Analysis
-
max time kernel
145s -
max time network
156s -
platform
android_x64 -
resource
android-x64-20240624-en -
resource tags
-
submitted
02/12/2024, 21:38
General
-
Target
e57565bd3f398508321470f857dfb07c195ed9b7b494ba00dc7c407ac8b8f3e1.apk
-
Size
3.9MB
-
MD5
ba1c2891d626401c5e1eb5b677ef2804
-
SHA1
4a541fdc55f63fbd24474587920d161af0adcf8f
-
SHA256
e57565bd3f398508321470f857dfb07c195ed9b7b494ba00dc7c407ac8b8f3e1
-
SHA512
1cd3b9e99d6008e3a88da594cb1899ad0462b8fb77c490fbdd26cd96f5abe43365c0b841e4aa9b3057f91378595e82d5402ffd8446e3e89ec8aaf4419899063c
-
SSDEEP
98304:Ehindhin69hinmhinyhin0hin1Ob4JiQZUR0szTZBUUk2ai52SzZzE5:aC7C6bCICECqC1Oaviq+TZBUUk5i52aW
Malware Config
Signatures
-
Makes use of the framework's Accessibility service 4 TTPs 2 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs
Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
-
Acquires the wake lock 1 IoCs
-
Checks the application is allowed to request package installs through the package installer 1 TTPs 1 IoCs
Checks the application is allowed to install additional applications (Might try to install applications from unknown sources).
-
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
-
Performs UI accessibility actions on behalf of the user 1 TTPs 14 IoCs
Application may abuse the accessibility service to prevent their removal.
-
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
-
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
-
Checks CPU information 2 TTPs 1 IoCs
-
Checks memory information 2 TTPs 1 IoCs
Processes
-
com.iptvpro1⤵
- Makes use of the framework's Accessibility service
- Obtains sensitive information copied to the device clipboard
- Acquires the wake lock
- Checks the application is allowed to request package installs through the package installer
- Makes use of the framework's foreground persistence service
- Performs UI accessibility actions on behalf of the user
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Checks CPU information
- Checks memory information
Network
MITRE ATT&CK Mobile v15
Persistence
Event Triggered Execution
1Broadcast Receivers
1Foreground Persistence
1Defense Evasion
Foreground Persistence
1Impair Defenses
1Prevent Application Removal
1Input Injection
1Subvert Trust Controls
1Code Signing Policy Modification
1Virtualization/Sandbox Evasion
2System Checks
2Credential Access
Clipboard Data
1Input Capture
2GUI Input Capture
1Keylogging
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4B
MD5098f6bcd4621d373cade4e832627b4f6
SHA1a94a8fe5ccb19ba61c4c0873d391e987982fbbd3
SHA2569f86d081884c7d659a2feaa0c55ad015a3bf4f1b2b0b822cd15d6c15b0f00a08
SHA512ee26b0dd4af7e749aa1a8ee3c10ae9923f618980772e473f8819a5d4940e0db27ac185f8a0e1d5f84f88bc887fd67b143732c304cc5fa9ad8e6f57f50028a8ff
-
Filesize
40KB
MD5c9ba8af2c46cfab6a421f96b0c7a4aba
SHA17cf335d13973adb71de16c9683c65326e04d0107
SHA256c4ddb071f51d8ccf2ae17406c75498de55d820371a8b28c77197a127d131863c
SHA5120fb0dc739a67f5dca3872f616adbbf361a82075411e17a3d6be06d7d52126b284f2119524d9ea47c251d77752b4802727d1499f015977616dc8ddcdd40309afd
-
Filesize
32KB
MD5fdd25b949d73bd4382094f4a43c3b9bb
SHA1f7b4e3938b71825596003f36d057fceb8cc5e0e4
SHA2567b21a776bc72f9f2ff45d9d35b3b06b5bc37ab43f12cf377d215ec44912adfe1
SHA512c9d4daabb28457033a44dba65365acc98be1d8b331665c3b614337c13719333aba1dec177d8a4aee3ae326fdbeb7d925c4bb9ef3215230a48b2b7b2b9cc12afb
-
Filesize
11B
MD51b65c10c6215685f9d621d797f911373
SHA1cc50aaed5cd521a62ec8cf9fe0413153ec90f265
SHA2562230c2b2787663a054c47450ecd1718f0296853ad768b8e5d306ecb912685e89
SHA5125a9139f295dbe384b1584eff5c11f3f86759232f7b661b75f27fe92b996b4cdc0552e315f79b26f5f2c1f91756d9ae04cf0c3675b6172e91a3d373b9b314496f
