Analysis
-
max time kernel
140s -
max time network
154s -
platform
android_x64 -
resource
android-x64-20240624-en -
resource tags
-
submitted
08-01-2025 03:44
General
-
Target
c4ffcc636a0cd535ed86ae31c5311a9da7a0951f62b41f98d229d680a8ba574d.apk
-
Size
15.7MB
-
MD5
e2251311fc8acf5de09952fc451a752e
-
SHA1
f2c651584be93d84f7ea66e2c2c5dc4ebcb1d058
-
SHA256
c4ffcc636a0cd535ed86ae31c5311a9da7a0951f62b41f98d229d680a8ba574d
-
SHA512
f31add99459b749071ae7e5e940ac3e440aae5f17dfa335ffbae9f5ee00d434c7cd2448d94c74166a556fb503e56462541313c9861e41e6494dff37448088210
-
SSDEEP
24576:YoWgP6AWRuEjdpP4V9YeNkA1LJQX0qQxnh:lvYwPY09k0Xxh
Malware Config
Signatures
-
Removes its main activity from the application launcher 1 TTPs 1 IoCs
-
Makes use of the framework's Accessibility service 4 TTPs 2 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Acquires the wake lock 1 IoCs
-
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
-
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
-
Schedules tasks to execute at a specified time 1 TTPs 1 IoCs
Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.
Processes
-
permitted.condo.respectively1⤵
- Removes its main activity from the application launcher
- Makes use of the framework's Accessibility service
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Schedules tasks to execute at a specified time
Network
MITRE ATT&CK Mobile v15
Persistence
Event Triggered Execution
1Broadcast Receivers
1Foreground Persistence
1Scheduled Task/Job
1Defense Evasion
Foreground Persistence
1Hide Artifacts
1Suppress Application Icon
1Input Injection
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
33B
MD5c5eeec129870dd069e1b353ddcd6fe60
SHA17849bb170a85ab2f929efbadfff6cc6f06c3bd32
SHA25611f2fa2034cbff5198427931b6a3f2bb9be2d7076dfaea20e62a7b91d2326cbc
SHA5124a7b9db60cf8229cc6376deda79ff07b00bd60427925f7cc91060b9b8019c7fb620c651def20b928c6ec6eaed1976b441093a1118795cc8632f6160e2347929a
-
Filesize
25B
MD5ba30336bf53d54ed3c0ea69dd545de8c
SHA1ce99c6724c75b93b7448e2d9fac16ca702a5711f
SHA2562d6988fb5afdaafc4e33fa1f71d6f10c95ab5a49a8ec820add5b13eef05439af
SHA512eea34ca526e03349e746d3687ea660b4748f0174fe2ffdb65161e232e08630b345e03329614852ce881a71362ba68575e9dd08fa361a416e5b2fb231e21a0a3e
-
Filesize
284B
MD5ee453d77603c551eae9ca4709d0e4f81
SHA1735e60ec270fed9eb8ef12cef35eddb3f8d66322
SHA2563e22f06551e4c66f22889f841b1843887b23ec2b5ab527399c7f0c8627f31cf8
SHA512e29ce47bfa4a6b213d610b5f5320c1b6ce747e7477b9a38da797f3f949a83a2f5773bf657496e3b35c595b8afaa26ddd838f475e2413804edce2990ef5fb1d08