Analysis
-
max time kernel
149s -
max time network
154s -
platform
android_x64 -
resource
android-x64-arm64-20240624-en -
resource tags
androidarch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20240624-enlocale:en-usos:android-11-x64system -
submitted
16-01-2025 11:22
Behavioral task
behavioral1
Sample
Wizard (3).apk
Resource
android-x86-arm-20240624-en
Behavioral task
behavioral2
Sample
Wizard (3).apk
Resource
android-x64-20240624-en
Behavioral task
behavioral3
Sample
Wizard (3).apk
Resource
android-x64-arm64-20240624-en
General
-
Target
Wizard (3).apk
-
Size
4.4MB
-
MD5
003bbc400fc420307858bae7dd751aae
-
SHA1
0919f82b8e0b613d6fd783df0afe98807b9dc269
-
SHA256
991785b7cebd464daa49a268ffa692d01c332a20efb74e07f7aa0a832e2efd04
-
SHA512
21b4287cc6887e2a177e5d9422b1d66d586dbeffd6c57fa7fb4a50d3e15661503a8174ca9a5aeed8c8dd20973238ba88b8fe94e562394889f404addea224bddd
-
SSDEEP
98304:NrhXzBCTLmzT30to7G1RskuL8/sMCM3J3gUVm0daNxjvcMZD7YZkI:0azso7dkC8/si3J33INxrXZQZj
Malware Config
Signatures
-
Makes use of the framework's Accessibility service 4 TTPs 1 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
description ioc Process Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId ground.displays.commander -
Acquires the wake lock 1 IoCs
description ioc Process Framework service call android.os.IPowerManager.acquireWakeLock ground.displays.commander -
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
description ioc Process Framework service call android.app.IActivityManager.setServiceForeground ground.displays.commander -
Schedules tasks to execute at a specified time 1 TTPs 1 IoCs
Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.
description ioc Process Framework service call android.app.job.IJobScheduler.schedule ground.displays.commander
Processes
Network
MITRE ATT&CK Mobile v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
21B
MD53a1d8698c889a5b2caba09c5e791d07b
SHA1a160952971b576279187f37074fd898201518fba
SHA2564320b73c5543394b710ff2722d37920fffae43c2552a1973dba24b9588c556b5
SHA512cdced6d5bfb30b5873501967a66a3bb29302e2be032586145d4923c422a53fd9e0148497fbeb88a944b1c2f1ce28c8646982ea2acb386dad951b4916172fa8f6
-
Filesize
13B
MD5de2c41a51ee9246eb1708f65b511add0
SHA12f442d634c8a18760a232c8829d4b5d74a52f074
SHA256ad2d914ca347cd1930e32f21c6d5448c34104bea181b93abc85ec518985653ab
SHA5127cdfbd001594503644e9ed80ae852f90ef9e841a8382e2eec6979e149a2c400a3b83055d205b4d1d66e1600e5127482932d5127eb5800d35a4ee5673fe34d84a
-
Filesize
25B
MD5bdb821a955117250611e94cd23842584
SHA181edcea1b44f94cfc140710c8410d0696b760c67
SHA256076eb89055ff3d929eb732e1002a0105652e628682a741151388ce1df3b6ec9d
SHA512e52ffed4ee84acc414c530c239c8876d9e99c1f2b2c7626c0ed7fbe0c59b9cb8f8a5e9e983541bea3dfdb849dd3b9593df054c2482ed8bcda7c70ebd960ca268