Analysis
-
max time kernel
144s -
max time network
150s -
platform
android-10_x64 -
resource
android-x64-20240910-en -
resource tags
-
submitted
16-01-2025 22:09
General
-
Target
ea7b3a0433572a338633f600fdab8db90ad065e2f39aba69d3b5cfc64e441db6.apk
-
Size
108KB
-
MD5
1ac21e515004e1cd4fd176b2e33c8a01
-
SHA1
538f76d1eef90e8badf05b86cf6f53393fc6bb54
-
SHA256
ea7b3a0433572a338633f600fdab8db90ad065e2f39aba69d3b5cfc64e441db6
-
SHA512
5c622c8ed2582755dffdf69e520205f1b571291dcf1296a2519b6b2f4c63c4eb25f975fe510c6635d1729da68dcbb76633d0ee0414aa4d450b3726ea611a0664
-
SSDEEP
3072:4cttGISZvMI+p/F8l6IO3f8ZbwcYklkGOQ:4yGImR+pt8l613kZbwcYNGf
Malware Config
Signatures
-
Removes its main activity from the application launcher 1 TTPs 1 IoCs
-
Loads dropped Dex/Jar 1 TTPs 3 IoCs
Runs executable file dropped to the device during analysis.
-
Makes use of the framework's Accessibility service 4 TTPs 2 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs
Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
-
Acquires the wake lock 1 IoCs
-
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
-
Performs UI accessibility actions on behalf of the user 1 TTPs 2 IoCs
Application may abuse the accessibility service to prevent their removal.
-
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
-
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
-
Checks CPU information 2 TTPs 1 IoCs
-
Checks memory information 2 TTPs 1 IoCs
Processes
-
com.zncpco.btqvrws1⤵
- Removes its main activity from the application launcher
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Obtains sensitive information copied to the device clipboard
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Performs UI accessibility actions on behalf of the user
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Checks CPU information
- Checks memory information
Network
MITRE ATT&CK Mobile v15
Persistence
Event Triggered Execution
1Broadcast Receivers
1Foreground Persistence
1Defense Evasion
Download New Code at Runtime
1Foreground Persistence
1Hide Artifacts
1Suppress Application Icon
1Impair Defenses
1Prevent Application Removal
1Input Injection
1Virtualization/Sandbox Evasion
2System Checks
2Credential Access
Clipboard Data
1Input Capture
2GUI Input Capture
1Keylogging
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
181B
MD51cad2e14facdec3a8c2399872446f2a9
SHA10adb9d986c73997cd08a8be20992218fc989e123
SHA2568b2e75b59e475fc23b25c3bc8a452c42400bef0bf2c3553d7e2689fbd718b032
SHA51291595cdbbf2c99b905bcd81806882694032511bb112abefff1ae91c66389d31b779f83cfb0389f06b81aa8797548f9ea2494ed8b808e39c826ff0a2920560873
-
Filesize
172KB
MD50fac43824bf1c289e5e90e9bfd18c3f7
SHA16bf8d1f51cb503b4a0911f028c56f08f976b4812
SHA2564477dba170e21b97067ccc39493c674351b43829205e14439c79be4cdf6126b8
SHA512f31798cf7bdaae5aa049faf3c977dbe54b677b6c7cdaf74cfc10b641a0d103df1288578ffbb8c224e66086f461b6fd0a32ea992901e722a6f463d016970cb8b9