Analysis
-
max time kernel
59s -
max time network
68s -
platform
android_x64 -
resource
android-33-x64-arm64-20240624-en -
resource tags
-
submitted
19-11-2024 05:40
General
-
Target
Video Chat.apk
-
Size
5.5MB
-
MD5
66c35ad81878feb1ece06cb9870392cd
-
SHA1
ff3113b23a0f7c2a202c1a5dbceeb65c2dbc2ed6
-
SHA256
b4e3ba416a955d2cbd2053ed5d4a946badd73dd47967471d4a01f351ae80551c
-
SHA512
cecd2cc7f02390fa471d150157b298017d8760a1b00b01a5fa430adc6b42e9023c20ae154d50b46a681f76b88970c2b9aac2cba980d39ed1e0c48c58f49ed35e
-
SSDEEP
98304:FVfzy6D7MuLaW/yMAQ1yzI75XTtCVzF21n11QzcmzBzBWTk0tlINV4:XWP8jqMAzs75DtKJ2D1ALzaXs4
Malware Config
Signatures
-
Makes use of the framework's Accessibility service 4 TTPs 3 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Acquires the wake lock 1 IoCs
-
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
-
Performs UI accessibility actions on behalf of the user 1 TTPs 8 IoCs
Application may abuse the accessibility service to prevent their removal.
-
Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
-
Schedules tasks to execute at a specified time 1 TTPs 1 IoCs
Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.
Processes
-
riding.global.mozilla1⤵
- Makes use of the framework's Accessibility service
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Performs UI accessibility actions on behalf of the user
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Schedules tasks to execute at a specified time
Network
MITRE ATT&CK Mobile v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
37B
MD52e2361a5ea6e895ea8e53895521d2de4
SHA1154d07dc38193181bd4c2d7400a9e2a1b5902465
SHA2560bca68e7d2cc928b4a0468c8bd241c2a74a363455867814d7edb79c0ef674363
SHA512043fdb55e6b0fc5fb2ac4d52d2dfde2f8cfaec1202d6fd11937e971703794fc091dc0dccd82144a18fbc88f2da0e72f9bc43fa75e1094361d96dade6c93949d7
-
Filesize
25B
MD5ba30336bf53d54ed3c0ea69dd545de8c
SHA1ce99c6724c75b93b7448e2d9fac16ca702a5711f
SHA2562d6988fb5afdaafc4e33fa1f71d6f10c95ab5a49a8ec820add5b13eef05439af
SHA512eea34ca526e03349e746d3687ea660b4748f0174fe2ffdb65161e232e08630b345e03329614852ce881a71362ba68575e9dd08fa361a416e5b2fb231e21a0a3e
-
Filesize
268B
MD5dabb30ce81802706da8a4f64f9f81139
SHA1668e3dd63b5179e19e9e7c687515b7c161f70c48
SHA2568ac44c61541346c0923f4286bb282eb44799c4bb6d5f0ba305dd7546d6c10043
SHA51265d3d47fe47bde224b08cf72672e2d7379b93f0c5053236e9210c91369d2e4df18554d80f4a68ddbfa1b1f76b1919430b38e58a9424c70a28deb115ce8d5a54e
-
Filesize
57B
MD5a9ec0c42a43c72d73c499e5c17ccbb8b
SHA1731652fbfe61eac3fdb4b9d3e2eaa010848a0906
SHA2566c5309ce3f31c9af3288b0de3305b7f5ddee97be60ca4ac1184f3c334480c05b
SHA5125f8ed24a51f68cfa0627aceb9190d3a7febaee61bd5a89898ab113ddaa7ce2a41f129a28c4e200d5e5e4ddff7a483abc0393dc38e870782caf1c46d2ec0df2e3