Analysis
-
max time kernel
149s -
max time network
157s -
platform
android_x64 -
resource
android-x64-20240624-en -
resource tags
-
submitted
21-02-2025 04:37
General
-
Target
9db3d7a0c657c5abbe688ab61638cd14d905484b1b9c4906a347922fc7e30e84.apk
-
Size
3.9MB
-
MD5
0116c96dce400053d1348a2626032efd
-
SHA1
0218c087f748073cc4d2b3693a259bf240c897cf
-
SHA256
9db3d7a0c657c5abbe688ab61638cd14d905484b1b9c4906a347922fc7e30e84
-
SHA512
164de2e1b097879eb74ba16ee55045b6cbcf77ca669fb5195395721e8cdce48c97e31308f74db37cc6adb377cad603b2d158995cffc8e56fd9d01cb1b3c5a909
-
SSDEEP
98304:mPKZLILt8f33dv8mzzzBRT1h0tplH+ODJ:mPKZLzf33trz/4F
Malware Config
Signatures
-
Makes use of the framework's Accessibility service 4 TTPs 3 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Acquires the wake lock 1 IoCs
-
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
-
Performs UI accessibility actions on behalf of the user 1 TTPs 4 IoCs
Application may abuse the accessibility service to prevent their removal.
-
Queries information about active data network 1 TTPs 1 IoCs
-
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
-
Schedules tasks to execute at a specified time 1 TTPs 1 IoCs
Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.
Processes
-
feeds.pavilion.employment1⤵
- Makes use of the framework's Accessibility service
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Performs UI accessibility actions on behalf of the user
- Queries information about active data network
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Schedules tasks to execute at a specified time
Network
MITRE ATT&CK Mobile v15
Persistence
Event Triggered Execution
1Broadcast Receivers
1Foreground Persistence
1Scheduled Task/Job
1Defense Evasion
Foreground Persistence
1Impair Defenses
1Prevent Application Removal
1Input Injection
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
37B
MD5bba20f1812ddeb5a708655d7e7b7181c
SHA1acc3e9116fc28f5036d4ee1e7386b29eb0f68c05
SHA256dfe73530ab107811224adf8e84da13eae3fcef4f2f1941ba839308342a38c653
SHA5125346bd8bf1053c72c42d57f601519bbc47619e9952501446244f3a032595066e4b95a37a6005bc0be60a0362bdb31afef19dad0c60e2203c46f85944b5caae8c
-
Filesize
37B
MD5102a6539070bfefa648e9a2771b2396d
SHA1a86b0c4b9d816152227f5821a3993e5b7f16d2bb
SHA256f4235554036a78efb4f48567cf4e4335db7ace503ced4e14e3a637aa6f562116
SHA512c62b433ceabf366b431afc2a15d91d43f9a8d643c33967c0795bd5da073796e8ba77b4c53363172b4811aae89c345327583858f0047419a85811d92c4fbcc385
-
Filesize
25B
MD5ba30336bf53d54ed3c0ea69dd545de8c
SHA1ce99c6724c75b93b7448e2d9fac16ca702a5711f
SHA2562d6988fb5afdaafc4e33fa1f71d6f10c95ab5a49a8ec820add5b13eef05439af
SHA512eea34ca526e03349e746d3687ea660b4748f0174fe2ffdb65161e232e08630b345e03329614852ce881a71362ba68575e9dd08fa361a416e5b2fb231e21a0a3e
-
Filesize
288B
MD51de88d3fd0868953d5c38665d70dadfc
SHA18e8c28e58427c6151f3c98a0671ffc688fa0ae56
SHA25665c1cb24cb6128f8e41a02e237cfbb1af3aa4b00fcf1a99a7eaebe2dcb359e39
SHA51269291935cd65db23b27f0348917a5db4ba706bf68644bfe24f571ce41e1a3f0cfdf2ec76acc20a22a94c53b3a68dd3eb472246738a79f268399fc3030e2078bb