Analysis

  • max time kernel
    599s
  • max time network
    598s
  • platform
    android_x64
  • resource
    android-x64-20240624-en
  • resource tags

    androidarch:x64arch:x86image:android-x64-20240624-enlocale:en-usos:android-10-x64system
  • submitted
    03-12-2024 12:56

General

  • Target

    ready.apk

  • Size

    8.6MB

  • MD5

    3276367586b421097993313ba0a444e2

  • SHA1

    4da75b8f197ab7f9e8877f556bbec3c66e3dec8f

  • SHA256

    79c7e415923e080bb8abb6c7410e63f006e149b7cdf97c99f6b6cac7cd79a763

  • SHA512

    9f70f9d5826f89dd9658d2378d3d57eb75cb75a3a7bfbdb32eb4cb117d8941fc2916457b9e7de7c1c88e2006b9c8ad6f7c22d36daef968dd7c3246dd33285829

  • SSDEEP

    98304:F9WwDrh1wdXpifc1w5vmmz3zB6Tu0tsRqJ9:C4rh1wdIt5vRzEV9/

Malware Config

Signatures

  • Makes use of the framework's Accessibility service 4 TTPs 3 IoCs

    Retrieves information displayed on the phone screen using AccessibilityService.

  • Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs

    Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.

  • Acquires the wake lock 1 IoCs
  • Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

    Application may abuse the framework's foreground service to continue running in the foreground.

  • Performs UI accessibility actions on behalf of the user 1 TTPs 8 IoCs

    Application may abuse the accessibility service to prevent their removal.

  • Queries information about active data network 1 TTPs 1 IoCs
  • Queries the mobile country code (MCC) 1 TTPs 1 IoCs
  • Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
  • Schedules tasks to execute at a specified time 1 TTPs 1 IoCs

    Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.

  • Checks memory information 2 TTPs 1 IoCs

Processes

  • payment.utah.nail
    1⤵
    • Makes use of the framework's Accessibility service
    • Obtains sensitive information copied to the device clipboard
    • Acquires the wake lock
    • Makes use of the framework's foreground persistence service
    • Performs UI accessibility actions on behalf of the user
    • Queries information about active data network
    • Queries the mobile country code (MCC)
    • Registers a broadcast receiver at runtime (usually for listening for system events)
    • Schedules tasks to execute at a specified time
    • Checks memory information
    PID:5052

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • /storage/emulated/0/Config/sys/apps/log/log-2024-12-03.txt

    Filesize

    25B

    MD5

    6a073085afb0a4d6fb679ac7dc985c1f

    SHA1

    44eca5eb9bd6ef5f9d6bc195f8b447702fd19e0c

    SHA256

    b6bc3fecf515d96b74526d41f05d0125d12af7fd322edb05048981978d4f5715

    SHA512

    2d09b972a207354c13fa2006f02a3da8a4d3984ac6e6b8a971ad1ca97c212b9ea8e26936b253c7bbbba91e0b7949718a1b2e76354ee8fa92fce156e8600ad5bb

  • /storage/emulated/0/Config/sys/apps/log/log-2024-12-03.txt

    Filesize

    25B

    MD5

    29c860eaf6f36678345f0a9f6b9cc0d9

    SHA1

    7ffbfbc250be31fd70760cb9f0536e6e4f45c6ef

    SHA256

    a1ea0cecec3d74e34e9874060753be7786995c8cc62e1daa420f930122f43eec

    SHA512

    290f920dbee3dd59bd258ec398f0816ee24a620392ce8deaad0e6d1eaa1208f891393522d8125aea4aef9163f9011a02b3463e2d41a4e24bde065fcbad57ed20

  • /storage/emulated/0/Config/sys/apps/log/log-2024-12-03.txt

    Filesize

    25B

    MD5

    ba30336bf53d54ed3c0ea69dd545de8c

    SHA1

    ce99c6724c75b93b7448e2d9fac16ca702a5711f

    SHA256

    2d6988fb5afdaafc4e33fa1f71d6f10c95ab5a49a8ec820add5b13eef05439af

    SHA512

    eea34ca526e03349e746d3687ea660b4748f0174fe2ffdb65161e232e08630b345e03329614852ce881a71362ba68575e9dd08fa361a416e5b2fb231e21a0a3e

  • /storage/emulated/0/Config/sys/apps/log/log-2024-12-03.txt

    Filesize

    276B

    MD5

    0d41a014e06b6876532014b774356941

    SHA1

    538314c0a24d9b9ba67a5288a52f8adc0c925a8b

    SHA256

    0374f90e30033d2ef11bff59aa3f8f3071f3d8069cebf2c924761d272efb0ecc

    SHA512

    bef7c2126ddb43c861e3fa265a7e97d2cc080bc5d35263b7ac9fd644f2128e73fb11d84e70bf187d24822b3a0798e065b7f21951a22d075c452fc2bd39c8128a