Analysis
-
max time kernel
146s -
max time network
129s -
platform
android-9_x86 -
resource
android-x86-arm-20240910-en -
resource tags
-
submitted
30/03/2025, 10:58
General
-
Target
client.apk
-
Size
760KB
-
MD5
cf99b9b3f6dcb4b02e317cb3f42ab3d1
-
SHA1
162a0f13e5b80528390dddca4e85424927420a47
-
SHA256
213e24786c7e7440abb88538c12fa08d91d72669a733ea081b57b1ba6b787775
-
SHA512
b6328bc9160cacbf827defddcd2f84d547e5a29d5edf66f1f6cb74e6d45f39253b2cb4ce89df0e20cfcaf0421ab8ac510d79002c04a0691812f19117e5a46bf2
-
SSDEEP
12288:2KRNa1a8Lreg9iIQ85J5WmpYshXZPbGwidNpgRC:2aa1a2egZQ85J5WmD9idNpH
Malware Config
Signatures
-
Removes its main activity from the application launcher 1 TTPs 1 IoCs
-
Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
-
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
-
Tries to add a device administrator. 2 TTPs 1 IoCs
-
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
Processes
-
cmf0.c3b5bm90zq.patch1⤵
- Removes its main activity from the application launcher
- Makes use of the framework's foreground persistence service
- Tries to add a device administrator.
- Registers a broadcast receiver at runtime (usually for listening for system events)
Network
MITRE ATT&CK Mobile v15
Persistence
Event Triggered Execution
1Broadcast Receivers
1Foreground Persistence
1Privilege Escalation
Abuse Elevation Control Mechanism
1Device Administrator Permissions
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD58023075782bb9079bd5bd339a129194d
SHA1bc97bcb6a6991d7f494595f289cbbccd16bf2506
SHA256e98e0e818bb24f35d093b7d445facba13b352593a880ec3be5b60150f6ba1e7a
SHA5127530453ab7ea01050fa87b60024818106ee5c4d23c7a80ae01f39bd8bd6ad7217599d170f7d771be035be72af851ad32e5e052a9e2e332f847d2d538e6e26075
-
Filesize
85B
MD5810040cddbc6d54c7bdbaaec4aa28c33
SHA1d536e4ef161630ee8c13748c67b0e8b8503f40cd
SHA256f5610adec17cf0f6bb58dc727bb1b8d9b0ff81742f65a5caa95c3c2e50e56d62
SHA51206729f0d5a7cbb27a84ad8a98a1c062ef85c5dc23f8aa136b4386241d1cd909b9331214fc355f051dc64d2198945ab0bf52a86fd9d13353ac9958e4cfed0ccf9