Analysis
-
max time kernel
121s -
max time network
151s -
platform
android-10_x64 -
resource
android-x64-20240910-en -
resource tags
arch:x64arch:x86image:android-x64-20240910-enlocale:en-usos:android-10-x64system -
submitted
18-12-2024 22:08
Behavioral task
behavioral1
Sample
7fef2c1490b7fb0b24eb516fc112ee4e4421e0d3b81c9d8429ca491e99401839.apk
Resource
android-x86-arm-20240910-en
Behavioral task
behavioral2
Sample
7fef2c1490b7fb0b24eb516fc112ee4e4421e0d3b81c9d8429ca491e99401839.apk
Resource
android-x64-20240910-en
Behavioral task
behavioral3
Sample
7fef2c1490b7fb0b24eb516fc112ee4e4421e0d3b81c9d8429ca491e99401839.apk
Resource
android-x64-arm64-20240624-en
Behavioral task
behavioral4
Sample
app.apk
Resource
android-x86-arm-20240910-en
Behavioral task
behavioral5
Sample
app.apk
Resource
android-x64-20240910-en
Behavioral task
behavioral6
Sample
app.apk
Resource
android-x64-arm64-20240624-en
General
-
Target
app.apk
-
Size
3.9MB
-
MD5
df43afa90abfe87b5164598b9ffa03e7
-
SHA1
b5f3a4d5c492555bed4007ada9c94419f68959a8
-
SHA256
c30e1764bcdd4eda8915d1081f826b6f14e9668160e5d8f83b85dab3425a112a
-
SHA512
efa57bca8852b25c15d49517cabf460d5ddd83d14450ae737d33f25c6ffd98b59e98f2e2b91868be2a3563afc7fe5491e061ace55a4031b4bdeb62d35694bd66
-
SSDEEP
98304:XWXaQLUzSCA5gJjVABxaipkRPVYWxFWhnBdxHaZT:XWXJLUzigJjVABxKsWxU3d0ZT
Malware Config
Signatures
-
Acquires the wake lock 1 IoCs
description ioc Process Framework service call android.os.IPowerManager.acquireWakeLock com.phenomenon.psychofugal -
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
description ioc Process Framework service call android.app.IActivityManager.setServiceForeground com.phenomenon.psychofugal -
Performs UI accessibility actions on behalf of the user 1 TTPs 1 IoCs
Application may abuse the accessibility service to prevent their removal.
ioc Process android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction com.phenomenon.psychofugal -
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
description ioc Process Framework API call javax.crypto.Cipher.doFinal com.phenomenon.psychofugal