Analysis
-
max time kernel
149s -
max time network
150s -
platform
android-9_x86 -
resource
android-x86-arm-20240910-en -
resource tags
-
submitted
01/04/2025, 21:18
General
-
Target
ready.apk
-
Size
6.2MB
-
MD5
993ce07c326f1148aa7e974d1b2ff586
-
SHA1
59b112a67355733265427f7381a699b7eb88168d
-
SHA256
6bc89cfaccf3aa3eb5135637d97b9b60de345334f622bb44bc6bcf96123f001b
-
SHA512
a61cb2804c5fe34b3f54c88f19f14f119c5542640ee379be95e61f48823b118de7795325198008636cbe741ddadea195c3b2c09ef40154cb0ece755698451bc5
-
SSDEEP
24576:8U5ViDCh94bszIs/LhU/5gxvY/u5xcb0lgYrVRBL9fn:8U5ViDk94bstLhUB+vYm5xcbDYL/
Malware Config
Signatures
-
Makes use of the framework's Accessibility service 4 TTPs 3 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Acquires the wake lock 1 IoCs
-
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
-
Performs UI accessibility actions on behalf of the user 1 TTPs 24 IoCs
Application may abuse the accessibility service to prevent their removal.
-
Queries information about active data network 1 TTPs 1 IoCs
-
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
-
Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
-
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
-
Schedules tasks to execute at a specified time 1 TTPs 1 IoCs
Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.
-
Checks CPU information 2 TTPs 1 IoCs
-
Checks memory information 2 TTPs 1 IoCs
Processes
-
consult.invoice.grab1⤵
- Makes use of the framework's Accessibility service
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Performs UI accessibility actions on behalf of the user
- Queries information about active data network
- Queries the mobile country code (MCC)
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Schedules tasks to execute at a specified time
- Checks CPU information
- Checks memory information
Network
MITRE ATT&CK Mobile v15
Persistence
Event Triggered Execution
1Broadcast Receivers
1Foreground Persistence
1Scheduled Task/Job
1Defense Evasion
Foreground Persistence
1Hide Artifacts
1User Evasion
1Impair Defenses
1Prevent Application Removal
1Input Injection
1Virtualization/Sandbox Evasion
2System Checks
2Discovery
System Information Discovery
2System Network Configuration Discovery
1System Network Connections Discovery
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
21B
MD5e81dad6079896188f0c67a4d8f3e26f7
SHA15850ef11fbc141051e8e8e3f5ea1b6535533c25d
SHA256a6549b6961a6b18c7e3c181f84e2cc6f4e2c02496fc2ae85d18173e22638a88b
SHA512be92424be019ed9293829fbf8fdaf3465afe295e3684b1bed061f2519f12ee52855bc8d8a1a61ac17411d155cfdb9bc7b72961a35c228d13a30c3f1f1353beb5
-
Filesize
29B
MD5e86548c4ecffd420467335c6d6f76320
SHA1e24870d13b09add302ab03fb63196bc2b7d205a2
SHA2563e6d2b03c97024a3a35ab617f1291deba8c6eaac0c3481e5e3b5e3dd2de3be49
SHA512c77d5679cabffe0fb1ec72de5d822c2e1c07f5052be4276ad13c1770aac3863cb067aa65f3768b5a649249ae9e148c5e03121ce7c9f753f7c0bd139bd7d02e39
-
Filesize
21B
MD502f107a07a9b71bd44fe8c0f3826d7ab
SHA1537f2c08edc923878bf6c4bd38c05809a55c54b4
SHA2563b11ab3f59ed1a29ac3e8f00e0793a40a2fa2a4c34a5836c8fb7da0da4f66837
SHA5127ecb7cbbc1d815564a9e26629dffb07082663975d117d6f1d0d03ea03f3c95560c93e4b5d5b5161b74a2d77c36e8ae4f2ccc7a6639391da807a90e64002a30a6
-
Filesize
924B
MD5457efbfe3ebcdfa16895317650b3b6c2
SHA1bc1ac4ae31709de991f0fb030e54efddc1a0ecaf
SHA256692be694104a26f7aa124ba0a7c72b6b06f8a609bb45cd863400494942757be0
SHA512e556906113485c3b9832a33e7e97745571390a60c0ddf6d0282a7496f2e513c4768e63284adcc187d3922fd7fe3a8201aa2f947c6f65a1598b5bd451477ca10e