Analysis
-
max time kernel
149s -
max time network
155s -
platform
android_x64 -
resource
android-x64-20240624-en -
resource tags
-
submitted
03-12-2024 12:10
General
-
Target
ready.apk
-
Size
8.5MB
-
MD5
4857e7ed398ad9d26104a8bea3d37546
-
SHA1
9f9a36e14f295db6ade66a72ebd8d65c57bddb78
-
SHA256
b16f5faf52611fc8763fd8df9b330327fd964d6f21bf3357e29cb73d8d1ca912
-
SHA512
9eef2b956a8f69a352f6d61936b18a4c21794c87c246ee5c32ca84f0452ebe76af69338e55a57b281293070d5d2d5984976d5f2573e734c3ae6f90bd3bbfdd43
-
SSDEEP
49152:GRxN/yyAM6bvPDSj2pjB+qVRgjOnn3ehSUN4hmzHzdGGjQTO7HU/Yqh0cgQEfd:wxyDMaP2j2PrijMXxmzHzBkTN0tQy
Malware Config
Signatures
-
Makes use of the framework's Accessibility service 4 TTPs 3 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs
Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
-
Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
-
Acquires the wake lock 1 IoCs
-
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
-
Queries information about active data network 1 TTPs 1 IoCs
-
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
-
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
-
Schedules tasks to execute at a specified time 1 TTPs 1 IoCs
Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.
-
Checks memory information 2 TTPs 1 IoCs
Processes
-
institutes.ghost.assets1⤵
- Makes use of the framework's Accessibility service
- Obtains sensitive information copied to the device clipboard
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Queries information about active data network
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Schedules tasks to execute at a specified time
- Checks memory information
Network
MITRE ATT&CK Mobile v15
Persistence
Event Triggered Execution
1Broadcast Receivers
1Foreground Persistence
1Scheduled Task/Job
1Defense Evasion
Foreground Persistence
1Input Injection
1Virtualization/Sandbox Evasion
1System Checks
1Credential Access
Clipboard Data
1Input Capture
2GUI Input Capture
1Keylogging
1Discovery
Software Discovery
1Security Software Discovery
1System Information Discovery
1System Network Configuration Discovery
1System Network Connections Discovery
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
25B
MD529c860eaf6f36678345f0a9f6b9cc0d9
SHA17ffbfbc250be31fd70760cb9f0536e6e4f45c6ef
SHA256a1ea0cecec3d74e34e9874060753be7786995c8cc62e1daa420f930122f43eec
SHA512290f920dbee3dd59bd258ec398f0816ee24a620392ce8deaad0e6d1eaa1208f891393522d8125aea4aef9163f9011a02b3463e2d41a4e24bde065fcbad57ed20
-
Filesize
25B
MD5ba30336bf53d54ed3c0ea69dd545de8c
SHA1ce99c6724c75b93b7448e2d9fac16ca702a5711f
SHA2562d6988fb5afdaafc4e33fa1f71d6f10c95ab5a49a8ec820add5b13eef05439af
SHA512eea34ca526e03349e746d3687ea660b4748f0174fe2ffdb65161e232e08630b345e03329614852ce881a71362ba68575e9dd08fa361a416e5b2fb231e21a0a3e
-
Filesize
276B
MD5ce0e4f879f5b15e9eb39c5b5857e5faa
SHA1533855669d02e1432ee6cc84e91bffd354e08fa8
SHA2565932a069c46e8ec29327d9bf7c09bf33e262e4576996aef1e3cef9f3b97e50a2
SHA5128d7680aa2d97fbb103e554248542b1ced3dfc17fa3ede2b5007b4efd030bb410c60a8568ffe4129df1604d7059fe618d9f732e850211e8de7ee351062476d267
-
Filesize
33B
MD567bcc37a9b6aa7a023fcdd514f7670e8
SHA18545df8b54081ccc21fb117c107226107af02680
SHA256e174bd88d346084a09a8a7a725a58454c707259aa36beac5bd83f850cf1503c5
SHA512756aef13b043f8e5fe4c48c948b1aa949fe4e5bf4e833292ae736e1b94eaded3aa0fa08339f8d9246a7cf10a0a78b9b78c871a1fc2eef5c3593a904809bc5b01