Analysis
-
max time kernel
149s -
max time network
151s -
platform
android-10_x64 -
resource
android-x64-20240910-en -
resource tags
-
submitted
25/03/2025, 12:38
General
-
Target
9f2d916b1e0ee486f5a49e3e9887eae59dbdca0a554139ae9a4dc8edc2f12de0.apk
-
Size
2.8MB
-
MD5
af9fde69078e906d628f5c04fe4ab11f
-
SHA1
6607baef8a3f4d0a077b8d38eea4afab4b8e9c5f
-
SHA256
9f2d916b1e0ee486f5a49e3e9887eae59dbdca0a554139ae9a4dc8edc2f12de0
-
SHA512
2a43ef73873d24254bd49a1b7b5e04ec279aabe06076bbec44d3c2ce867e619136aca9b85e319d6c6c0c0ed29b3331ccbe091549cc33a13d232ecf338bf42fef
-
SSDEEP
49152:CdB2WK9IVhZGa7+o4Dmu1iAYOSMA+418rU4+xVRgOd35UZJlTn7C:CdIxWVhZGaCoCiTrU46UPhlO9TG
Malware Config
Signatures
-
Loads dropped Dex/Jar 1 TTPs 2 IoCs
Runs executable file dropped to the device during analysis.
-
Makes use of the framework's Accessibility service 4 TTPs 2 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs
Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
-
Acquires the wake lock 1 IoCs
-
Performs UI accessibility actions on behalf of the user 1 TTPs 7 IoCs
Application may abuse the accessibility service to prevent their removal.
-
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
-
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
-
Checks CPU information 2 TTPs 1 IoCs
-
Checks memory information 2 TTPs 1 IoCs
Processes
-
com.zzvk.elxxjqz1⤵
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Obtains sensitive information copied to the device clipboard
- Acquires the wake lock
- Performs UI accessibility actions on behalf of the user
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Checks CPU information
- Checks memory information
Network
MITRE ATT&CK Mobile v15
Defense Evasion
Download New Code at Runtime
1Impair Defenses
1Prevent Application Removal
1Input Injection
1Virtualization/Sandbox Evasion
2System Checks
2Credential Access
Clipboard Data
1Input Capture
2GUI Input Capture
1Keylogging
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.5MB
MD532c6f01e9b7e6bbc43064cd56d1cdef5
SHA1c51f76c18aa17cc26e94932ed2bac63036c55535
SHA2564bc261033a6353ce3ef11b30c6675946b1a004793222c2c951e500b827daa035
SHA5126f471b9eb210cffe124fb9d8bdf27e96133bff0794fa32d8bd1b2aebe5717dcfd135404755c2ab38bb47195373c84d0d66f74920436e7ac5b1d3e357c5b9de65