ad7edea231a4c057df19d0b552f64437aab5476801bb8d91af1e5fc4b40ddf7d

General

Target

ready.apk
Size

696KB
MD5

d9f290fb187ef934a1d537a8e4e23d4d
SHA1

e8ecb29ca4c3fbcf2c422e38ca5f5f42acbd1267
SHA256

ad7edea231a4c057df19d0b552f64437aab5476801bb8d91af1e5fc4b40ddf7d
SHA512

42733f2dcb466b381223fee1dea794d2cc67a39ef4afb409d8f0fda8510a1f368e266ba075457306dfe069d799fda246fd09acb24a65fdf2ec9a063b924dfb0f
SSDEEP

12288:9QmhJeRll5/MHgvhjiZQNT3+HamhQR5S6Vm+6usT3cgtN0Fd06Rq21YgKZtWDYPI:9QrRllK8+ZQNOhTy6HT3SFd0GNtxYQ

Score

7^/10

collection credential_access defense_evasion discovery evasion persistence

Malware Config

Signatures

Makes use of the framework's Accessibility service 4 TTPs 1 IoCs

Retrieves information displayed on the phone screen using AccessibilityService.

collection defense_evasion credential_access

Input Injection

T1516

Screen Capture

T1513

Keylogging

T1417.001

GUI Input Capture

T1417.002

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	com.appser.verapp

Performs UI accessibility actions on behalf of the user 1 TTPs 4 IoCs

Application may abuse the accessibility service to prevent their removal.

evasion

Prevent Application Removal

T1629.001

ioc	Process
android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction	com.appser.verapp
android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction	com.appser.verapp
android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction	com.appser.verapp
android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction	com.appser.verapp

Queries the mobile country code (MCC) 1 TTPs 1 IoCs

discovery

System Network Configuration Discovery

T1422

description	ioc	Process
Framework service call	com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone	com.appser.verapp

Requests enabling of the accessibility settings. 1 IoCs

description	ioc	Process
Intent action	android.settings.ACCESSIBILITY_SETTINGS	com.appser.verapp

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs

persistence

Broadcast Receivers

T1624.001

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	com.appser.verapp

Checks CPU information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	com.appser.verapp

Checks memory information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	com.appser.verapp

com.appser.verapp
1⤵
- Makes use of the framework's Accessibility service
- Performs UI accessibility actions on behalf of the user
- Queries the mobile country code (MCC)
- Requests enabling of the accessibility settings.
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Checks CPU information
- Checks memory information
PID:4224

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Event Triggered Execution

1

T1624

Broadcast Receivers

1

T1624.001

Privilege Escalation

Defense Evasion

Impair Defenses

1

T1629

Prevent Application Removal

Input Injection

Virtualization/Sandbox Evasion

2

T1633

System Checks

2

T1633.001

Credential Access

Input Capture

2

T1417

GUI Input Capture

1

T1417.002

Keylogging

1

T1417.001

Discovery

System Information Discovery

2

T1426

System Network Configuration Discovery

1

T1422

Lateral Movement

Collection

Input Capture

2

T1417

GUI Input Capture

1

T1417.002

Keylogging

Screen Capture

Command and Control

Exfiltration

Impact

Input Injection

1

T1516

Replay Monitor

Loading Replay Monitor...

Downloads

/storage/emulated/0/Config/sys/apps/log/log-MjAyNS0wMi0xOQ== .txt

Filesize
36B

MD5
ef7483d30f9937599061cf8fddcea864

SHA1
6e31006bbd96ae01f49964c16851be3185ffcf40

SHA256
55106cf8a3fe38e18570e635b3fa4019a563c0921773fcd926e510806cdff3a9

SHA512
43bf4e0d05d4c1bbb86a4605169a2623490481c0a0630c9970f91138174049d800e2a9259b63c610c7983a528cf1dd6e8c98969981e3289e0850ccadb52e74fe

Download Submit
/storage/emulated/0/Config/sys/apps/log/log-MjAyNS0wMi0xOQ== .txt

Filesize
24B

MD5
8b7b3f50eed2777d6c50bdb3e883519c

SHA1
f3f04b5679105f5bd0efc3dda76aa29258ac006f

SHA256
3c5f2c9318209bfb1e85b0bc7d92b4c038881913854a4ea1fd7c4fa46cbd0dde

SHA512
037435b68e40006b82c78989d7ed7b4751b7026859f62c0c2ba58957638d75be284509b6fd108557fcf452d5696f8e03e32b520d56b37d8f3416a519b6c0dbc4

Download Submit
/storage/emulated/0/Config/sys/apps/log/log-MjAyNS0wMi0xOQ== .txt

Filesize
24B

MD5
2ac244b9b6eaae01972d1c5a23aa6909

SHA1
a91d8bd71990aa82b7bdd073dce972a06714f81a

SHA256
3df2098ad52682321aa7e134d7358fd3bbece7830b6b02db1be19de6b609e289

SHA512
ce061ce6d6f8ba4cc61cbd5e66e981d044905787d91e6ffef4b825bc3968ba4aaec710409471802146e746111cb0f61dcdc0c98d402bedbabdf201fe7aaeb18d

Download Submit
/storage/emulated/0/Config/sys/apps/log/log-MjAyNS0wMi0xOQ== .txt

Filesize
40B

MD5
3a71cc46a72de9883a7b8fa8cbe34ca1

SHA1
ef1bbdb281e546b3628a1a845b4941db1ca9e4a3

SHA256
c06d9e99f6ee253432eadfdfac6008e211182c3770fd883fd0ff6e4e08a5e201

SHA512
f65df913a1f4ecb920de54fb6c30ec52368e3b61043f9e37656f364d420f97d3a816ef2b0c6d9e770521e3cf1818cf9c5d689482418278b3c967a4d57c9bdf07

Download Submit
/storage/emulated/0/Config/sys/apps/log/log-MjAyNS0wMi0xOQ== .txt

Filesize
255B

MD5
dd11724b67fb7c333f51cbdd1a2f11f1

SHA1
9bedfa7c7bfb4cf98cc838c25a050cb0ba0046f1

SHA256
3bcf4f8053a94b786f3392cb1c6c584f23a5b718701491bda6183739dfa9a5de

SHA512
173102427b454638fa107b30dadb7c566e21eaf57af5024f331d6a30804a26e15c422db864ba52b56a3fd578fd8669c832c5d3709332e0deb3f44743e54bdef1

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads