Analysis
-
max time kernel
146s -
max time network
150s -
platform
android-9_x86 -
resource
android-x86-arm-20240910-en -
resource tags
-
submitted
27/03/2025, 18:27
General
-
Target
client.apk
-
Size
760KB
-
MD5
ce99fcb4e374391d16f135ac4cf5953a
-
SHA1
1c87c24349ae286b47ab9bac12b7f949d177f624
-
SHA256
4e4851de6ed3b965f05a848c9949e4a513a3f71e6f45e2830caabf8b8c38d585
-
SHA512
f778307ca383d04b613a58ac4c1d667731c7721631174f2a0cebce156a27866a80df94f3dd052bfde583410e2a27de2da3deb5fb22ea81f6297f385e647fde01
-
SSDEEP
12288:sWGFKidPa1a8Lzeyf8/UypN5WmpYshXZPbGwidNpgf2U:sWaPa1amey2UypN5WmD9idNpU
Malware Config
Signatures
-
Removes its main activity from the application launcher 1 TTPs 1 IoCs
-
Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
-
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
-
Requests enabling of the accessibility settings. 1 IoCs
-
Tries to add a device administrator. 2 TTPs 1 IoCs
-
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
Processes
-
cmf0.c3b5bm90zq.patch1⤵
- Removes its main activity from the application launcher
- Makes use of the framework's foreground persistence service
- Requests enabling of the accessibility settings.
- Tries to add a device administrator.
- Registers a broadcast receiver at runtime (usually for listening for system events)
Network
MITRE ATT&CK Mobile v15
Persistence
Event Triggered Execution
1Broadcast Receivers
1Foreground Persistence
1Privilege Escalation
Abuse Elevation Control Mechanism
1Device Administrator Permissions
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
85B
MD5c46097d35a7ba9bca8e6ef3057b6d8a8
SHA12cb938b69393e5eb287ca7aa6b6ac09bc86ab2f6
SHA256d0fbbda42df094f95d492f383b2606490cc30163e758b81d1ecb29205a2e994c
SHA512faf9f4c600d6a65aab72387bc684f401f390502d8f519db623f5eb65aa1fcf9c28e5d7ccd121b349ff474b7e5edb8be06f9057b511a90746353d94f27ead78b9
-
Filesize
76B
MD582b18a5662782749f1035d7b213df13e
SHA15ca11095f9c0cfa6b0c0365f055d6e599876300e
SHA256c75ec3984e18c1328bdc3bc945d059c7554a47563fd76598146685900789469e
SHA51272b39d487751855bfa003a2cae9664519c57917244611cd560cac4740779abde74fd5c0e22e1439eee1feceb21b5296d8f6b52ce87533d1696b9ffd4dd64c9d9
-
Filesize
264B
MD54908b4e70fc6b7dad673ab5545a8ca0a
SHA12970358e1aabe2621124230d1bd1a20a476a7c50
SHA256d639d1dc012fdfe49457709c18b573287204be45b473907720898f9b94fec82f
SHA5123b94dce88f67065984e3f448860c640e52c1174e5139e78664988cfa89e1367680df095644660e5a1aacaf63046eb590c9379ae43113ce5b183338831f9c3c49
-
Filesize
76B
MD543961795649e50505d98df06041a2b8d
SHA19757c669aec18330cdac058b47279a738e212ce7
SHA25615b75ad4d9125ec36a1ca51272382cdd76cb19f0e36baf88e73a9d5555a43a8f
SHA512c353f0657de580d794d358baa469f7efc5ad64c3bb8e2f5c2928f8b771994729c3778c43a57784277d51c04879740f4fdbd6cdce2f51d2a7f15fd97dc2943ca4
-
Filesize
264B
MD5b3d01372f57d9b9c97cab0f419c1f320
SHA19e4090f2cb56534bfdeb7dd495ae5cce6a0d5d60
SHA25620450928ba9eeec40b7e2ea42b0f357920be3d8e2fe6a5fccd0704e5a612c6a3
SHA512a04fb9a3c9b5838a7d8ab01ed08c71dbeacbeb4f4748e83b2b6f04441bcd269a026d2dcfc79be73e124face18addf35a94b58031a7b5fb0fa7037e2b02ca3131