Analysis
-
max time kernel
599s -
max time network
598s -
platform
android_x64 -
resource
android-x64-20240624-en -
resource tags
androidarch:x64arch:x86image:android-x64-20240624-enlocale:en-usos:android-10-x64system -
submitted
03-12-2024 12:56
Behavioral task
behavioral1
Sample
ready.apk
Resource
android-x86-arm-20240624-en
Behavioral task
behavioral2
Sample
ready.apk
Resource
android-x64-20240624-en
Behavioral task
behavioral3
Sample
ready.apk
Resource
android-x64-arm64-20240624-en
General
-
Target
ready.apk
-
Size
8.6MB
-
MD5
3276367586b421097993313ba0a444e2
-
SHA1
4da75b8f197ab7f9e8877f556bbec3c66e3dec8f
-
SHA256
79c7e415923e080bb8abb6c7410e63f006e149b7cdf97c99f6b6cac7cd79a763
-
SHA512
9f70f9d5826f89dd9658d2378d3d57eb75cb75a3a7bfbdb32eb4cb117d8941fc2916457b9e7de7c1c88e2006b9c8ad6f7c22d36daef968dd7c3246dd33285829
-
SSDEEP
98304:F9WwDrh1wdXpifc1w5vmmz3zB6Tu0tsRqJ9:C4rh1wdIt5vRzEV9/
Malware Config
Signatures
-
Makes use of the framework's Accessibility service 4 TTPs 3 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
description ioc Process Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId payment.utah.nail Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByText payment.utah.nail Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId payment.utah.nail -
Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs
Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
description ioc Process Framework service call android.content.IClipboard.addPrimaryClipChangedListener payment.utah.nail -
Acquires the wake lock 1 IoCs
description ioc Process Framework service call android.os.IPowerManager.acquireWakeLock payment.utah.nail -
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
description ioc Process Framework service call android.app.IActivityManager.setServiceForeground payment.utah.nail -
Performs UI accessibility actions on behalf of the user 1 TTPs 8 IoCs
Application may abuse the accessibility service to prevent their removal.
ioc Process android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction payment.utah.nail android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction payment.utah.nail android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction payment.utah.nail android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction payment.utah.nail android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction payment.utah.nail android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction payment.utah.nail android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction payment.utah.nail android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction payment.utah.nail -
Queries information about active data network 1 TTPs 1 IoCs
description ioc Process Framework service call android.net.IConnectivityManager.getActiveNetworkInfo payment.utah.nail -
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
description ioc Process Framework service call com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone payment.utah.nail -
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
description ioc Process Framework service call android.app.IActivityManager.registerReceiver payment.utah.nail -
Schedules tasks to execute at a specified time 1 TTPs 1 IoCs
Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.
description ioc Process Framework service call android.app.job.IJobScheduler.schedule payment.utah.nail -
Checks memory information 2 TTPs 1 IoCs
description ioc Process File opened for read /proc/meminfo payment.utah.nail
Processes
-
payment.utah.nail1⤵
- Makes use of the framework's Accessibility service
- Obtains sensitive information copied to the device clipboard
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Performs UI accessibility actions on behalf of the user
- Queries information about active data network
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Schedules tasks to execute at a specified time
- Checks memory information
PID:5052
Network
MITRE ATT&CK Mobile v15
Persistence
Event Triggered Execution
1Broadcast Receivers
1Foreground Persistence
1Scheduled Task/Job
1Defense Evasion
Foreground Persistence
1Impair Defenses
1Prevent Application Removal
1Input Injection
1Virtualization/Sandbox Evasion
1System Checks
1Credential Access
Clipboard Data
1Input Capture
2GUI Input Capture
1Keylogging
1Discovery
System Information Discovery
1System Network Configuration Discovery
1System Network Connections Discovery
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
25B
MD56a073085afb0a4d6fb679ac7dc985c1f
SHA144eca5eb9bd6ef5f9d6bc195f8b447702fd19e0c
SHA256b6bc3fecf515d96b74526d41f05d0125d12af7fd322edb05048981978d4f5715
SHA5122d09b972a207354c13fa2006f02a3da8a4d3984ac6e6b8a971ad1ca97c212b9ea8e26936b253c7bbbba91e0b7949718a1b2e76354ee8fa92fce156e8600ad5bb
-
Filesize
25B
MD529c860eaf6f36678345f0a9f6b9cc0d9
SHA17ffbfbc250be31fd70760cb9f0536e6e4f45c6ef
SHA256a1ea0cecec3d74e34e9874060753be7786995c8cc62e1daa420f930122f43eec
SHA512290f920dbee3dd59bd258ec398f0816ee24a620392ce8deaad0e6d1eaa1208f891393522d8125aea4aef9163f9011a02b3463e2d41a4e24bde065fcbad57ed20
-
Filesize
25B
MD5ba30336bf53d54ed3c0ea69dd545de8c
SHA1ce99c6724c75b93b7448e2d9fac16ca702a5711f
SHA2562d6988fb5afdaafc4e33fa1f71d6f10c95ab5a49a8ec820add5b13eef05439af
SHA512eea34ca526e03349e746d3687ea660b4748f0174fe2ffdb65161e232e08630b345e03329614852ce881a71362ba68575e9dd08fa361a416e5b2fb231e21a0a3e
-
Filesize
276B
MD50d41a014e06b6876532014b774356941
SHA1538314c0a24d9b9ba67a5288a52f8adc0c925a8b
SHA2560374f90e30033d2ef11bff59aa3f8f3071f3d8069cebf2c924761d272efb0ecc
SHA512bef7c2126ddb43c861e3fa265a7e97d2cc080bc5d35263b7ac9fd644f2128e73fb11d84e70bf187d24822b3a0798e065b7f21951a22d075c452fc2bd39c8128a