62b002528c334cec9d29d6126ef1b935d10f3b1796cb6380254045189553185d

General

Target

ready.apk
Size

6.2MB
MD5

24d0f3802c0891d625fac917a940936c
SHA1

36ad393f4687a676efb2fc0d62a6532c17eb89ab
SHA256

62b002528c334cec9d29d6126ef1b935d10f3b1796cb6380254045189553185d
SHA512

23f65fbce631f3f97eb65f4dbb01b0495ef84a50de5bbfe4bffbfc66040b83480678b1071e2c9d49ba4681a972dc04304e81570f68669be507b93c4607029fd7
SSDEEP

24576:lXvLvTSt4jfa4zBj2mFXs8WFuiWUFutbF:lXvFO4zBKmFaFuHtp

Score

7^/10

collection credential_access defense_evasion discovery execution impact persistence

Malware Config

Signatures

Makes use of the framework's Accessibility service 4 TTPs 3 IoCs

Retrieves information displayed on the phone screen using AccessibilityService.

collection defense_evasion credential_access

Input Injection

T1516

Screen Capture

T1513

Keylogging

T1417.001

GUI Input Capture

T1417.002

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId	vessel.wax.phrases
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	vessel.wax.phrases
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByText	vessel.wax.phrases

Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs

Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.

collection credential_access impact

Clipboard Data

T1414

Transmitted Data Manipulation

T1641.001

description	ioc	Process
Framework service call	android.content.IClipboard.addPrimaryClipChangedListener	vessel.wax.phrases

Acquires the wake lock 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	vessel.wax.phrases

Queries information about active data network 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	vessel.wax.phrases

Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs

defense_evasion

User Evasion

T1628.002

description	ioc	Process
Intent action	android.settings.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS	vessel.wax.phrases

Schedules tasks to execute at a specified time 1 TTPs 1 IoCs

Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.

execution persistence

Scheduled Task/Job

T1603

description	ioc	Process
Framework service call	android.app.job.IJobScheduler.schedule	vessel.wax.phrases

Checks CPU information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	vessel.wax.phrases

Checks memory information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	vessel.wax.phrases

vessel.wax.phrases
1⤵
- Makes use of the framework's Accessibility service
- Obtains sensitive information copied to the device clipboard
- Acquires the wake lock
- Queries information about active data network
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Schedules tasks to execute at a specified time
- Checks CPU information
- Checks memory information
PID:4333

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Scheduled Task/Job

1

T1603

Persistence

Scheduled Task/Job

1

T1603

Privilege Escalation

Defense Evasion

Hide Artifacts

1

T1628

User Evasion

Input Injection

Virtualization/Sandbox Evasion

2

T1633

System Checks

2

T1633.001

Credential Access

Clipboard Data

1

T1414

Input Capture

2

T1417

GUI Input Capture

1

T1417.002

Keylogging

1

T1417.001

Discovery

System Information Discovery

2

T1426

System Network Connections Discovery

1

T1421

Lateral Movement

Collection

Clipboard Data

1

T1414

Input Capture

2

T1417

GUI Input Capture

1

T1417.002

Keylogging

Screen Capture

Command and Control

Exfiltration

Impact

Data Manipulation

1

T1641

Transmitted Data Manipulation

Input Injection

Replay Monitor

Loading Replay Monitor...

Downloads

/storage/emulated/0/Config/sys/apps/log/log-2025-01-28.txt

Filesize
33B

MD5
da25c7bff55a2936a9cb811d9fe27d93

SHA1
87711aa4a1ee842a6d0cf50a254c742e853b48a5

SHA256
49ecccba597e47651a3dc051292ed5b1c89a9c36a0e85bff287c2127b3330be5

SHA512
51d114639fee48a61618964fb064562b7cf3b1dc29accce57ab1e99f9fb6593c4727671ee4a23caba7f157adf294ef5734ec6f910f596f35b4c2ed7231f76c6c

Download Submit
/storage/emulated/0/Config/sys/apps/log/log-2025-01-28.txt

Filesize
29B

MD5
b9b530e2448252311640bbecb69b796a

SHA1
215ede46fb42a68a7ae84c3019acb3019668a46c

SHA256
5a290151305de1ec4f790cd8ada8bd68c076a2c4ed497c40a519509659b65150

SHA512
5834499307946d130887067b2f837ddfef7fdfe3a7e5ed8977eb14c2dc1ab328334da35ed4c978e20b3e6b28ff30dbd12f0430f4b7c831481f339d360c260919

Download Submit
/storage/emulated/0/Config/sys/apps/log/log-2025-01-28.txt

Filesize
49B

MD5
6053d0e988f346a622fcd6e371de0caa

SHA1
b2921a361b5bd197c7054b8921dd9dd247333eed

SHA256
aaf38a9886fcbbfdbe6b19c7e4bc1bc8797e347014921351396c7219a60c4668

SHA512
f8554dc6698fbe23ddc92a5d17ff5a4c57055e0b6241ccc148ba3a95075af85a76722f90c0b679a2b146a46149f4ec79c36ef7659c6749cd965a4d2f234d02c5

Download Submit
/storage/emulated/0/Config/sys/apps/log/log-2025-01-28.txt

Filesize
33B

MD5
9f190570b03153e8b0fc609cfcdcf975

SHA1
d17d6d8015f21ac3305036ab400a3226cca196ba

SHA256
ea66d2d198b22f2b2dcdf9dad0fb761916fb7d681e433252a572ad25e25ad5b4

SHA512
0b7e5fc6a764adebbd12a54e1772593f903af7a27d75db2516d6ddf49123b675b198f33e9f89e4c7730614fc2e572a7962310838caf0ee326051a37d6efde10d

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads