Analysis
-
max time kernel
149s -
max time network
131s -
platform
android_x86 -
resource
android-x86-arm-20240624-en -
resource tags
-
submitted
19-11-2024 22:05
General
-
Target
5445e0ed8f1a52c12193db41647c6cc8b9735ed560c5bdfd5d7ffdaff19096f6.apk
-
Size
4.8MB
-
MD5
c89912d8fb46dbc1abbe9bec8ff9746f
-
SHA1
0105a31900586367dc56652c01adb237f6f9946e
-
SHA256
5445e0ed8f1a52c12193db41647c6cc8b9735ed560c5bdfd5d7ffdaff19096f6
-
SHA512
45c2d445bf942212b60744ce2295598f0c060dc2049e07c41d98bf366e3d33ab93823600949f94c27fe27133e16da27556f1f6fcaef014e4e7cf796e3391f31d
-
SSDEEP
98304:xlWp8rxVvB3yfV55NILND+9zMbekH8zam+/R/42UeA2NxY05:uaLZ8VruR26H7+2Ub2jY+
Malware Config
Signatures
-
Removes its main activity from the application launcher 1 TTPs 8 IoCs
-
Loads dropped Dex/Jar 1 TTPs 2 IoCs
Runs executable file dropped to the device during analysis.
-
Makes use of the framework's Accessibility service 4 TTPs 3 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Performs UI accessibility actions on behalf of the user 1 TTPs 4 IoCs
Application may abuse the accessibility service to prevent their removal.
-
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
-
Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
-
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
-
Schedules tasks to execute at a specified time 1 TTPs 1 IoCs
Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.
-
Checks CPU information 2 TTPs 1 IoCs
-
Checks memory information 2 TTPs 1 IoCs
Processes
-
com.getepic.Epic1⤵
- Removes its main activity from the application launcher
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Performs UI accessibility actions on behalf of the user
- Queries the mobile country code (MCC)
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Schedules tasks to execute at a specified time
- Checks CPU information
- Checks memory information
-
/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.getepic.Epic/app_DynamicOptDex/DKTboahLdEI.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/com.getepic.Epic/app_DynamicOptDex/oat/x86/DKTboahLdEI.odex --compiler-filter=quicken --class-loader-context=&2⤵
- Loads dropped Dex/Jar
-
Network
MITRE ATT&CK Mobile v15
Persistence
Event Triggered Execution
1Broadcast Receivers
1Scheduled Task/Job
1Defense Evasion
Download New Code at Runtime
1Hide Artifacts
2Suppress Application Icon
1User Evasion
1Impair Defenses
1Prevent Application Removal
1Input Injection
1Virtualization/Sandbox Evasion
2System Checks
2Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
572KB
MD57bd608fbefda5c4b98b52f8091f04f30
SHA14ff23b5a0c00a30038f453ea52c74c1c9dda2fdc
SHA256b5b9ebce94ad32b21ca1199c7fc872fd9f10c15f84cb90b27995d44b8be56254
SHA51207355df308a5ee463f43a96595c1d5b1e40607ed7f4a72b0938c2c176b1a9e148a47ec336b50423f1e82275f7e301f729e20fb15531b3ee292a477df1fc046d2
-
Filesize
572KB
MD56eabad13bd19b8329411b577356416c6
SHA12fe8723420ef7d9136802f311511ac94a9b68239
SHA256d56d817232ce41a8939ecddcca4bdf9d3e57b75a7147050cc8935a9e130543e2
SHA512edc9722dcdd3c591d757f213ef133123f73f823bbab6bd557eb68704b3c102fa2a6c0a06b06b6dc6cbb5bedd7e596e6a2f921de5684c841b7d54926f775debf2
-
Filesize
538B
MD572f59f8a7026f1b18fd73e384fb83dfb
SHA18ffaadc8e0a9175437a657290f22216ff19799fa
SHA256053048bc948203a54e68c6829d00f4f7095c71db052aaf948e3731c5267782a5
SHA5129b213db4df8d3621864e7af3833c1036207b347ffe870266bb3b5b38b23dac182773acd02a71649fe97a9093abff59d07173644ac4c09e4ec9f7564d17474673
-
Filesize
631KB
MD51b8d5b5f98a372c9c0a83c796c12bea6
SHA199b410c30cb3d4afa8c3ace5cc2775078d373e72
SHA256fb6404a1c60df0d8778e2269080cca5fbfa5948c302eebd8882f58b8b48068bd
SHA512f8419f8e4bf6989dec2bd5f2733a68ad5eac276cf227dbfd57cce7ca3777d23b2f3128619ebb671dc70c6ba09e208545ecb1d2b4342e8bb85fbe63793108b1cb
-
Filesize
631KB
MD531a12802efb3d26caf1199cff0c88570
SHA169c6ef4226759a9ce7737923da01063251bc4dac
SHA25626a077d8f147e56bc4da5875c5a8faf71ce8c1dd84819c157d0bd081210f6ef1
SHA512f3cc3780afb03afecd47f54e24e1726e740bb3bc4fc464f5e4ba28cdbc3543b15d9f720042e396b16af98d4c602aa6bc4d3fa0ea4c3fcaa12f6ea583ad9b54c5