Analysis

  • max time kernel
    149s
  • max time network
    157s
  • platform
    android_x64
  • resource
    android-x64-20240624-en
  • resource tags

    androidarch:x64arch:x86image:android-x64-20240624-enlocale:en-usos:android-10-x64system
  • submitted
    26/02/2025, 07:02

General

  • Target

    ready.apk

  • Size

    4.4MB

  • MD5

    1c53ddd5d8720f7a59572bdddb603597

  • SHA1

    1b86e6610d292fb46e87bb135ed7457a4fb3aeeb

  • SHA256

    6cad0a9c721959e6f3c47a33dc6a3e34db3c07e4e5f2f563e4db30fe64838cd7

  • SHA512

    f12a98dba654291a380c1feda10417a5354328256053733395f199a8a5331db9d2a26b60cbf7867e4be11a3b7c3046713a9ef23d469260a5067481f31ee9bc24

  • SSDEEP

    98304:9X4Z7EEQAoyvLyCcunyJizqmzvzBfT20t4TpL5:BMexyvLyCcuyJizFzN9q5

Malware Config

Signatures

  • Makes use of the framework's Accessibility service 4 TTPs 1 IoCs

    Retrieves information displayed on the phone screen using AccessibilityService.

  • Acquires the wake lock 1 IoCs
  • Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

    Application may abuse the framework's foreground service to continue running in the foreground.

  • Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
  • Schedules tasks to execute at a specified time 1 TTPs 1 IoCs

    Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.

Processes

  • bottom.vote.himself
    1⤵
    • Makes use of the framework's Accessibility service
    • Acquires the wake lock
    • Makes use of the framework's foreground persistence service
    • Registers a broadcast receiver at runtime (usually for listening for system events)
    • Schedules tasks to execute at a specified time
    PID:4970

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • /storage/emulated/0/Config/sys/apps/log/log-2025-02-26.txt

    Filesize

    13B

    MD5

    de2c41a51ee9246eb1708f65b511add0

    SHA1

    2f442d634c8a18760a232c8829d4b5d74a52f074

    SHA256

    ad2d914ca347cd1930e32f21c6d5448c34104bea181b93abc85ec518985653ab

    SHA512

    7cdfbd001594503644e9ed80ae852f90ef9e841a8382e2eec6979e149a2c400a3b83055d205b4d1d66e1600e5127482932d5127eb5800d35a4ee5673fe34d84a

  • /storage/emulated/0/Config/sys/apps/log/log-2025-02-26.txt

    Filesize

    25B

    MD5

    fb032b64a1a0901d5c7385bc8359ce5d

    SHA1

    07089af61f0e27327224927e9cb6007926692871

    SHA256

    120210aef4e41a8176d6b8e44603368aa0a158f3190d8af7a4ff20be653fdb5e

    SHA512

    c79ea6e75a15e6450fceae193eb6aaabaa805f3705999c6a8bd432f90854fce306e27bef34e593c8a850c61d15c52df8d4c27146d1a36a209f84fdcae87f8048

  • /storage/emulated/0/Config/sys/apps/log/log-2025-02-26.txt

    Filesize

    41B

    MD5

    47bf4896695dd37839081267ce5bdc7f

    SHA1

    5a22524c99760b6bedb78a471103b776441d0184

    SHA256

    6695a9937b4d80e5da880643272faa5aab78d45be90b092fff8a9235a9e65c67

    SHA512

    d58d5bbc32e115e8a46efdba89dd9df622c439fd9356fb13974279d09fc5eb4b5391be5a376ce91648a0dfb5fae6250b3a799107e4e05a755f496383ba1de146