc9c6467664c0e08

    SHA256

    a994dcc3438c7366101e4b46add5ee74e9d073b86fa4debe8fbe451f3a57506d

    SHA512

    4bc00bf393ddefce1b2befc7960de5daf4d771c0917ea1252198e3545cc8074c57769bf2b89e9d2a3a77d9dbef5237e85b58542df7d2f0e26e67d6c503c66d88

  • /data/data/shriek.mooing.juggle.irk/no_backup/androidx.work.workdb-wal

    Filesize

    402KB

    MD5

    2d13bee8cfafd969a220384dae4c5bfc

    SHA1

    4e40d4eac7dd13f5b04ef343f503b5f1ec2b9eaf

    SHA256

    b57715f2cee1111db0d5ade7a567fc6b7087b1ce36947295b35477b8d0dd53aa

    SHA512

    53ad6b72bd0cde97cc189f330b1918d4e045e8327344bd8c66c433ba860afa1d5e2d416f32474c340263327cf30b3406f55b7207f1b01df50b84bffa037943c9