Analysis
-
max time kernel
55s -
max time network
57s -
platform
android_x86 -
resource
android-x86-arm-20240624-en -
resource tags
-
submitted
28-01-2025 09:55
General
-
Target
ready.apk
-
Size
6.2MB
-
MD5
24d0f3802c0891d625fac917a940936c
-
SHA1
36ad393f4687a676efb2fc0d62a6532c17eb89ab
-
SHA256
62b002528c334cec9d29d6126ef1b935d10f3b1796cb6380254045189553185d
-
SHA512
23f65fbce631f3f97eb65f4dbb01b0495ef84a50de5bbfe4bffbfc66040b83480678b1071e2c9d49ba4681a972dc04304e81570f68669be507b93c4607029fd7
-
SSDEEP
24576:lXvLvTSt4jfa4zBj2mFXs8WFuiWUFutbF:lXvFO4zBKmFaFuHtp
Malware Config
Signatures
-
Makes use of the framework's Accessibility service 4 TTPs 3 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Acquires the wake lock 1 IoCs
-
Queries information about active data network 1 TTPs 1 IoCs
-
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
-
Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
-
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
-
Schedules tasks to execute at a specified time 1 TTPs 1 IoCs
Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.
-
Checks CPU information 2 TTPs 1 IoCs
-
Checks memory information 2 TTPs 1 IoCs
Processes
-
vessel.wax.phrases1⤵
- Makes use of the framework's Accessibility service
- Acquires the wake lock
- Queries information about active data network
- Queries the mobile country code (MCC)
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Schedules tasks to execute at a specified time
- Checks CPU information
- Checks memory information
Network
MITRE ATT&CK Mobile v15
Persistence
Event Triggered Execution
1Broadcast Receivers
1Scheduled Task/Job
1Defense Evasion
Hide Artifacts
1User Evasion
1Input Injection
1Virtualization/Sandbox Evasion
2System Checks
2Discovery
System Information Discovery
2System Network Configuration Discovery
1System Network Connections Discovery
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
33B
MD5da25c7bff55a2936a9cb811d9fe27d93
SHA187711aa4a1ee842a6d0cf50a254c742e853b48a5
SHA25649ecccba597e47651a3dc051292ed5b1c89a9c36a0e85bff287c2127b3330be5
SHA51251d114639fee48a61618964fb064562b7cf3b1dc29accce57ab1e99f9fb6593c4727671ee4a23caba7f157adf294ef5734ec6f910f596f35b4c2ed7231f76c6c
-
Filesize
29B
MD5c9db0aece56267f06c34e62d03659b4a
SHA1e52a55ea4e5a0d30d70e90a5f5833a39370609d9
SHA256d77bace5ecc67118face00462acf4fdb6724b5a1647a37b1283e8ca8d316ed80
SHA512f8f1b07bbfe3837598288ac5935e7ad7e7ccaabbeb90b41903717a62d69a37cbbcc7a9ab63ada7b714f31a333270fd626abf40a27e26fad2a909e12a0d6468b2
-
Filesize
49B
MD56053d0e988f346a622fcd6e371de0caa
SHA1b2921a361b5bd197c7054b8921dd9dd247333eed
SHA256aaf38a9886fcbbfdbe6b19c7e4bc1bc8797e347014921351396c7219a60c4668
SHA512f8554dc6698fbe23ddc92a5d17ff5a4c57055e0b6241ccc148ba3a95075af85a76722f90c0b679a2b146a46149f4ec79c36ef7659c6749cd965a4d2f234d02c5
-
Filesize
33B
MD59f190570b03153e8b0fc609cfcdcf975
SHA1d17d6d8015f21ac3305036ab400a3226cca196ba
SHA256ea66d2d198b22f2b2dcdf9dad0fb761916fb7d681e433252a572ad25e25ad5b4
SHA5120b7e5fc6a764adebbd12a54e1772593f903af7a27d75db2516d6ddf49123b675b198f33e9f89e4c7730614fc2e572a7962310838caf0ee326051a37d6efde10d
-
Filesize
53B
MD5919de58745c9f5df44813558082c785b
SHA1297c7306c0065ee941b5f04264563ff08907db41
SHA2563381f3d99bb0817ad8194b1f2e1e16bd636dd5bb8d33c8abeb5f63bc7dfc966a
SHA51257b79ad0b0b885275e8f058078ab5965d629fca649308c43e05c5ca0a5750d4d90679b4860c84f489dc5527358881b74300036bdecc2490ca918703247b5e4fe