Analysis

  • max time kernel
    149s
  • max time network
    155s
  • platform
    android_x64
  • resource
    android-x64-20240624-en
  • resource tags

    androidarch:x64arch:x86image:android-x64-20240624-enlocale:en-usos:android-10-x64system
  • submitted
    17-02-2025 17:30

General

  • Target

    ready.apk

  • Size

    9.4MB

  • MD5

    b5b733fe818647c731a8e5f1f839c332

  • SHA1

    078e18aadc08dd26e410785426ab19ede31a1a67

  • SHA256

    84298b63d63c59ba63775367bbc615a0fa1aeb2b9f02cb4a2b664f611aaa5067

  • SHA512

    5e7b87e99550b02e371584b081fa0a731d3d77f3b42a992b0d5e47c5b74beaae53e202d6452caff7b15c76e88f7aa5c4650f0ed2c3fa87e4143fe36f63aa5606

  • SSDEEP

    98304:ENNGh4aOCizJl4Ir6COvecaLWFDauKmzxzB3TE0tlp3C:Ee4ZR4IrDOWcf+ulzn3+

Malware Config

Signatures

  • Makes use of the framework's Accessibility service 4 TTPs 1 IoCs

    Retrieves information displayed on the phone screen using AccessibilityService.

  • Acquires the wake lock 1 IoCs
  • Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

    Application may abuse the framework's foreground service to continue running in the foreground.

  • Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
  • Schedules tasks to execute at a specified time 1 TTPs 1 IoCs

    Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.

Processes

  • zealand.barry.lace
    1⤵
    • Makes use of the framework's Accessibility service
    • Acquires the wake lock
    • Makes use of the framework's foreground persistence service
    • Registers a broadcast receiver at runtime (usually for listening for system events)
    • Schedules tasks to execute at a specified time
    PID:4967

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • /storage/emulated/0/Config/sys/apps/log/log-2025-02-17.txt

    Filesize

    13B

    MD5

    de2c41a51ee9246eb1708f65b511add0

    SHA1

    2f442d634c8a18760a232c8829d4b5d74a52f074

    SHA256

    ad2d914ca347cd1930e32f21c6d5448c34104bea181b93abc85ec518985653ab

    SHA512

    7cdfbd001594503644e9ed80ae852f90ef9e841a8382e2eec6979e149a2c400a3b83055d205b4d1d66e1600e5127482932d5127eb5800d35a4ee5673fe34d84a

  • /storage/emulated/0/Config/sys/apps/log/log-2025-02-17.txt

    Filesize

    29B

    MD5

    58289ccf28520f001ae0d5e744f12cbc

    SHA1

    14d6c4ce740676b33f72081d547aa57c73e78f7c

    SHA256

    f4972706b56ff8fe17c1d86943cb071e3457f2c91adaa8a8703c730e521cd6ec

    SHA512

    785b398af90bdfbb226bb1015390aa417aacc476a47996848dcf83ddf9b44d175264a162fe517f2bf94e02819789b33b91df7f3f77f39ee778f68693d90fda97

  • /storage/emulated/0/Config/sys/apps/log/log-2025-02-17.txt

    Filesize

    57B

    MD5

    8d7fce2a07275bbbf1dd7c03c0e1309d

    SHA1

    900ff7a6c614e8e7291dbb36d1af83451be06dba

    SHA256

    b6ed245284d9fbf017a33f1bd0af271c463bdf593ee50f270ac2305b6746fe37

    SHA512

    e1f365e528d7dc6bfc2e11df05f0f917a44a196eb09dbed88d142a1dcfea83501d0319c7c53a2eba237827458dc31de2417f587ccb80f7980d7e0d3061c7f265