Analysis
-
max time kernel
139s -
max time network
150s -
platform
android_x64 -
resource
android-x64-arm64-20240624-en -
resource tags
-
submitted
19-11-2024 22:05
General
-
Target
5445e0ed8f1a52c12193db41647c6cc8b9735ed560c5bdfd5d7ffdaff19096f6.apk
-
Size
4.8MB
-
MD5
c89912d8fb46dbc1abbe9bec8ff9746f
-
SHA1
0105a31900586367dc56652c01adb237f6f9946e
-
SHA256
5445e0ed8f1a52c12193db41647c6cc8b9735ed560c5bdfd5d7ffdaff19096f6
-
SHA512
45c2d445bf942212b60744ce2295598f0c060dc2049e07c41d98bf366e3d33ab93823600949f94c27fe27133e16da27556f1f6fcaef014e4e7cf796e3391f31d
-
SSDEEP
98304:xlWp8rxVvB3yfV55NILND+9zMbekH8zam+/R/42UeA2NxY05:uaLZ8VruR26H7+2Ub2jY+
Malware Config
Signatures
-
Removes its main activity from the application launcher 1 TTPs 7 IoCs
-
Loads dropped Dex/Jar 1 TTPs 1 IoCs
Runs executable file dropped to the device during analysis.
-
Makes use of the framework's Accessibility service 4 TTPs 3 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs
Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
-
Performs UI accessibility actions on behalf of the user 1 TTPs 4 IoCs
Application may abuse the accessibility service to prevent their removal.
-
Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
-
Schedules tasks to execute at a specified time 1 TTPs 1 IoCs
Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.
-
Checks CPU information 2 TTPs 1 IoCs
-
Checks memory information 2 TTPs 1 IoCs
Processes
-
com.getepic.Epic1⤵
- Removes its main activity from the application launcher
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Obtains sensitive information copied to the device clipboard
- Performs UI accessibility actions on behalf of the user
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Schedules tasks to execute at a specified time
- Checks CPU information
- Checks memory information
Network
MITRE ATT&CK Mobile v15
Defense Evasion
Download New Code at Runtime
1Hide Artifacts
2Suppress Application Icon
1User Evasion
1Impair Defenses
1Prevent Application Removal
1Input Injection
1Virtualization/Sandbox Evasion
2System Checks
2Credential Access
Clipboard Data
1Input Capture
2GUI Input Capture
1Keylogging
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
572KB
MD57bd608fbefda5c4b98b52f8091f04f30
SHA14ff23b5a0c00a30038f453ea52c74c1c9dda2fdc
SHA256b5b9ebce94ad32b21ca1199c7fc872fd9f10c15f84cb90b27995d44b8be56254
SHA51207355df308a5ee463f43a96595c1d5b1e40607ed7f4a72b0938c2c176b1a9e148a47ec336b50423f1e82275f7e301f729e20fb15531b3ee292a477df1fc046d2
-
Filesize
572KB
MD56eabad13bd19b8329411b577356416c6
SHA12fe8723420ef7d9136802f311511ac94a9b68239
SHA256d56d817232ce41a8939ecddcca4bdf9d3e57b75a7147050cc8935a9e130543e2
SHA512edc9722dcdd3c591d757f213ef133123f73f823bbab6bd557eb68704b3c102fa2a6c0a06b06b6dc6cbb5bedd7e596e6a2f921de5684c841b7d54926f775debf2
-
Filesize
631KB
MD531a12802efb3d26caf1199cff0c88570
SHA169c6ef4226759a9ce7737923da01063251bc4dac
SHA25626a077d8f147e56bc4da5875c5a8faf71ce8c1dd84819c157d0bd081210f6ef1
SHA512f3cc3780afb03afecd47f54e24e1726e740bb3bc4fc464f5e4ba28cdbc3543b15d9f720042e396b16af98d4c602aa6bc4d3fa0ea4c3fcaa12f6ea583ad9b54c5
-
Filesize
229B
MD52f7266096db7118292a0322460c22e85
SHA1b1a5af2fe27a09cbf5a1acb9014388775fcee360
SHA2560965e2c2251b643be4fefc5acf37d0313c4c501dc3f3eb2f8ae37f6a4c6c7bc1
SHA51237bf95597102b384f9e1ac38425ba9d7b056c47a3634f0a4a9f779bb9eca178db7925bd3087cc2d9cff2d7c8188014f246e726f72e94a8cd6b1753aa2f46846a