Analysis
-
max time kernel
148s -
max time network
155s -
platform
android_x64 -
resource
android-x64-20240624-en -
resource tags
-
submitted
28-01-2025 07:11
General
-
Target
e78cfa3bfdb11537f19234e57461feb904177a62539c6f8e458a8ba7a2d3609b.apk
-
Size
5.6MB
-
MD5
b02eeeffc37f1b3f1251f5bd8e30dbbb
-
SHA1
499ae345c686ea57e49ad3c34b894d37fd4867c4
-
SHA256
e78cfa3bfdb11537f19234e57461feb904177a62539c6f8e458a8ba7a2d3609b
-
SHA512
b8ee8f650f191ff181613eedb7a767b1b0e030c96e42dc35bfad930f83b5ef445b065664d691affcc178cebc4b7b66917876be1d1b9ab91c445d57ed0610d844
-
SSDEEP
98304:udA8WAlbPGjldPMmw7MdDR0hIHOuj6/GALtzBCTjmzQlu50t4:udA8nl7QyIHOujrCzQlH4
Malware Config
Signatures
-
Removes its main activity from the application launcher 1 TTPs 1 IoCs
-
Makes use of the framework's Accessibility service 4 TTPs 3 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
-
Acquires the wake lock 1 IoCs
-
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
-
Performs UI accessibility actions on behalf of the user 1 TTPs 4 IoCs
Application may abuse the accessibility service to prevent their removal.
-
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
-
Schedules tasks to execute at a specified time 1 TTPs 1 IoCs
Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.
Processes
-
paid.any.savannah1⤵
- Removes its main activity from the application launcher
- Makes use of the framework's Accessibility service
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Performs UI accessibility actions on behalf of the user
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Schedules tasks to execute at a specified time
Network
MITRE ATT&CK Mobile v15
Persistence
Event Triggered Execution
1Broadcast Receivers
1Foreground Persistence
1Scheduled Task/Job
1Defense Evasion
Foreground Persistence
1Hide Artifacts
1Suppress Application Icon
1Impair Defenses
1Prevent Application Removal
1Input Injection
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
21B
MD54158727d0b554d33c4dd7b481efd202f
SHA16e7bd178bc8b53fcb87a14a23fb712e262eb17f4
SHA25605288b8d0a82b9a73de68c27775cde5e4417bf7f608b91d305c6c32ca4399a9c
SHA512101d6d27490bd81e18213f388f8046440f3e5bb34c0802971f2a18dbd04b20225ed92000e139988c3297c5607059513afecdd5c258acaf4923878a5296cb4505
-
Filesize
29B
MD5de0b4e0c874a7a2c8c5c6574e049fe47
SHA1348bb82ef0c4607c5000545d57b83b3e95a1aa4c
SHA256b7da3af785008dd11218b3735ea7714dcef4710baf95f8ca23a83963dcb4884a
SHA5125e782f70716b48d222b9cbd6dd8ed43eb68987232e026a5f4781d47571ea3246298d094ef35b94aa6db00b55debf1b9a22b9af25fc5c33587522463b717b0a72
-
Filesize
25B
MD5ba30336bf53d54ed3c0ea69dd545de8c
SHA1ce99c6724c75b93b7448e2d9fac16ca702a5711f
SHA2562d6988fb5afdaafc4e33fa1f71d6f10c95ab5a49a8ec820add5b13eef05439af
SHA512eea34ca526e03349e746d3687ea660b4748f0174fe2ffdb65161e232e08630b345e03329614852ce881a71362ba68575e9dd08fa361a416e5b2fb231e21a0a3e
-
Filesize
276B
MD526f182ee25ef2fd43941c6632b2db8f4
SHA15072a1d219ab3560e531bd4642f77f36ddab5a67
SHA256e6c869a5029534953324c5dbc47aaaeb04ed1ef897a9a78ae92349ee48ca6877
SHA51270916caa304039c40cbc0e32c4895e9a320d2131b2b463dc96011f06dba29d924de271265dcc82ca289060a56fc26d5cbbbd8fd868fac2d6818680bd2b3b099b