Analysis
-
max time kernel
149s -
max time network
157s -
platform
android_x64 -
resource
android-x64-20240624-en -
resource tags
-
submitted
22-02-2025 22:15
General
-
Target
ready.apk
-
Size
28.1MB
-
MD5
4249bd2327f6d1ec3fb219d4860c1c10
-
SHA1
dbb495179df9041407423af6f7f6e6ec835c8245
-
SHA256
2d6d500e601054ebbbac6e3dfe28bcb89ba41b2f048472e192df820662728478
-
SHA512
f6496cac3cf8dcab372f257705b8a5236e426a00f49d75284c7232ff1bb56a6641b21d1b58c07bdf84e8a892a7e4cccfd7fb0580d767cebb2cfbf4a6977cd236
-
SSDEEP
98304:sEZ4xlCOAsylJJ60ZK3ZehOymzfzBITe0tsM1ZFd:EuNsylZZK3ZehO9zSFZr
Malware Config
Signatures
-
Removes its main activity from the application launcher 1 TTPs 1 IoCs
-
Makes use of the framework's Accessibility service 4 TTPs 3 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
-
Acquires the wake lock 1 IoCs
-
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
-
Performs UI accessibility actions on behalf of the user 1 TTPs 8 IoCs
Application may abuse the accessibility service to prevent their removal.
-
Queries information about active data network 1 TTPs 1 IoCs
-
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
-
Schedules tasks to execute at a specified time 1 TTPs 1 IoCs
Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.
Processes
-
senior.warrior.transmission1⤵
- Removes its main activity from the application launcher
- Makes use of the framework's Accessibility service
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Performs UI accessibility actions on behalf of the user
- Queries information about active data network
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Schedules tasks to execute at a specified time
Network
MITRE ATT&CK Mobile v15
Persistence
Event Triggered Execution
1Broadcast Receivers
1Foreground Persistence
1Scheduled Task/Job
1Defense Evasion
Foreground Persistence
1Hide Artifacts
1Suppress Application Icon
1Impair Defenses
1Prevent Application Removal
1Input Injection
1Discovery
Software Discovery
1Security Software Discovery
1System Network Connections Discovery
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
21B
MD5397405ec11a4ea2c73d7830a8a57971d
SHA1075734bf78c4bcc7816c023609b9239fccb633d6
SHA256f75524630758fbc8ad900293e800daa77d2c3c70ab2a322a497c2fe9d82a8222
SHA5128c1dc72c0f8ca30779e9bbd67a76fc7efad5e8f4947fc81c50ae9051d466e465968be807070268442b72e697bdafd2a1bcca9588142a9421120156666b205cb8
-
Filesize
17B
MD5dabb223b2ecfad3694955e58c8d9ab92
SHA1ec9a1f0f30033478397851de2d802db8beb43c69
SHA25627aa08c7fa92aa17ac3364a77e96f1dafc62c63f600fe90ca6282a0350e60338
SHA512d9559e77ab50b6aadfda30daa5f2edfe52240656469712021e8da18adba85da8216e97003f3f2c1fb2cd02977f5e6f0e8e1a013f6be3098b870fd9e42b01cc25
-
Filesize
25B
MD5ba30336bf53d54ed3c0ea69dd545de8c
SHA1ce99c6724c75b93b7448e2d9fac16ca702a5711f
SHA2562d6988fb5afdaafc4e33fa1f71d6f10c95ab5a49a8ec820add5b13eef05439af
SHA512eea34ca526e03349e746d3687ea660b4748f0174fe2ffdb65161e232e08630b345e03329614852ce881a71362ba68575e9dd08fa361a416e5b2fb231e21a0a3e
-
Filesize
272B
MD5944261e648aec971aa5ad8f069d4bff5
SHA176ed2e76846ee011250b1724e1d08b3e22d74fb0
SHA25627026b8e0ac2e30f692a5661af4cd4c14009ee006ab048802c19607d5921f933
SHA512db119987410e2735858a9b78e2eaca1f59585826369f789d26226369e060e878ac7a3c4dc30fc5de2d9230a42f31dd3ba4aed8a640355d30f211ad81c5c5bd74