Analysis
-
max time kernel
145s -
max time network
164s -
platform
android-10_x64 -
resource
android-x64-20240910-en -
resource tags
-
submitted
28/03/2025, 22:08
General
-
Target
6228451bafdb12f42daf518d80997124c089eaac2e35b053433e321f33ac78d3.apk
-
Size
4.3MB
-
MD5
c44b34a617d6e7a6e03cd1cb1b290d86
-
SHA1
dcbe4dadd457f24109035e820073556aa81b7a39
-
SHA256
6228451bafdb12f42daf518d80997124c089eaac2e35b053433e321f33ac78d3
-
SHA512
cd7ebd21b4dc2a360e61e7476528783b815d5ca2fe298ad9031e59381b1462d9e2681a75226af8f58195be98ec07330add0d4585c0517680f37b525e18bb80b1
-
SSDEEP
98304:K5vRV3T5bEl0DssSD+3sYpfdcuqWgS6ewUKvHHWkwmJhdNX4skLS08IvN0frHQ:K5vRV3T5bFssSDCsuHq+67UKvH2VmFCp
Malware Config
Signatures
-
Makes use of the framework's Accessibility service 4 TTPs 1 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
-
Queries information about active data network 1 TTPs 1 IoCs
-
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
-
Schedules tasks to execute at a specified time 1 TTPs 1 IoCs
Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.
Processes
-
faces.addresses.plexiglass.procu_rements.trap1⤵
- Makes use of the framework's Accessibility service
- Makes use of the framework's foreground persistence service
- Queries information about active data network
- Registers a broadcast receiver at runtime (usually for listening for system events)
-
faces.addresses.plexiglass.procu_rements.trap:watch1⤵
- Schedules tasks to execute at a specified time