Analysis
-
max time kernel
149s -
max time network
152s -
platform
android-9_x86 -
resource
android-x86-arm-20240910-en -
resource tags
-
submitted
28/03/2025, 22:11
General
-
Target
a258f01892cdfc3a3a3f5ee19a83d948084e8c666ab75b782f35b7ff9522fcfa.apk
-
Size
3.2MB
-
MD5
93b3815cb420f995ac39e32cfcf47fb3
-
SHA1
5c165298c7632efd05001d2884c318eab3a6ce45
-
SHA256
a258f01892cdfc3a3a3f5ee19a83d948084e8c666ab75b782f35b7ff9522fcfa
-
SHA512
db8c89a2b67842607fd6c17fe03f17dea037ee9d6a597a50f1f7afacf7b87e2b40c69d831d3d2b7debd46224edd4837c122a388192cda493f9f71ed8177f7442
-
SSDEEP
98304:SlfglCN+XvF4yXRotS/LJaoSrwMlz7BI2C4mbgjFfytH:SlfglCNk4yBnJbSvW
Malware Config
Signatures
-
Removes its main activity from the application launcher 1 TTPs 8 IoCs
-
Loads dropped Dex/Jar 1 TTPs 1 IoCs
Runs executable file dropped to the device during analysis.
-
Makes use of the framework's Accessibility service 4 TTPs 3 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Performs UI accessibility actions on behalf of the user 1 TTPs 4 IoCs
Application may abuse the accessibility service to prevent their removal.
-
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
-
Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
-
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
-
Schedules tasks to execute at a specified time 1 TTPs 1 IoCs
Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.
-
Checks CPU information 2 TTPs 1 IoCs
-
Checks memory information 2 TTPs 1 IoCs
Processes
-
com.drama.bronze1⤵
- Removes its main activity from the application launcher
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Performs UI accessibility actions on behalf of the user
- Queries the mobile country code (MCC)
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Schedules tasks to execute at a specified time
- Checks CPU information
- Checks memory information
Network
MITRE ATT&CK Mobile v15
Persistence
Event Triggered Execution
1Broadcast Receivers
1Scheduled Task/Job
1Defense Evasion
Download New Code at Runtime
1Hide Artifacts
2Suppress Application Icon
1User Evasion
1Impair Defenses
1Prevent Application Removal
1Input Injection
1Virtualization/Sandbox Evasion
2System Checks
2Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
320KB
MD51b3954af42bab3cfefa48082192805d1
SHA1b6439fa19390e65fbd2efc183957ffa6b028e333
SHA256cd945ca83b26fe9a04684788000008a465cbdf777000231500064c6dd1427b91
SHA512b081d52c13348a786113fd88f11f1f1edd93626f59b07b49d6055c9c14f33dab20b3ba82131b00f207628960b2c69263f5852d9754c5d36641bfe910037b53e8
-
Filesize
320KB
MD532d5c5af123316b8f01f5ce0ae75cdc5
SHA1184b1dfcc0f3042be614d744c2f6c54a8f9ea913
SHA256c5edf90aa49d992e2c16e1118da0e046bf3b4ac409947ed7b87304c147610f78
SHA5128e3cc61ae84c4f294d66fa22413383b05b3fbe2e91157bf3626fe98237e7f0beb249ae2432107246013434e3a57d74ef1cfe602030e0bab1bb2c8e9c8ffca4da
-
Filesize
439B
MD54a52ab2ea1bf94d7bb931dfa0b08c1bb
SHA1d65d9c0808637e1be36d5e2783e2ca1bf17fcc7c
SHA2564666d9a9b70c4a151dad8c3c54b1c16b342d1ee0d97f4d7ae73592d0a63600a9
SHA512e74beb5a3a0b80ff23380a9762b7f8359d56186d9017d5210eec9dd3d734ae72eeb70135747ae06b99251c0c3eeb2d7db74397b9f5d49bf2342a86d99d60eed1
-
Filesize
635KB
MD594b44042d1e0507fc6dafeae54163754
SHA1fbb9dd5c625292be95257c7cdee9d24a33189cdd
SHA25667cb08d942783e6a45e4f089be6aa4ea7704a41186c3d70287382010c55d7998
SHA51227d5dbcd3835d0b60f432635528f7b2680ea6ffd089f0c44626bc9c38de122b69e1d5c96af085129ddddbb7d228471c1ec496a7ff5eb4652689bd6390469e92c