Overview
overview
10Static
static
10BastianHei...25.zip
windows7-x64
1BastianHei...25.zip
windows10-2004-x64
1888RAT/QAFLRG.apk
android-9-x86
888RAT/QAFLRG.apk
android-10-x64
888RAT/QAFLRG.apk
android-11-x64
Generic/Fr....0.apk
android-9-x86
Generic/Fr....0.apk
android-10-x64
Generic/Fr....0.apk
android-11-x64
Generic/ge...ed.apk
android-9-x86
Generic/ge...ed.apk
android-10-x64
Generic/ge...ed.apk
android-11-x64
Generic/ا...1).apk
android-9-x86
Generic/ا...1).apk
android-10-x64
Generic/ا...1).apk
android-11-x64
Spynote/Ci...-1.apk
android-9-x86
Spynote/Ci...-1.apk
android-10-x64
Spynote/Ci...-1.apk
android-11-x64
Spynote/CraxsApp.apk
android-9-x86
Spynote/CraxsApp.apk
android-10-x64
Spynote/CraxsApp.apk
android-11-x64
Spynote/En...ed.apk
android-9-x86
Spynote/En...ed.apk
android-10-x64
Spynote/En...ed.apk
android-11-x64
Spynote/Launcher.apk
android-9-x86
Spynote/Launcher.apk
android-10-x64
Spynote/Launcher.apk
android-11-x64
Spynote/Pe...et.apk
android-9-x86
Spynote/Pe...et.apk
android-10-x64
Spynote/Pe...et.apk
android-11-x64
childapp.apk
android-9-x86
7childapp.apk
android-10-x64
7childapp.apk
android-11-x64
7Analysis
-
max time kernel
149s -
max time network
155s -
platform
android-11_x64 -
resource
android-x64-arm64-20240910-en -
resource tags
arch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20240910-enlocale:en-usos:android-11-x64system -
submitted
23/03/2025, 18:36
Behavioral task
behavioral1
Sample
BastianHein Android malware samples 2025.zip
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
BastianHein Android malware samples 2025.zip
Resource
win10v2004-20250314-en
Behavioral task
behavioral3
Sample
888RAT/QAFLRG.apk
Resource
android-x86-arm-20240910-en
Behavioral task
behavioral4
Sample
888RAT/QAFLRG.apk
Resource
android-x64-20240910-en
Behavioral task
behavioral5
Sample
888RAT/QAFLRG.apk
Resource
android-x64-arm64-20240910-en
Behavioral task
behavioral6
Sample
Generic/Free apk 1.0.apk
Resource
android-x86-arm-20240910-en
Behavioral task
behavioral7
Sample
Generic/Free apk 1.0.apk
Resource
android-x64-20240910-en
Behavioral task
behavioral8
Sample
Generic/Free apk 1.0.apk
Resource
android-x64-arm64-20240910-en
Behavioral task
behavioral9
Sample
Generic/gen_signed.apk
Resource
android-x86-arm-20240910-en
Behavioral task
behavioral10
Sample
Generic/gen_signed.apk
Resource
android-x64-20240910-en
Behavioral task
behavioral11
Sample
Generic/gen_signed.apk
Resource
android-x64-arm64-20240910-en
Behavioral task
behavioral12
Sample
Generic/الناي ناي (1).apk
Resource
android-x86-arm-20240910-en
Behavioral task
behavioral13
Sample
Generic/الناي ناي (1).apk
Resource
android-x64-20240910-en
Behavioral task
behavioral14
Sample
Generic/الناي ناي (1).apk
Resource
android-x64-arm64-20240910-en
Behavioral task
behavioral15
Sample
Spynote/City Cleaning-1.apk
Resource
android-x86-arm-20240910-en
Behavioral task
behavioral16
Sample
Spynote/City Cleaning-1.apk
Resource
android-x64-20240910-en
Behavioral task
behavioral17
Sample
Spynote/City Cleaning-1.apk
Resource
android-x64-arm64-20240910-en
Behavioral task
behavioral18
Sample
Spynote/CraxsApp.apk
Resource
android-x86-arm-20240910-en
Behavioral task
behavioral19
Sample
Spynote/CraxsApp.apk
Resource
android-x64-20240910-en
Behavioral task
behavioral20
Sample
Spynote/CraxsApp.apk
Resource
android-x64-arm64-20240910-en
Behavioral task
behavioral21
Sample
Spynote/Encrypted_Signed.apk
Resource
android-x86-arm-20240910-en
Behavioral task
behavioral22
Sample
Spynote/Encrypted_Signed.apk
Resource
android-x64-20240910-en
Behavioral task
behavioral23
Sample
Spynote/Encrypted_Signed.apk
Resource
android-x64-arm64-20240910-en
Behavioral task
behavioral24
Sample
Spynote/Launcher.apk
Resource
android-x86-arm-20240910-en
Behavioral task
behavioral25
Sample
Spynote/Launcher.apk
Resource
android-x64-20240910-en
Behavioral task
behavioral26
Sample
Spynote/Launcher.apk
Resource
android-x64-arm64-20240910-en
Behavioral task
behavioral27
Sample
Spynote/Pepper_x_pocket.apk
Resource
android-x86-arm-20240910-en
Behavioral task
behavioral28
Sample
Spynote/Pepper_x_pocket.apk
Resource
android-x64-20240910-en
Behavioral task
behavioral29
Sample
Spynote/Pepper_x_pocket.apk
Resource
android-x64-arm64-20240910-en
Behavioral task
behavioral30
Sample
childapp.apk
Resource
android-x86-arm-20240910-en
Behavioral task
behavioral31
Sample
childapp.apk
Resource
android-x64-20240910-en
Behavioral task
behavioral32
Sample
childapp.apk
Resource
android-x64-arm64-20240910-en
General
-
Target
childapp.apk
-
Size
4.4MB
-
MD5
8e22828a63f574113c52c779ee12e6ea
-
SHA1
6d034ae5412ab94dce5a7c13b1803bfedc430268
-
SHA256
9dfc67ae5ad93b5f224186aa433db28af7ff20b671ce1db5c779183335d69479
-
SHA512
a2d4ca8dd112e8b15c499f438494d2df8ae4af8bcb74c2c8038aec37b69c96447767bcdd44116e1da3cbee3fbf45881e3b1aba8db3c9313078e7ace55d339962
-
SSDEEP
98304:NfrGwTVxBeIn91DzNvrV5g2ZkiivCE2mz7zBjTl0tA0O5o:NZHBF7PNvppkiF0zl6n5
Malware Config
Signatures
-
Makes use of the framework's Accessibility service 4 TTPs 1 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
description ioc Process Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId com.expensive.financial -
Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
-
Acquires the wake lock 1 IoCs
description ioc Process Framework service call android.os.IPowerManager.acquireWakeLock com.expensive.financial -
Schedules tasks to execute at a specified time 1 TTPs 1 IoCs
Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.
description ioc Process Framework service call android.app.job.IJobScheduler.schedule com.expensive.financial
Processes
Network
MITRE ATT&CK Mobile v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
13B
MD5de2c41a51ee9246eb1708f65b511add0
SHA12f442d634c8a18760a232c8829d4b5d74a52f074
SHA256ad2d914ca347cd1930e32f21c6d5448c34104bea181b93abc85ec518985653ab
SHA5127cdfbd001594503644e9ed80ae852f90ef9e841a8382e2eec6979e149a2c400a3b83055d205b4d1d66e1600e5127482932d5127eb5800d35a4ee5673fe34d84a
-
Filesize
21B
MD57c92e024aa43d3c250643463dcfa2dff
SHA1c75c4ea51520f967a269e0cc94a6aed75fd8737b
SHA256d4e6ea6de80c909fe8619339f4611c51a680e51d341f795255c87f41e4efbc2a
SHA5126e75cdaff8cb9a03aec9b06ca39ba0e11946b2a7e10f9164b65e94f0afb28939e4631b3dc36d32b8b6056cedae697ba6f097cb4207114d4c05b247b534acdfc2
-
Filesize
25B
MD5bdb821a955117250611e94cd23842584
SHA181edcea1b44f94cfc140710c8410d0696b760c67
SHA256076eb89055ff3d929eb732e1002a0105652e628682a741151388ce1df3b6ec9d
SHA512e52ffed4ee84acc414c530c239c8876d9e99c1f2b2c7626c0ed7fbe0c59b9cb8f8a5e9e983541bea3dfdb849dd3b9593df054c2482ed8bcda7c70ebd960ca268