Analysis
-
max time kernel
149s -
max time network
151s -
platform
android-10_x64 -
resource
android-x64-20240910-en -
resource tags
-
submitted
12-12-2024 02:31
General
-
Target
8469ec91f9058c03527dd55b2778864c5c11588ef2e1b7ba5938a4c3dacf7258.apk
-
Size
3.7MB
-
MD5
d15d3744e57d220dd297896f4b93eaa4
-
SHA1
83ea1f9a07a0f923729d46d6e830831f6f41b3e2
-
SHA256
8469ec91f9058c03527dd55b2778864c5c11588ef2e1b7ba5938a4c3dacf7258
-
SHA512
18bcf0fe4dbd088b440d03f454b0a8bb10b10d23b3e3fb0581c6ceb028d8d369d4fec7aea9363dcf3f0160f36bc02b9f16f6a433f9728e35ff6a5cc08d5f39d7
-
SSDEEP
98304:CieaIXa6MQc+3cP6JEtUV2zmy6mz/zBbTP0twsRP8:CcIBc+06Jhe1z5AY
Malware Config
Signatures
-
Makes use of the framework's Accessibility service 4 TTPs 3 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Acquires the wake lock 1 IoCs
-
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
-
Performs UI accessibility actions on behalf of the user 1 TTPs 4 IoCs
Application may abuse the accessibility service to prevent their removal.
-
Queries information about active data network 1 TTPs 1 IoCs
-
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
-
Schedules tasks to execute at a specified time 1 TTPs 1 IoCs
Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.
Processes
-
rb.dig.basket1⤵
- Makes use of the framework's Accessibility service
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Performs UI accessibility actions on behalf of the user
- Queries information about active data network
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Schedules tasks to execute at a specified time
Network
MITRE ATT&CK Mobile v15
Persistence
Event Triggered Execution
1Broadcast Receivers
1Foreground Persistence
1Scheduled Task/Job
1Defense Evasion
Foreground Persistence
1Impair Defenses
1Prevent Application Removal
1Input Injection
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
29B
MD516ef61d26203494d70c0b1e1d17c4b04
SHA1d7f740c9af5b0d4b1e1f6a496fce3067c05c27c0
SHA2569ef6b83d9bb205c5130314849b4905b527538230dfcc2821aec12bb07a071448
SHA512c8c10edcc8ef7955954994e4f788493483b368a5e653a527610d9e85c2de4513a04b731201ce498653c8b19bde732c8c4d7916a0914d3d033b1c08884740daa1
-
Filesize
29B
MD59591164fdc2fbc31b76f223ceca4f825
SHA195177eaef594c084f6a9456788f3b8e566001fe4
SHA256d1d43790935e4c13d559cc9dd152b0614aeb00222d43eed8d23978178a4c6255
SHA512cc0a0f1168d139e243a16dafb6949451e57a13553ae50c951858f240de3f2d81e2865a50ebeb48647152571edae85f457934924ac677909232c7ec9798693cf4
-
Filesize
25B
MD5ba30336bf53d54ed3c0ea69dd545de8c
SHA1ce99c6724c75b93b7448e2d9fac16ca702a5711f
SHA2562d6988fb5afdaafc4e33fa1f71d6f10c95ab5a49a8ec820add5b13eef05439af
SHA512eea34ca526e03349e746d3687ea660b4748f0174fe2ffdb65161e232e08630b345e03329614852ce881a71362ba68575e9dd08fa361a416e5b2fb231e21a0a3e
-
Filesize
284B
MD5cc3d9dfe54696669a52e3315c0533bb3
SHA1ffe67b366ef9e1ecd0a259d7376d8156ae682d20
SHA256fd1c8587c9a5cf251d59a689c86f8b1b7118ebb93c9a4d0518c50337ffc0c791
SHA5128009879659f7a897ea0b01944fd86724156d80694c5535229b940c62ed90e4d9f410e88da87abbaeef4bb32bd75a001ececb9aee29ddc139479c0f4f32965204