Analysis
-
max time kernel
148s -
max time network
158s -
platform
android_x64 -
resource
android-x64-arm64-20240624-en -
resource tags
-
submitted
11-12-2024 09:21
General
-
Target
8fe8d1857f17dc03b0652e97666527b01.apk
-
Size
8.1MB
-
MD5
8fe8d1857f17dc03b0652e97666527b0
-
SHA1
d909c81f01d496fe804205b7830223def8b988e5
-
SHA256
cbae18e2cd6e55b407a61a684db7e81ee2846ea9910d7ed9dfbfaf2892ff4f88
-
SHA512
1a5b97a2683ac521b0bade9b3c237b6418a862478dd58ccbb175133f3e0dfb35260fdd5a26a2ef447521cba0a454c8edc65f05852186b56d3e372ad85100c867
-
SSDEEP
196608:p/+vzp7E9TogCAOONKJcLpuLqp8IwcFyWxBDlDmDPDXDC0D0DbDv/O:x+vzp7E9Y5ONRumqYZxNJibTFg/XO
Malware Config
Signatures
-
Makes use of the framework's Accessibility service 4 TTPs 2 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs
Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
-
Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
-
Acquires the wake lock 1 IoCs
-
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
-
Performs UI accessibility actions on behalf of the user 1 TTPs 64 IoCs
Application may abuse the accessibility service to prevent their removal.
-
Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.
-
Requests accessing notifications (often used to intercept notifications before users become aware). 1 TTPs 1 IoCs
-
Checks CPU information 2 TTPs 1 IoCs
-
Checks memory information 2 TTPs 1 IoCs
Processes
-
com.micaixamiappnueva.appapk1⤵
- Makes use of the framework's Accessibility service
- Obtains sensitive information copied to the device clipboard
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Performs UI accessibility actions on behalf of the user
- Queries information about the current Wi-Fi connection
- Requests accessing notifications (often used to intercept notifications before users become aware).
- Checks CPU information
- Checks memory information
Network
MITRE ATT&CK Mobile v15
Defense Evasion
Foreground Persistence
1Impair Defenses
1Prevent Application Removal
1Input Injection
1Virtualization/Sandbox Evasion
2System Checks
2Credential Access
Access Notifications
1Clipboard Data
1Input Capture
2GUI Input Capture
1Keylogging
1Discovery
Software Discovery
1Security Software Discovery
1System Information Discovery
2System Network Connections Discovery
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
428B
MD56ed38de9ae61bd0683c728ced49ba201
SHA1e8177573b42cdee69b1301b05096d08fc99a8c7e
SHA256215b87b2aa821a28c8e283633180f4ada02583e07226dd0aa6daaf551bea3299
SHA512046819f53f66a19182cce0fa43fa19e110317eb884525e3b6cecaa1d5becc84a3826b7d60038620fe61681550646451dbe267be3d4868c3fe8f802ba478dc3ed
-
Filesize
4B
MD5098f6bcd4621d373cade4e832627b4f6
SHA1a94a8fe5ccb19ba61c4c0873d391e987982fbbd3
SHA2569f86d081884c7d659a2feaa0c55ad015a3bf4f1b2b0b822cd15d6c15b0f00a08
SHA512ee26b0dd4af7e749aa1a8ee3c10ae9923f618980772e473f8819a5d4940e0db27ac185f8a0e1d5f84f88bc887fd67b143732c304cc5fa9ad8e6f57f50028a8ff
-
Filesize
44KB
MD5d5d190e1180c5e6858c40a93f7526f12
SHA10d054f2e34776c8d5bcfd54d743831b9919618fe
SHA256274fe3e82fc2630d99809afd6a1c64768a77ed69c04b33e0df6a292a5a042203
SHA5120d58df37359d6e35f02ef95e4edcfb05fac6c3bc57d1c3e56e49fa7b6c66aef3f99b383cb14dc5a01b52bc6a0d4685f275fb30279aa26e8339a5e0b8416ba85e
-
Filesize
7KB
MD5c1856fe66350f0e32bb443fe0e8b2060
SHA17c0d497ff5fa85fe3bf22f3ee2640cb6d97a0ba1
SHA256240a94549a5d7661093b0092a7c298870ecc868d45e1e257820f07084e4f2a3e
SHA5127150ec10595e04f9875c0c80707efcc03eb9e06163d588486bc5579d9e40d8446bf78790ee9de934ee1bb0a5b1e7568c72ba12cd6f3998f88344b9ebcad4e5fa
-
Filesize
1B
MD5c4ca4238a0b923820dcc509a6f75849b
SHA1356a192b7913b04c54574d18c28d46e6395428ab
SHA2566b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b
SHA5124dff4ea340f0a823f15d3f4f01ab62eae0e5da579ccb851f8db9dfe84c58b2b37b89903a740e1ee172da793a6e79d560e5f7f9bd058a12a280433ed6fa46510a
-
Filesize
11B
MD51b65c10c6215685f9d621d797f911373
SHA1cc50aaed5cd521a62ec8cf9fe0413153ec90f265
SHA2562230c2b2787663a054c47450ecd1718f0296853ad768b8e5d306ecb912685e89
SHA5125a9139f295dbe384b1584eff5c11f3f86759232f7b661b75f27fe92b996b4cdc0552e315f79b26f5f2c1f91756d9ae04cf0c3675b6172e91a3d373b9b314496f
