Analysis
-
max time kernel
146s -
max time network
151s -
platform
android-9_x86 -
resource
android-x86-arm-20240910-en -
resource tags
-
submitted
16-01-2025 22:09
General
-
Target
ea7b3a0433572a338633f600fdab8db90ad065e2f39aba69d3b5cfc64e441db6.apk
-
Size
108KB
-
MD5
1ac21e515004e1cd4fd176b2e33c8a01
-
SHA1
538f76d1eef90e8badf05b86cf6f53393fc6bb54
-
SHA256
ea7b3a0433572a338633f600fdab8db90ad065e2f39aba69d3b5cfc64e441db6
-
SHA512
5c622c8ed2582755dffdf69e520205f1b571291dcf1296a2519b6b2f4c63c4eb25f975fe510c6635d1729da68dcbb76633d0ee0414aa4d450b3726ea611a0664
-
SSDEEP
3072:4cttGISZvMI+p/F8l6IO3f8ZbwcYklkGOQ:4yGImR+pt8l613kZbwcYNGf
Malware Config
Signatures
-
Removes its main activity from the application launcher 1 TTPs 1 IoCs
-
Loads dropped Dex/Jar 1 TTPs 4 IoCs
Runs executable file dropped to the device during analysis.
-
Acquires the wake lock 1 IoCs
-
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
-
Performs UI accessibility actions on behalf of the user 1 TTPs 2 IoCs
Application may abuse the accessibility service to prevent their removal.
-
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
-
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
-
Checks CPU information 2 TTPs 1 IoCs
-
Checks memory information 2 TTPs 1 IoCs
Processes
-
com.zncpco.btqvrws1⤵
- Removes its main activity from the application launcher
- Loads dropped Dex/Jar
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Performs UI accessibility actions on behalf of the user
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Checks CPU information
- Checks memory information
-
/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.spy.info4444/files/Factory/Plugins/classes.dex --output-vdex-fd=43 --oat-fd=44 --oat-location=/data/user/0/com.spy.info4444/files/Factory/Plugins/oat/x86/classes.odex --compiler-filter=quicken --class-loader-context=&2⤵
- Loads dropped Dex/Jar
-
Network
MITRE ATT&CK Mobile v15
Persistence
Event Triggered Execution
1Broadcast Receivers
1Foreground Persistence
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
172KB
MD5c900cfad2d2b5520d02a27d7e999f607
SHA125509954c1477f153f02fe00419578c6dc9ee5fa
SHA25656fb95b777ddf2a2cc08382a8954c33bcda9588c9f48d99c771b5d5dcdfaa717
SHA512589f03ff86b1d13e50587e133bc7b24d79c0d698f4782fb5325bc977be1a586751821c5366dec93f08c4fffeaff67274827668adb42f0a75aee6091f0d23f8b8
-
Filesize
172KB
MD50fac43824bf1c289e5e90e9bfd18c3f7
SHA16bf8d1f51cb503b4a0911f028c56f08f976b4812
SHA2564477dba170e21b97067ccc39493c674351b43829205e14439c79be4cdf6126b8
SHA512f31798cf7bdaae5aa049faf3c977dbe54b677b6c7cdaf74cfc10b641a0d103df1288578ffbb8c224e66086f461b6fd0a32ea992901e722a6f463d016970cb8b9