Analysis
-
max time kernel
880s -
max time network
905s -
platform
android_x86 -
resource
android-x86-arm-20240624-en -
resource tags
-
submitted
13/01/2025, 11:29
General
-
Target
c0950c697eb7ec84d1406e258a137924b24ef22be460eaee9e4cc88b6a43cd3b.apk
-
Size
4.2MB
-
MD5
c60df2dcc8e5c990bcac34123e232f45
-
SHA1
53b688467668bb5ea3a0c97a0bec12edf82f3769
-
SHA256
c0950c697eb7ec84d1406e258a137924b24ef22be460eaee9e4cc88b6a43cd3b
-
SHA512
7a9b88ee04d3b885879aa17bf5709ccc2f7524b8cce2612103200126b1e37dcd6fcf8b52cde579dc79ed3fcd3d7a90f5da611dab4ba916755ba23222d2637405
-
SSDEEP
98304:lDxwlp3SgS0Dk8JaF/6SudPIqfSD0eXD0fD0pD0nA5D0lD0Dv8:lVup31DBJaF/TYPI2SDFDGDoDCMDEDKk
Malware Config
Signatures
-
Makes use of the framework's Accessibility service 4 TTPs 2 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Acquires the wake lock 1 IoCs
-
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
-
Performs UI accessibility actions on behalf of the user 1 TTPs 12 IoCs
Application may abuse the accessibility service to prevent their removal.
-
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
-
Requests accessing notifications (often used to intercept notifications before users become aware). 1 TTPs 1 IoCs
-
Requests allowing to install additional applications from unknown sources. 1 TTPs 1 IoCs
-
Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
-
Requests modifying system settings. 1 IoCs
-
Requests overlaying windows on top of other apps. 1 TTPs 1 IoCs
-
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
-
Checks CPU information 2 TTPs 1 IoCs
-
Checks memory information 2 TTPs 1 IoCs
Processes
-
com.com.androidrr1⤵
- Makes use of the framework's Accessibility service
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Performs UI accessibility actions on behalf of the user
- Queries the mobile country code (MCC)
- Requests accessing notifications (often used to intercept notifications before users become aware).
- Requests allowing to install additional applications from unknown sources.
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Requests modifying system settings.
- Requests overlaying windows on top of other apps.
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Checks CPU information
- Checks memory information
Network
MITRE ATT&CK Mobile v15
Persistence
Event Triggered Execution
1Broadcast Receivers
1Foreground Persistence
1Defense Evasion
Foreground Persistence
1Hide Artifacts
1User Evasion
1Impair Defenses
1Prevent Application Removal
1Input Injection
1Subvert Trust Controls
1Code Signing Policy Modification
1Virtualization/Sandbox Evasion
2System Checks
2Credential Access
Access Notifications
1Input Capture
3GUI Input Capture
2Keylogging
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
12KB
MD5256df4f1f534234b1d510cd7ccd71dab
SHA1b7d93f7875c80eb6d55ca84ed3def780b6a84759
SHA2568aad7daf3faa9bce66f44dabe11613afeb8731704e93112d890573b9d909d5e3
SHA5123768be2a2f53ce428473f1d92c55342240994ad92fe6af315ba9322239a267fc059c7f0dd8f156c395dcfa5841c257c5158c7fabd28b6ef342fcc2e01b709ffc
-
Filesize
4KB
MD524815b80325d6a52a5a4663ba1f85d21
SHA1300b7ac83e8bda4225d5e4daa6bd0e7b640136ba
SHA256e536c2307655f1145a41e3bdf9baa12c28d1aa4b189e4ab4d79a9d662fc9dee7
SHA512ebed5cf3e67f53b8112ef0541f3110db3462d4684cf92ff7bfe5b232d53a9cab5b4a42d5d1591d66b9501d78f068c059ffadb42d9d0b58261fcb2bf585ade1e4
-
Filesize
4KB
MD5a6edaf5d196cbe37001c442300f0259f
SHA198ac268b72517e5e7d31bdc5795f2c44e9190a16
SHA256f685855220b0a9c9d1814a752ea4091d8cc46f19eedf10de4db5c667c5256a3d
SHA51268e4a76f7ecc880a83618af80401a9bbd7f2782a730fe16d8238ccae466d6f51778bce0b1a6460335c07aa9671f0838b65fb665f4a251f6657eec2ed7ed1b87a
-
Filesize
32KB
MD5bb7df04e1b0a2570657527a7e108ae23
SHA15188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA256c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
SHA512768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012
-
Filesize
121KB
MD57b38720a0352dffa26411726c72dd2b0
SHA1b15e687f42abcdc12427f146a3115ef2259211f8
SHA2562013f490d45638cada331b3474ed65b9a43cec60da773accc98332e58c06336d
SHA5120df28f87da4f9beb3ca8c108f54021a2a1a1434771abbb5ba67a2736097f2287b05e5220a33e92c42ee13ecae1144714a422b986763712794f69e65bc44c83e3
-
Filesize
11B
MD51b65c10c6215685f9d621d797f911373
SHA1cc50aaed5cd521a62ec8cf9fe0413153ec90f265
SHA2562230c2b2787663a054c47450ecd1718f0296853ad768b8e5d306ecb912685e89
SHA5125a9139f295dbe384b1584eff5c11f3f86759232f7b661b75f27fe92b996b4cdc0552e315f79b26f5f2c1f91756d9ae04cf0c3675b6172e91a3d373b9b314496f
