General
-
Target
RetiredTraveller.apk
-
Size
4.4MB
-
Sample
241115-h147ca1bmq
-
MD5
f11a48f3ccd301ab0846020b145df4a1
-
SHA1
dd165dbe1b0d5c6d047f2ccae972fa0e653064f2
-
SHA256
f0add5a86d9c7ec47608b50ada6242e6120d8e87ee9852a44f0c0ba8588b7395
-
SHA512
8344bbf87e75ad543b5ccd3e9e90295c18e32fba67eac79c7c86d0939053dd98dc1af8d3525382bf3b06e4c4da06c0b735eed37eacea2bd0b03e5fb3f86c808c
-
SSDEEP
98304:aWkWjzBlTDmzgW0tB+xxtZOjqs6rfUOB/wCq/QWD3VVE1t:zPizGB+brECUQWDF61t
Malware Config
Targets
-
-
Target
RetiredTraveller.apk
-
Size
4.4MB
-
MD5
f11a48f3ccd301ab0846020b145df4a1
-
SHA1
dd165dbe1b0d5c6d047f2ccae972fa0e653064f2
-
SHA256
f0add5a86d9c7ec47608b50ada6242e6120d8e87ee9852a44f0c0ba8588b7395
-
SHA512
8344bbf87e75ad543b5ccd3e9e90295c18e32fba67eac79c7c86d0939053dd98dc1af8d3525382bf3b06e4c4da06c0b735eed37eacea2bd0b03e5fb3f86c808c
-
SSDEEP
98304:aWkWjzBlTDmzgW0tB+xxtZOjqs6rfUOB/wCq/QWD3VVE1t:zPizGB+brECUQWDF61t
Score7/10-
Makes use of the framework's Accessibility service
Retrieves information displayed on the phone screen using AccessibilityService.
-
Acquires the wake lock
-
Makes use of the framework's foreground persistence service
Application may abuse the framework's foreground service to continue running in the foreground.
-