Analysis
-
max time kernel
149s -
max time network
154s -
platform
android_x86 -
resource
android-x86-arm-20240624-en -
resource tags
-
submitted
10-01-2025 08:14
General
-
Target
Active Senior Trip.apk
-
Size
4.5MB
-
MD5
134e0dbf98f3ce6f374410c4e69de1dd
-
SHA1
3d914383dba8f945ac340e30961f61186958d4b0
-
SHA256
51ac0a11ba9ae5d95a74f598873f9dcccb483318166e9e330da56733d7a1677a
-
SHA512
24c1a5b3ab479bf88cdc77ed9c58932d20a91692febdba5bb884ac67ed6e33067f85c323d3aa5e44c918c22190593f34b6b106986a24b22f1ceb71d09afcd8d6
-
SSDEEP
98304:NHl2zBRTVmz1Q0tPnEMZwVo8r4/ahADwLX7cPheySlwoP06te21:N+YzJPnEMZSr9+ES4lwoP5p1
Malware Config
Signatures
-
Loads dropped Dex/Jar 1 TTPs 3 IoCs
Runs executable file dropped to the device during analysis.
-
Makes use of the framework's Accessibility service 4 TTPs 1 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Acquires the wake lock 1 IoCs
-
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
-
Requests enabling of the accessibility settings. 1 IoCs
-
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
-
Schedules tasks to execute at a specified time 1 TTPs 1 IoCs
Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.
Processes
-
about.worn.inn1⤵
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Requests enabling of the accessibility settings.
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Schedules tasks to execute at a specified time
Network
MITRE ATT&CK Mobile v15
Persistence
Event Triggered Execution
1Broadcast Receivers
1Foreground Persistence
1Scheduled Task/Job
1Defense Evasion
Download New Code at Runtime
1Foreground Persistence
1Input Injection
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
7KB
MD5effbc10b41f027e5c2130835d524c99d
SHA1affb65361d7a36d00e402ad869696578b5ac3259
SHA256566fb91b6bf186c05c4ec051aa2e2802961cbb158df24a8fecaa0678febece84
SHA512b2ddd0142a80663097e9b71d8d654d88382ef8f765c92f0c8fbf600f1174cb1b1e9e61088f954e609e6d2402fd4750b88945af7c1080018b991f2e6e6d9ad52a
-
Filesize
4KB
MD53748dfbaeae0d43d38471f14e4321dcd
SHA1a5a6dcb2e325479cb25a44cb66216e09a843666c
SHA2564830f1d48d41c7725686901a2d4f93a8ea722f6160dfecc6815ac85598e361db
SHA512bde4b86489abafb3a5aff955ce232367044b6fdf106ea02847c3dbd78e49a02dd7c63bf82c26a3b630962aad16a877ece85af74608909a37a89b0591e012625c
-
Filesize
3KB
MD5514d884ca8bb12d1b8f440f3e64c3f9f
SHA16242b72c85ce2a287e95fb2522afe1f559b277aa
SHA2565a9b87d66daf4ad4791d980d9c3270c7806bc18c89e323472a500fb8ebfefc5e
SHA512c18018ecb5742753f72dbe369c6f21b391b514a3d0dda2ef404cd53be299c42f3c774c7bec085d7c5713d42cf0fdb2f9e629d6cf5d635d3ca9271147e8420ac2
-
Filesize
268B
MD594bae4bb6403303bff82ae14aeb4330b
SHA149954c501cf815c0daedaf7ccbf74056df81bdc3
SHA256ffae8e81b13970edfcacb39422e0174893c259c08f08f327bf3f480078234227
SHA5122859f5de7d13483d5c31275952ab263020b9c0480efcc224a061e5d817793aad1e08efe8e1b983e608541d644b0ba3198e0ea4d6fc5a3282e87f04b43bf37b33
-
Filesize
13B
MD5de2c41a51ee9246eb1708f65b511add0
SHA12f442d634c8a18760a232c8829d4b5d74a52f074
SHA256ad2d914ca347cd1930e32f21c6d5448c34104bea181b93abc85ec518985653ab
SHA5127cdfbd001594503644e9ed80ae852f90ef9e841a8382e2eec6979e149a2c400a3b83055d205b4d1d66e1600e5127482932d5127eb5800d35a4ee5673fe34d84a
-
Filesize
25B
MD5ba30336bf53d54ed3c0ea69dd545de8c
SHA1ce99c6724c75b93b7448e2d9fac16ca702a5711f
SHA2562d6988fb5afdaafc4e33fa1f71d6f10c95ab5a49a8ec820add5b13eef05439af
SHA512eea34ca526e03349e746d3687ea660b4748f0174fe2ffdb65161e232e08630b345e03329614852ce881a71362ba68575e9dd08fa361a416e5b2fb231e21a0a3e