Analysis
-
max time kernel
149s -
max time network
151s -
platform
android-10_x64 -
resource
android-x64-20240910-en -
resource tags
-
submitted
27/03/2025, 22:14
General
-
Target
e2f86dc49b6fa03589035944c83a75e440f9cd040723d9948f0610d3c7db6e73.apk
-
Size
181KB
-
MD5
0b9ffb688506065856ff032ca159233a
-
SHA1
b9549d23bfafd3e1c406611fdaa83b48b523b4cc
-
SHA256
e2f86dc49b6fa03589035944c83a75e440f9cd040723d9948f0610d3c7db6e73
-
SHA512
40764719d61c6738b7f9fadf088f52c55e2acc197b08097e1750512f3e3a98e4bb824ef6320f0ea88936b7403e834bdd4d621491f5cccea7ac93f0530df06b17
-
SSDEEP
3072:ehHS5kbM599UB2xzkNG1HQLHxVzLU1hyxCrUZip5U+vt0mhKdU+R3fGAkzR4Sm1w:e9S5koW2xG0wLRVkMFZedlMdUESmqMj8
Malware Config
Signatures
-
Loads dropped Dex/Jar 1 TTPs 3 IoCs
Runs executable file dropped to the device during analysis.
-
Makes use of the framework's Accessibility service 4 TTPs 2 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs
Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
-
Acquires the wake lock 1 IoCs
-
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
-
Performs UI accessibility actions on behalf of the user 1 TTPs 1 IoCs
Application may abuse the accessibility service to prevent their removal.
-
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
-
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
-
Checks CPU information 2 TTPs 1 IoCs
-
Checks memory information 2 TTPs 1 IoCs
Processes
-
com.fsgij.deils1⤵
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Obtains sensitive information copied to the device clipboard
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Performs UI accessibility actions on behalf of the user
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Checks CPU information
- Checks memory information
Network
MITRE ATT&CK Mobile v15
Persistence
Event Triggered Execution
1Broadcast Receivers
1Foreground Persistence
1Defense Evasion
Download New Code at Runtime
1Foreground Persistence
1Impair Defenses
1Prevent Application Removal
1Input Injection
1Virtualization/Sandbox Evasion
2System Checks
2Credential Access
Clipboard Data
1Input Capture
2GUI Input Capture
1Keylogging
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
217B
MD5329272ac4f411118f131ff771cc06a04
SHA1f197cf06d68fddcd1daea9aa07d3ecb80c6d980e
SHA256dfd877b5944a7069ac4977fd9a07cd36c3d61aff03e51ac29ba42a6065828bf9
SHA512518981addd7abae0f3a2d93ecfcf1949ebb1e1420f8dcc893fa8fad728a0a40019e17af3fad634377f8f087c70189af76f76b000c520f41c7d7f9c07f7055f43
-
Filesize
159B
MD56c064d2b4fbc886f31f70fb521364f1c
SHA182ef13325623e1b6c754ade8cac117132b18cb6a
SHA2569b26ff32af2ef83a725031b5644cdf8bdc1c93b5b566237e0eb777ce0c981598
SHA5127269d3649abcfff92e478fba77bf666d99ebc4ad8418380110a782ad513696958a1616cacde76f8181b3c73f4a373db2b67693881971ca96fd5e567f2ba4a42a
-
Filesize
185KB
MD5a917464ddddaaba4fd6c2e0d419ef62a
SHA1419511f83ac7723ed2b0044621588c90dbfdf9d1
SHA2565c13bed9bba9f40ea0dff48a37e883bea84cfc87b4f4a3134963b6e8bf9171b5
SHA51291d6007985aea8c116577ca82fd4f15ccac5e67ee04fe3f5e40cc502809a537103b9c3b650fac6655d1341f447ff81de74c1c89fc610385265afb7781459977f