Analysis
-
max time kernel
18s -
max time network
158s -
platform
android-11_x64 -
resource
android-x64-arm64-20240910-en -
resource tags
-
submitted
27/03/2025, 16:24
General
-
Target
f76524d907aa6b2e6f192e3e513622ab31489997d0754df775f9f5e8e111e3e4.apk
-
Size
2.1MB
-
MD5
9495d2a58fb5efe2189ab890fe98a2fa
-
SHA1
e30941e6adb3411176509c79e0377a9b4903717d
-
SHA256
f76524d907aa6b2e6f192e3e513622ab31489997d0754df775f9f5e8e111e3e4
-
SHA512
31e828bec5be506c823c3eeba6c1174d339510c5479ef93f0000453095c319c1c9330c859a133d7ac4af4df4b8ed6caccf744b57a0ecac012a2dbc7ebe46b141
-
SSDEEP
49152:aaErDVPV5HJzTpkb6flyDqqQT775RPxpXQEg0JT4tYT+x8hw5zpcViOJouzoS8A:aaCpHJzTpkbHDqF75JxpOs42TybpuNoM
Malware Config
Signatures
-
Removes its main activity from the application launcher 1 TTPs 1 IoCs
-
Loads dropped Dex/Jar 1 TTPs 4 IoCs
Runs executable file dropped to the device during analysis.
-
Makes use of the framework's Accessibility service 4 TTPs 2 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Acquires the wake lock 1 IoCs
-
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
-
Performs UI accessibility actions on behalf of the user 1 TTPs 2 IoCs
Application may abuse the accessibility service to prevent their removal.
-
Requests accessing notifications (often used to intercept notifications before users become aware). 1 TTPs 1 IoCs
-
Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
-
Requests enabling of the accessibility settings. 1 IoCs
-
Listens for changes in the sensor environment (might be used to detect emulation) 1 TTPs 1 IoCs
Processes
-
btkyxyc.kowtwacupumntmcf.qiwehukjxrxmukpisz1⤵
- Removes its main activity from the application launcher
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Performs UI accessibility actions on behalf of the user
- Requests accessing notifications (often used to intercept notifications before users become aware).
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Requests enabling of the accessibility settings.
- Listens for changes in the sensor environment (might be used to detect emulation)
Network
MITRE ATT&CK Mobile v15
Defense Evasion
Download New Code at Runtime
1Foreground Persistence
1Hide Artifacts
3Suppress Application Icon
1User Evasion
2Impair Defenses
1Prevent Application Removal
1Input Injection
1Credential Access
Access Notifications
1Input Capture
2GUI Input Capture
1Keylogging
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.4MB
MD50e5739c89dfe5f9dd8f93841560dbb47
SHA13f507351b592fc133c5e930f26f9565108e978b3
SHA256d77cfdc3c783695a1776b033f409dc5375990de3f4272f73c2008fe426600a1c
SHA51273fe1cf143b223608db3ca05c9978516692f6bfe6ffabc3e06a4892c855929e2dc18659e8b51c36b26627ddd637da571fd8b29c8e011235c04aa51b50e5cd2ae
-
Filesize
1.4MB
MD5818950cda870ce6b4ef7b46e8ad89c29
SHA17ad04f6a2df89ea2c4a9935c496ea88a89f90f90
SHA256d4884cd50ecd05387a0c2b3693fb16f39fdd6f4516337fbf54f0ab6e9a01f564
SHA512c49c3d15c37db1da8244f33a9fb4f864dc311d6b126ba15120915a3363f198f1d5eb67c78f8a2719c8c1fef13774e17526b663bde4c0326f7d48a8ebacd7402a