Analysis
-
max time kernel
599s -
max time network
598s -
platform
android_x64 -
resource
android-x64-arm64-20240624-en -
resource tags
-
submitted
03-12-2024 12:56
General
-
Target
ready.apk
-
Size
8.6MB
-
MD5
3276367586b421097993313ba0a444e2
-
SHA1
4da75b8f197ab7f9e8877f556bbec3c66e3dec8f
-
SHA256
79c7e415923e080bb8abb6c7410e63f006e149b7cdf97c99f6b6cac7cd79a763
-
SHA512
9f70f9d5826f89dd9658d2378d3d57eb75cb75a3a7bfbdb32eb4cb117d8941fc2916457b9e7de7c1c88e2006b9c8ad6f7c22d36daef968dd7c3246dd33285829
-
SSDEEP
98304:F9WwDrh1wdXpifc1w5vmmz3zB6Tu0tsRqJ9:C4rh1wdIt5vRzEV9/
Malware Config
Signatures
-
Makes use of the framework's Accessibility service 4 TTPs 3 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs
Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
-
Acquires the wake lock 1 IoCs
-
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
-
Performs UI accessibility actions on behalf of the user 1 TTPs 8 IoCs
Application may abuse the accessibility service to prevent their removal.
-
Queries information about active data network 1 TTPs 1 IoCs
-
Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
-
Schedules tasks to execute at a specified time 1 TTPs 1 IoCs
Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.
-
Checks memory information 2 TTPs 1 IoCs
Processes
-
payment.utah.nail1⤵
- Makes use of the framework's Accessibility service
- Obtains sensitive information copied to the device clipboard
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Performs UI accessibility actions on behalf of the user
- Queries information about active data network
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Schedules tasks to execute at a specified time
- Checks memory information
Network
MITRE ATT&CK Mobile v15
Defense Evasion
Foreground Persistence
1Hide Artifacts
1User Evasion
1Impair Defenses
1Prevent Application Removal
1Input Injection
1Virtualization/Sandbox Evasion
1System Checks
1Credential Access
Clipboard Data
1Input Capture
2GUI Input Capture
1Keylogging
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
25B
MD529c860eaf6f36678345f0a9f6b9cc0d9
SHA17ffbfbc250be31fd70760cb9f0536e6e4f45c6ef
SHA256a1ea0cecec3d74e34e9874060753be7786995c8cc62e1daa420f930122f43eec
SHA512290f920dbee3dd59bd258ec398f0816ee24a620392ce8deaad0e6d1eaa1208f891393522d8125aea4aef9163f9011a02b3463e2d41a4e24bde065fcbad57ed20
-
Filesize
25B
MD5ba30336bf53d54ed3c0ea69dd545de8c
SHA1ce99c6724c75b93b7448e2d9fac16ca702a5711f
SHA2562d6988fb5afdaafc4e33fa1f71d6f10c95ab5a49a8ec820add5b13eef05439af
SHA512eea34ca526e03349e746d3687ea660b4748f0174fe2ffdb65161e232e08630b345e03329614852ce881a71362ba68575e9dd08fa361a416e5b2fb231e21a0a3e
-
Filesize
276B
MD5ce0e4f879f5b15e9eb39c5b5857e5faa
SHA1533855669d02e1432ee6cc84e91bffd354e08fa8
SHA2565932a069c46e8ec29327d9bf7c09bf33e262e4576996aef1e3cef9f3b97e50a2
SHA5128d7680aa2d97fbb103e554248542b1ced3dfc17fa3ede2b5007b4efd030bb410c60a8568ffe4129df1604d7059fe618d9f732e850211e8de7ee351062476d267
-
Filesize
57B
MD5412f4d2d71fbe7f5d80554e178d95bf3
SHA18d418fe5acdffbe0c434c92e15fd0acc10e0987e
SHA2560e44d3c83da573f79bb066eb0aa5eb70bb80301b9163619eb0beca52e6b8de18
SHA512d55d82a07fe15debafd659fa4dc38808251560673301455dd3cc94d5c80b743732ca96a1558b8af7c4ba0895ecadc038082e5bc186120d9cfa4bcfd470d2f6df