Analysis
-
max time kernel
121s -
max time network
130s -
platform
android-10_x64 -
resource
android-x64-20240910-en -
resource tags
arch:x64arch:x86image:android-x64-20240910-enlocale:en-usos:android-10-x64system -
submitted
23-01-2025 22:06
Behavioral task
behavioral1
Sample
c49c238735d7ac11e95449ebabffec7581cc74dba8090790d53f1fe4c574d434.apk
Resource
android-x86-arm-20240910-en
Behavioral task
behavioral2
Sample
c49c238735d7ac11e95449ebabffec7581cc74dba8090790d53f1fe4c574d434.apk
Resource
android-x64-20240910-en
Behavioral task
behavioral3
Sample
c49c238735d7ac11e95449ebabffec7581cc74dba8090790d53f1fe4c574d434.apk
Resource
android-x64-arm64-20240624-en
Behavioral task
behavioral4
Sample
up.apk
Resource
android-x86-arm-20240910-en
Behavioral task
behavioral5
Sample
up.apk
Resource
android-x64-20240910-en
Behavioral task
behavioral6
Sample
up.apk
Resource
android-x64-arm64-20240624-en
General
-
Target
up.apk
-
Size
3.9MB
-
MD5
c5fe2c9a190f00a492120278104f011a
-
SHA1
b9dce8c9c890746ffdd63a2760d087327ca074fd
-
SHA256
18f5f817288f48fa4285e916a2ee3ecf78591b46eb341f5ab6ca8805bfcd502c
-
SHA512
b0f5114cf1272d3093532f9e91425156320240561c87668dc1e29b90097d956666a10d08b6c8c50196721b947e274f0095982d8ffe389b6b2aab015631ffe590
-
SSDEEP
98304:/v6ufpJO5RdxBmOtOAenID1PQl83kgPRM+jLVv:/vBmRdxUOtOAenIDuBQMgVv
Malware Config
Signatures
-
Acquires the wake lock 1 IoCs
description ioc Process Framework service call android.os.IPowerManager.acquireWakeLock com.metabolizability.sunbathe -
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
description ioc Process Framework service call android.app.IActivityManager.setServiceForeground com.metabolizability.sunbathe -
Performs UI accessibility actions on behalf of the user 1 TTPs 1 IoCs
Application may abuse the accessibility service to prevent their removal.
ioc Process android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction com.metabolizability.sunbathe -
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
description ioc Process Framework API call javax.crypto.Cipher.doFinal com.metabolizability.sunbathe