Analysis
-
max time kernel
149s -
max time network
153s -
platform
android_x64 -
resource
android-x64-20240624-en -
resource tags
-
submitted
03-12-2024 13:00
General
-
Target
ready.apk
-
Size
8.6MB
-
MD5
957a17d22cd95f08538c110dbe75cbac
-
SHA1
36de5d6b0a0391ba292488e90be11bf045ad8eb8
-
SHA256
6d316ee0f968cb999f17bb7ffcde4557c9a4e5bd56e50547e3a95682f86b4fb5
-
SHA512
4a8f4b0353edefa8ce0e2b8c8bbf097d907de1b7e3e89897bcf76b509c8bd07eb7bbbf1efc2f292808e362140b02a42fed3dbb05af14663b999b153beca5cc4e
-
SSDEEP
98304:3XBWxKvQVAP2pMt67M6sumznzB6T90t4HR2GE:gxg4AXM77spzsy7
Malware Config
Signatures
-
Makes use of the framework's Accessibility service 4 TTPs 3 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Acquires the wake lock 1 IoCs
-
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
-
Performs UI accessibility actions on behalf of the user 1 TTPs 4 IoCs
Application may abuse the accessibility service to prevent their removal.
-
Queries information about active data network 1 TTPs 1 IoCs
-
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
-
Schedules tasks to execute at a specified time 1 TTPs 1 IoCs
Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.
Processes
-
show.donald.spain1⤵
- Makes use of the framework's Accessibility service
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Performs UI accessibility actions on behalf of the user
- Queries information about active data network
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Schedules tasks to execute at a specified time
Network
MITRE ATT&CK Mobile v15
Persistence
Event Triggered Execution
1Broadcast Receivers
1Foreground Persistence
1Scheduled Task/Job
1Defense Evasion
Foreground Persistence
1Impair Defenses
1Prevent Application Removal
1Input Injection
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
29B
MD5ece45f8623243feea4df6c2fe45b36e1
SHA1ef24e005271d92ed255e24a40a15d94b0d5f6bd3
SHA256e011b2d4119782d41972729f76497925f6f503f6b87dbf8363a50d5134ff39a2
SHA51286e5a142bb1c4607af14414558fca4711e9a043842aef5add7229d2b49a640d43d62383729edd60869f26e2ad28218d48228303e358b56038267d8bdaf6353da
-
Filesize
33B
MD5cccac2c2a5ccbbc19de1e65f4a713fde
SHA18f81bdc29817ff1359ce9cf1f86a6e5ca6bd4839
SHA256b0a40190c703a9589642e774b871e2c82ccc0d47351d225d3cd39073b0ad4570
SHA5121356bc74b373ea3bd39fe7220019d85734ebcf632f30dfce7af89c80c744a1567ef2ec50d3476394665d302aa5ddee7debdbdef66ff5bc5b66ed7db3d6fc39d3
-
Filesize
231B
MD55863167dcd4c7e523d4d7e6f11c33195
SHA1a79b2f29872f369410c3a4fe1d3bc641ff945b7d
SHA2569d54a9825776c73592d6fb7d37e9e2a5f38ddaabf09502e3f4e561f5f9e91bd7
SHA512e4214e5fdcb2e3c0842aabac46352a32087fd379edd41717fd5f99325382235961af4cabb8d3c50ccff6905b0794f9f2addf256a93e9ad698368b36be4c4e4f6
-
Filesize
284B
MD5b2813113d1356179c7e81010f2e8a6ed
SHA1d3208a0343a1a2139d67c919b89777e5093a5593
SHA256ee75dc6b480122f15368034e8d798b0bb38617375b87c6d011364e021e2058a4
SHA512a17418ad8da2032e7e508c7ba0c86325d25613133785aba333d54a0c7a00bdb3ee54c56d193dffb690256130fd6a97ca9a1b4ee0537302d05df8261c62be6086