Analysis
-
max time kernel
149s -
max time network
155s -
platform
android_x86 -
resource
android-x86-arm-20240624-en -
resource tags
-
submitted
26-11-2024 11:57
General
-
Target
PSB Guard.apk
-
Size
8.7MB
-
MD5
53b01bb4d064c9826feb45f2bd265ea2
-
SHA1
320ee119945675b2db689ff1258cdde8ffc2c6cc
-
SHA256
4814530804e0e6aca8103cc9919d0ed470bd96662f0937d6a5990d58441346a1
-
SHA512
23d70b32bb062647745ac0687b2808d9a45c96b965311c238d7c92c32a288f72dd5ad4e80cd2d2d64df01630f73cdcb274cfa947ca30ae5ef2cae0940f2e23fd
-
SSDEEP
49152:PHQKDb2EyknAZkZRwxWP424W3M7svSf2ymzgzdGGdQTOG1UZYqB0cgZiiYikJtt:oxETA6oxWQiMg82ymzgzBSTi0tZi1tt
Malware Config
Signatures
-
Makes use of the framework's Accessibility service 4 TTPs 3 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
-
Acquires the wake lock 1 IoCs
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs
-
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
-
Performs UI accessibility actions on behalf of the user 1 TTPs 4 IoCs
Application may abuse the accessibility service to prevent their removal.
-
Queries information about active data network 1 TTPs 1 IoCs
-
Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
-
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
-
Schedules tasks to execute at a specified time 1 TTPs 1 IoCs
Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.
Processes
-
dinner.dispatched.pierce1⤵
- Makes use of the framework's Accessibility service
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Performs UI accessibility actions on behalf of the user
- Queries information about active data network
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Schedules tasks to execute at a specified time
Network
MITRE ATT&CK Enterprise v15
MITRE ATT&CK Mobile v15
Persistence
Event Triggered Execution
1Broadcast Receivers
1Foreground Persistence
1Scheduled Task/Job
1Defense Evasion
Foreground Persistence
1Hide Artifacts
1User Evasion
1Impair Defenses
1Prevent Application Removal
1Input Injection
1Discovery
Software Discovery
1Security Software Discovery
1System Network Connections Discovery
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
25B
MD53b7ea75ecdb8a74d2992a098079fa660
SHA11f054ff1a3bc78b99586fc6e63dafff501460f42
SHA2569dce2dd9f954dba8abf9be9f5542e2d64716de54a5cd72ed3d051efe4d26fbd4
SHA5124669b9cc3f3be17c2e54f790c3830e75dc74580afb2270fcc3d9763118dd1be362210da1bb8379d570be500ccdf7ef21b50ab8cb7225148ee9ad5ab5549b1baf
-
Filesize
25B
MD5ba30336bf53d54ed3c0ea69dd545de8c
SHA1ce99c6724c75b93b7448e2d9fac16ca702a5711f
SHA2562d6988fb5afdaafc4e33fa1f71d6f10c95ab5a49a8ec820add5b13eef05439af
SHA512eea34ca526e03349e746d3687ea660b4748f0174fe2ffdb65161e232e08630b345e03329614852ce881a71362ba68575e9dd08fa361a416e5b2fb231e21a0a3e
-
Filesize
280B
MD596a55758a371d721b840b729173c9a12
SHA1113f1d2989ab19b8b4a45eca38735f923b7e1309
SHA256dc5a3dd9bb62505d8b0d9887f637f9ed1560c927cce2c777008d7d3c497b0715
SHA512d7d0ec1b24e3e719fae19d6dd03070ab63726a11d8c329a2249fb8ceffa21513f34ff0368e5c1ac09c3bb802c3d24f4fab9bd7d899f239cc2cd038660a2ca4a9
-
Filesize
57B
MD53af69119804d1d999d56d230338ffd36
SHA169350826205583c8acc385ee0a6e3fc2673ee2ca
SHA25610994862cb263ab6b1e4428cc24cc9c585458fc67544fe0f5dfea81a5a7a115c
SHA5124a41b19d28f637b397d9dff225621694c44c750a9bd65f3e6ad5d3b9acf0d118910ddf53d4618213f9e14c61e0fb154f33f2747dd3b8d50459990767f42fc8cb