Analysis
-
max time kernel
136s -
max time network
150s -
platform
android-11_x64 -
resource
android-x64-arm64-20240910-en -
resource tags
-
submitted
27/03/2025, 01:33
General
-
Target
ad07d44d348185db08710d8cdef6b4cff3f52e5c8ce0646654cef441dea1e869.apk
-
Size
1.4MB
-
MD5
4b4b8078717890dee57a58a3307a9b07
-
SHA1
03c192ca1676dfccdee1f08b604da023838d16b9
-
SHA256
ad07d44d348185db08710d8cdef6b4cff3f52e5c8ce0646654cef441dea1e869
-
SHA512
517bf0349a03032e8e8ec00643bea7a5f2a94ca4d0f12796c057869ee95ed7c46c3ed9c1f503d087700c447cc4118428b0f86e538a1377da4dd38f80fc375895
-
SSDEEP
24576:xPe1ZkNOHSf7NO9sz1jt2zdqipzYL1Y3WHTgBzhZ2n3FJsQ91oQJV3bmg2o5+Gu:c1ZzHSDNOKVEQR1ZgRhy3FJsu1oQD3bk
Malware Config
Signatures
-
Removes its main activity from the application launcher 1 TTPs 1 IoCs
-
Loads dropped Dex/Jar 1 TTPs 4 IoCs
Runs executable file dropped to the device during analysis.
-
Makes use of the framework's Accessibility service 4 TTPs 3 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
-
Queries account information for other applications stored on the device 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect account information stored on the device.
-
Acquires the wake lock 1 IoCs
-
Performs UI accessibility actions on behalf of the user 1 TTPs 1 IoCs
Application may abuse the accessibility service to prevent their removal.
-
Requests enabling of the accessibility settings. 1 IoCs
-
Schedules tasks to execute at a specified time 1 TTPs 1 IoCs
Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.
-
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
Processes
-
cptbedyfutyryth.ggkimkmqmcoaaryu.qsygluabcdoutpomxgdfhtqamgf1⤵
- Removes its main activity from the application launcher
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Acquires the wake lock
- Performs UI accessibility actions on behalf of the user
-
cptbedyfutyryth.ggkimkmqmcoaaryu.qsygluabcdoutpomxgdfhtqamgf:cproc1⤵
- Loads dropped Dex/Jar
- Queries account information for other applications stored on the device
- Requests enabling of the accessibility settings.
- Schedules tasks to execute at a specified time
- Uses Crypto APIs (Might try to encrypt user data)
Network
MITRE ATT&CK Mobile v15
Defense Evasion
Download New Code at Runtime
1Hide Artifacts
1Suppress Application Icon
1Impair Defenses
1Prevent Application Removal
1Input Injection
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
178B
MD51e1e3a76b2051c73e0e3f136b184aac0
SHA19ff83f54ca5b4270a17943bef3c05add3744eed9
SHA256eb4abcd462199f6e061b1fd8d66255d246c64f07edf15f416929487da8efb057
SHA512fe9dce921b27ea81c816f58b8916d2dda8c1b26eb16df03d118ce13aac8072405f491d36263ad35102af93db37668f9a2e03ffadbe245128a7a65d41574afeb3
-
Filesize
645KB
MD5f32141e4a740597e1efa3978fc3241f8
SHA15d36529560c284fb8c57405f33082ff0f59a5e92
SHA256cb909d561fb19847e1ea0c337cf03084e2aae1691c88fbbc9a42169169fb57a1
SHA51228cee7bc4aee1684186b2785c7238fca778b9a718dacc512f8b52887ccc1ef1d57a03a8c44ed991f3fb4d11c17d5aa563da862593e26165904be83245cc81c0a
-
Filesize
645KB
MD538b50103344c93e3b50742a127668788
SHA1bbdd27e2ec52728930a920d8e926a8666ddc9f0d
SHA256a441e6ad9db039e3bb8bceb54aae8c038566803732bad16711eafeb1ff15d3f6
SHA512c8fce56030e44458e6ca9f6362ef2ea08fe5ef1855558b217f79a2bd06d08957627bbab1fc609d65a8d1a79b7e3ffb97037edc1e96d44a67874a67990fc01445