Analysis
-
max time kernel
149s -
max time network
148s -
platform
android_x86 -
resource
android-x86-arm-20240624-en -
resource tags
-
submitted
22-02-2025 22:15
General
-
Target
ready.apk
-
Size
28.1MB
-
MD5
4249bd2327f6d1ec3fb219d4860c1c10
-
SHA1
dbb495179df9041407423af6f7f6e6ec835c8245
-
SHA256
2d6d500e601054ebbbac6e3dfe28bcb89ba41b2f048472e192df820662728478
-
SHA512
f6496cac3cf8dcab372f257705b8a5236e426a00f49d75284c7232ff1bb56a6641b21d1b58c07bdf84e8a892a7e4cccfd7fb0580d767cebb2cfbf4a6977cd236
-
SSDEEP
98304:sEZ4xlCOAsylJJ60ZK3ZehOymzfzBITe0tsM1ZFd:EuNsylZZK3ZehO9zSFZr
Malware Config
Signatures
-
Removes its main activity from the application launcher 1 TTPs 1 IoCs
-
Makes use of the framework's Accessibility service 4 TTPs 3 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
-
Acquires the wake lock 1 IoCs
-
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
-
Performs UI accessibility actions on behalf of the user 1 TTPs 8 IoCs
Application may abuse the accessibility service to prevent their removal.
-
Queries information about active data network 1 TTPs 1 IoCs
-
Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
-
Requests enabling of the accessibility settings. 1 IoCs
-
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
-
Schedules tasks to execute at a specified time 1 TTPs 1 IoCs
Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.
Processes
-
senior.warrior.transmission1⤵
- Removes its main activity from the application launcher
- Makes use of the framework's Accessibility service
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Performs UI accessibility actions on behalf of the user
- Queries information about active data network
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Requests enabling of the accessibility settings.
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Schedules tasks to execute at a specified time
Network
MITRE ATT&CK Mobile v15
Persistence
Event Triggered Execution
1Broadcast Receivers
1Foreground Persistence
1Scheduled Task/Job
1Defense Evasion
Foreground Persistence
1Hide Artifacts
2Suppress Application Icon
1User Evasion
1Impair Defenses
1Prevent Application Removal
1Input Injection
1Discovery
Software Discovery
1Security Software Discovery
1System Network Connections Discovery
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
25B
MD5ba30336bf53d54ed3c0ea69dd545de8c
SHA1ce99c6724c75b93b7448e2d9fac16ca702a5711f
SHA2562d6988fb5afdaafc4e33fa1f71d6f10c95ab5a49a8ec820add5b13eef05439af
SHA512eea34ca526e03349e746d3687ea660b4748f0174fe2ffdb65161e232e08630b345e03329614852ce881a71362ba68575e9dd08fa361a416e5b2fb231e21a0a3e
-
Filesize
17B
MD5dabb223b2ecfad3694955e58c8d9ab92
SHA1ec9a1f0f30033478397851de2d802db8beb43c69
SHA25627aa08c7fa92aa17ac3364a77e96f1dafc62c63f600fe90ca6282a0350e60338
SHA512d9559e77ab50b6aadfda30daa5f2edfe52240656469712021e8da18adba85da8216e97003f3f2c1fb2cd02977f5e6f0e8e1a013f6be3098b870fd9e42b01cc25
-
Filesize
272B
MD5c67f763f5a6e195736630d7f78e29c6b
SHA181c6b38bd448a08f88bcc08a5085edbfd98cded7
SHA25624afb676c42426128be404d7b8c586d885a9ce42fd7921a385647465be67bf73
SHA51209cb64a98b09d70a72f096cd52a2a0c9bec04bd9caa9b509982bc8be379837f3ccf5712cf41626f6a068531c5570ce087b2486c7c9621f82d5cbbeaaf0b9c692