Analysis
-
max time kernel
148s -
max time network
152s -
platform
android-11_x64 -
resource
android-x64-arm64-20240910-en -
resource tags
-
submitted
09-02-2025 02:33
General
-
Target
7336d69db60d8b7a9113f3867c764e6b438afc7024b30610e465a7e9499ade68.apk
-
Size
3.2MB
-
MD5
1b69285c1135ad439baf7da8a7dae91b
-
SHA1
1899663f322d01050e33f37c478c08bc09294f0c
-
SHA256
7336d69db60d8b7a9113f3867c764e6b438afc7024b30610e465a7e9499ade68
-
SHA512
495ec0623cfebc141d2d1d522938d3e46db896ee12e5a7f8f9246d6e525c32995c047d3ea0e86e002d7e2ffee9e963bd90e3c38cf641cf1140ee688c938223e3
-
SSDEEP
98304:q95TvYRIKePOg6JxjwEBISSddXCEYp7k3XEjp:QxvYRIPOSe4XCF9
Malware Config
Signatures
-
Makes use of the framework's Accessibility service 4 TTPs 1 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs
Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
-
Acquires the wake lock 1 IoCs
-
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
-
Queries information about active data network 1 TTPs 1 IoCs
-
Schedules tasks to execute at a specified time 1 TTPs 1 IoCs
Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.
-
Checks CPU information 2 TTPs 1 IoCs
-
Checks memory information 2 TTPs 1 IoCs
Processes
-
com.xuanfeng.xubulpinn1⤵
- Makes use of the framework's Accessibility service
- Obtains sensitive information copied to the device clipboard
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Queries information about active data network
- Schedules tasks to execute at a specified time
- Checks CPU information
- Checks memory information
Network
MITRE ATT&CK Mobile v15
Defense Evasion
Foreground Persistence
1Input Injection
1Virtualization/Sandbox Evasion
2System Checks
2Credential Access
Clipboard Data
1Input Capture
2GUI Input Capture
1Keylogging
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
28B
MD5e156c2b8fc3be1af1c34ae17f7f455ea
SHA11bd10e12b6e73c591d68d94ad4c1592ef0ef29b9
SHA256f6ff44f9e787504e05d70cd47d05f898c2605eee72b1d6e66b8e09b54160bb2e
SHA512d9b32ea141d875c22609e86065d13f343a127ce7584a3cfc1de9bd2856e5291a7fec5a07b35f21bfffa0aa5636864f96f5929b73def8e57812b50be73a28ef1a
-
Filesize
20B
MD555b40caf775ad6dfcef011ee42b918ed
SHA1a42f81de19fe6889655c99fb10fddac473e986e9
SHA2565be69f5a72048dc2f1b36ca4d5d875bea2fc7779b9a42e469c5abd39c33e2444
SHA5125ab2a9b411ed298a679ad9a8a841427f4a22bad8e044fa0f113bf730beaeb90a87b5cd44a9b5d42f419e80cd0fa2d6db6fb601b613fba394bc7550c62eef5696
-
Filesize
20B
MD5984097c5510cb52a533f03d8ffdb5c1b
SHA1426b738b8924dc5b5d1668c84d4e9140a39af7e3
SHA256bb38ae7ff64830f6f337ddf19b9ede818e6bf34adc673b414ebd484acc383e00
SHA512edf35fba34a48d113dee83f84dbd6068c20fa1a76bb40861c239001108a16eb86ccb3e4663bafcde3c0ce5edf19da3a0beb2fc0bb5335fd6c291af88a09f178f
-
Filesize
28B
MD5a8bd60592f1a797dd4408a4f8b5189db
SHA10df8c2bdfae4b72c630e7dafdb391be76e3f639e
SHA256d621bcfc9fd87aee2d3905d38ed262a579b93442fa0f30abeb7bf57d91374127
SHA512fce160edff0bc4357341e0e47e857a36c946059548461b3fc640132cf620d61443283373348b595b1e2428a3939000480259e0a3e72c0650841c2adfb19c0e5d