Analysis
-
max time kernel
137s -
max time network
149s -
platform
android-9_x86 -
resource
android-x86-arm-20240910-en -
resource tags
-
submitted
27/03/2025, 01:33
General
-
Target
ad07d44d348185db08710d8cdef6b4cff3f52e5c8ce0646654cef441dea1e869.apk
-
Size
1.4MB
-
MD5
4b4b8078717890dee57a58a3307a9b07
-
SHA1
03c192ca1676dfccdee1f08b604da023838d16b9
-
SHA256
ad07d44d348185db08710d8cdef6b4cff3f52e5c8ce0646654cef441dea1e869
-
SHA512
517bf0349a03032e8e8ec00643bea7a5f2a94ca4d0f12796c057869ee95ed7c46c3ed9c1f503d087700c447cc4118428b0f86e538a1377da4dd38f80fc375895
-
SSDEEP
24576:xPe1ZkNOHSf7NO9sz1jt2zdqipzYL1Y3WHTgBzhZ2n3FJsQ91oQJV3bmg2o5+Gu:c1ZzHSDNOKVEQR1ZgRhy3FJsu1oQD3bk
Malware Config
Signatures
-
Removes its main activity from the application launcher 1 TTPs 1 IoCs
-
Loads dropped Dex/Jar 1 TTPs 5 IoCs
Runs executable file dropped to the device during analysis.
-
Makes use of the framework's Accessibility service 4 TTPs 1 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
-
Queries account information for other applications stored on the device 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect account information stored on the device.
-
Acquires the wake lock 1 IoCs
-
Requests enabling of the accessibility settings. 1 IoCs
-
Schedules tasks to execute at a specified time 1 TTPs 1 IoCs
Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.
-
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
Processes
-
cptbedyfutyryth.ggkimkmqmcoaaryu.qsygluabcdoutpomxgdfhtqamgf1⤵
- Removes its main activity from the application launcher
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Acquires the wake lock
-
/system/bin/dex2oat --debuggable --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --debuggable --generate-mini-debug-info --dex-file=/data/user/0/cptbedyfutyryth.ggkimkmqmcoaaryu.qsygluabcdoutpomxgdfhtqamgf/app_DynamicOptDex/pJ.json --output-vdex-fd=42 --oat-fd=43 --oat-location=/data/user/0/cptbedyfutyryth.ggkimkmqmcoaaryu.qsygluabcdoutpomxgdfhtqamgf/app_DynamicOptDex/oat/x86/pJ.odex --compiler-filter=quicken --class-loader-context=&2⤵
- Loads dropped Dex/Jar
-
-
cptbedyfutyryth.ggkimkmqmcoaaryu.qsygluabcdoutpomxgdfhtqamgf:cproc1⤵
- Loads dropped Dex/Jar
- Queries account information for other applications stored on the device
- Requests enabling of the accessibility settings.
- Schedules tasks to execute at a specified time
- Uses Crypto APIs (Might try to encrypt user data)
Network
MITRE ATT&CK Mobile v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
144B
MD536961f1e44e87bf05fbcd51454315d27
SHA1ef0e50fd0a5e9a793cdc3e4105e65680ef2b6266
SHA2568483821c5446da89ef599a9b9b70047af032faebcde7f1e1915e02f8739dacc5
SHA512447a6cdc5fe8232f68d724bf349854b818ded6af941584e23e540b23eb102c55f5807eef8e011c8e0790e5a3dd0838e64c4ad7a5bf57fd0eea8f5f50dca525b5
-
Filesize
645KB
MD5f32141e4a740597e1efa3978fc3241f8
SHA15d36529560c284fb8c57405f33082ff0f59a5e92
SHA256cb909d561fb19847e1ea0c337cf03084e2aae1691c88fbbc9a42169169fb57a1
SHA51228cee7bc4aee1684186b2785c7238fca778b9a718dacc512f8b52887ccc1ef1d57a03a8c44ed991f3fb4d11c17d5aa563da862593e26165904be83245cc81c0a
-
Filesize
645KB
MD538b50103344c93e3b50742a127668788
SHA1bbdd27e2ec52728930a920d8e926a8666ddc9f0d
SHA256a441e6ad9db039e3bb8bceb54aae8c038566803732bad16711eafeb1ff15d3f6
SHA512c8fce56030e44458e6ca9f6362ef2ea08fe5ef1855558b217f79a2bd06d08957627bbab1fc609d65a8d1a79b7e3ffb97037edc1e96d44a67874a67990fc01445