Analysis
-
max time kernel
149s -
max time network
132s -
platform
android_x64 -
resource
android-x64-arm64-20240624-en -
resource tags
-
submitted
23-02-2025 11:59
General
-
Target
ready.apk
-
Size
37.8MB
-
MD5
98542dba995b3b0c4b47903d8835c418
-
SHA1
6de7950bc78bda970648ab8d4f88ab233754c074
-
SHA256
adf28672a9fc5e55f1c80b35a2a037d6240d97ee2003ec0f2d8e1605b24eac38
-
SHA512
67d23e0d551b87f43f117a65101e776e1154aa53a34fc5ffa67a0cadef7a123ccd396ce944a1cbbf8dd1008e82716a82e4a195aa4fef74f2701958727ccea6a2
-
SSDEEP
98304:zr/EwH6L0yvupi1SeWNgRA6EDmz0MzBqTF0twlEf:k664yvupizKg+6Eiz0haP
Malware Config
Signatures
-
Makes use of the framework's Accessibility service 4 TTPs 3 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Acquires the wake lock 1 IoCs
-
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
-
Performs UI accessibility actions on behalf of the user 1 TTPs 12 IoCs
Application may abuse the accessibility service to prevent their removal.
-
Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
-
Schedules tasks to execute at a specified time 1 TTPs 1 IoCs
Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.
Processes
-
francis.flow.administrators1⤵
- Makes use of the framework's Accessibility service
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Performs UI accessibility actions on behalf of the user
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Schedules tasks to execute at a specified time
Network
MITRE ATT&CK Mobile v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
13B
MD5de2c41a51ee9246eb1708f65b511add0
SHA12f442d634c8a18760a232c8829d4b5d74a52f074
SHA256ad2d914ca347cd1930e32f21c6d5448c34104bea181b93abc85ec518985653ab
SHA5127cdfbd001594503644e9ed80ae852f90ef9e841a8382e2eec6979e149a2c400a3b83055d205b4d1d66e1600e5127482932d5127eb5800d35a4ee5673fe34d84a
-
Filesize
33B
MD5b76c468cc22c96ebf74c316142c2a11e
SHA11e79bad40e3c798f2c6f2012d21410e753342884
SHA2563481b8c4e6e72e3b504e9d24c8bc1180610ba64b19fea4edbd5336d0948600c3
SHA512b3a4569a0aaf74cc4ad947ed5cc40fbde766bc7ad262b4c452fec22f2930aae40b9d0ba7e59916b5b50710518166076e3e95e8baf24cdfc732837efd38ff3bba
-
Filesize
284B
MD5df70026729d4f53aec498466f3d16374
SHA1524dc3fd9b11d8ece0563526f044dca15837dab3
SHA256241f9c2aa87a0a895d0aefdbc5f3cb6df4c68d5e35e99b894652c693a42d7b0f
SHA512ed89d92ece26bf5ac881e7210f42b9780a3b0ae49a9762427726647fad9914fc5e291c008fd73dc87f18e285ef648c838008d6c2cd095d9dadfe9d78f6e1e5f2