Analysis
-
max time kernel
149s -
max time network
143s -
platform
android_x86 -
resource
android-x86-arm-20240624-en -
resource tags
-
submitted
28-01-2025 07:11
General
-
Target
e78cfa3bfdb11537f19234e57461feb904177a62539c6f8e458a8ba7a2d3609b.apk
-
Size
5.6MB
-
MD5
b02eeeffc37f1b3f1251f5bd8e30dbbb
-
SHA1
499ae345c686ea57e49ad3c34b894d37fd4867c4
-
SHA256
e78cfa3bfdb11537f19234e57461feb904177a62539c6f8e458a8ba7a2d3609b
-
SHA512
b8ee8f650f191ff181613eedb7a767b1b0e030c96e42dc35bfad930f83b5ef445b065664d691affcc178cebc4b7b66917876be1d1b9ab91c445d57ed0610d844
-
SSDEEP
98304:udA8WAlbPGjldPMmw7MdDR0hIHOuj6/GALtzBCTjmzQlu50t4:udA8nl7QyIHOujrCzQlH4
Malware Config
Signatures
-
Removes its main activity from the application launcher 1 TTPs 1 IoCs
-
Makes use of the framework's Accessibility service 4 TTPs 3 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
-
Acquires the wake lock 1 IoCs
-
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
-
Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
-
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
-
Schedules tasks to execute at a specified time 1 TTPs 1 IoCs
Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.
Processes
-
paid.any.savannah1⤵
- Removes its main activity from the application launcher
- Makes use of the framework's Accessibility service
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Schedules tasks to execute at a specified time
Network
MITRE ATT&CK Mobile v15
Persistence
Event Triggered Execution
1Broadcast Receivers
1Foreground Persistence
1Scheduled Task/Job
1Defense Evasion
Foreground Persistence
1Hide Artifacts
2Suppress Application Icon
1User Evasion
1Input Injection
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
21B
MD59bf2fabb079584245156b0128cf79f45
SHA165d776e7f158777e6a705eee334aae3dc05e6320
SHA2568f59fb8f34a9d0c730031f6b47de6f2dd3cd8057b7a711bd215d9e4f0002bcd0
SHA512129d1400db3998239c199dfd6eeae6d928f8073c8922a0e4caf38982e6906f3b1aa449fac87e4022e6fd3f8d631766e5348542f95c38d80776b7444dfb2cce8f
-
Filesize
21B
MD54158727d0b554d33c4dd7b481efd202f
SHA16e7bd178bc8b53fcb87a14a23fb712e262eb17f4
SHA25605288b8d0a82b9a73de68c27775cde5e4417bf7f608b91d305c6c32ca4399a9c
SHA512101d6d27490bd81e18213f388f8046440f3e5bb34c0802971f2a18dbd04b20225ed92000e139988c3297c5607059513afecdd5c258acaf4923878a5296cb4505
-
Filesize
29B
MD5de0b4e0c874a7a2c8c5c6574e049fe47
SHA1348bb82ef0c4607c5000545d57b83b3e95a1aa4c
SHA256b7da3af785008dd11218b3735ea7714dcef4710baf95f8ca23a83963dcb4884a
SHA5125e782f70716b48d222b9cbd6dd8ed43eb68987232e026a5f4781d47571ea3246298d094ef35b94aa6db00b55debf1b9a22b9af25fc5c33587522463b717b0a72
-
Filesize
25B
MD5ba30336bf53d54ed3c0ea69dd545de8c
SHA1ce99c6724c75b93b7448e2d9fac16ca702a5711f
SHA2562d6988fb5afdaafc4e33fa1f71d6f10c95ab5a49a8ec820add5b13eef05439af
SHA512eea34ca526e03349e746d3687ea660b4748f0174fe2ffdb65161e232e08630b345e03329614852ce881a71362ba68575e9dd08fa361a416e5b2fb231e21a0a3e
-
Filesize
276B
MD597120f7e1c9ba595d827fb5edd6c2aa7
SHA1a6e4f814c1a698730236f0b47f69d8c42c906ae3
SHA256aeafb66b5472876f1e09f8bf3bf98ac22616c5c71f03cba3bfce2e386df47de2
SHA512e71ca2d86e05100a9a0aa3df948ac1c7ccbbcf3e15c9e686143ff5c21b998f8ce1833fe26b0976a1024b596e20bbc0d65f859231f679483029d9ee3f1d42b5e8