Analysis
-
max time kernel
149s -
max time network
148s -
platform
android-10_x64 -
resource
android-x64-20240910-en -
resource tags
-
submitted
01/04/2025, 21:18
General
-
Target
ready.apk
-
Size
6.2MB
-
MD5
993ce07c326f1148aa7e974d1b2ff586
-
SHA1
59b112a67355733265427f7381a699b7eb88168d
-
SHA256
6bc89cfaccf3aa3eb5135637d97b9b60de345334f622bb44bc6bcf96123f001b
-
SHA512
a61cb2804c5fe34b3f54c88f19f14f119c5542640ee379be95e61f48823b118de7795325198008636cbe741ddadea195c3b2c09ef40154cb0ece755698451bc5
-
SSDEEP
24576:8U5ViDCh94bszIs/LhU/5gxvY/u5xcb0lgYrVRBL9fn:8U5ViDk94bstLhUB+vYm5xcbDYL/
Malware Config
Signatures
-
Makes use of the framework's Accessibility service 4 TTPs 3 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs
Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
-
Acquires the wake lock 1 IoCs
-
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
-
Queries information about active data network 1 TTPs 1 IoCs
-
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
-
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
-
Schedules tasks to execute at a specified time 1 TTPs 1 IoCs
Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.
-
Checks CPU information 2 TTPs 1 IoCs
-
Checks memory information 2 TTPs 1 IoCs
Processes
-
consult.invoice.grab1⤵
- Makes use of the framework's Accessibility service
- Obtains sensitive information copied to the device clipboard
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Queries information about active data network
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Schedules tasks to execute at a specified time
- Checks CPU information
- Checks memory information
Network
MITRE ATT&CK Mobile v15
Persistence
Event Triggered Execution
1Broadcast Receivers
1Foreground Persistence
1Scheduled Task/Job
1Defense Evasion
Foreground Persistence
1Input Injection
1Virtualization/Sandbox Evasion
2System Checks
2Credential Access
Clipboard Data
1Input Capture
2GUI Input Capture
1Keylogging
1Discovery
System Information Discovery
2System Network Configuration Discovery
1System Network Connections Discovery
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
21B
MD5e81dad6079896188f0c67a4d8f3e26f7
SHA15850ef11fbc141051e8e8e3f5ea1b6535533c25d
SHA256a6549b6961a6b18c7e3c181f84e2cc6f4e2c02496fc2ae85d18173e22638a88b
SHA512be92424be019ed9293829fbf8fdaf3465afe295e3684b1bed061f2519f12ee52855bc8d8a1a61ac17411d155cfdb9bc7b72961a35c228d13a30c3f1f1353beb5
-
Filesize
33B
MD5cccac2c2a5ccbbc19de1e65f4a713fde
SHA18f81bdc29817ff1359ce9cf1f86a6e5ca6bd4839
SHA256b0a40190c703a9589642e774b871e2c82ccc0d47351d225d3cd39073b0ad4570
SHA5121356bc74b373ea3bd39fe7220019d85734ebcf632f30dfce7af89c80c744a1567ef2ec50d3476394665d302aa5ddee7debdbdef66ff5bc5b66ed7db3d6fc39d3
-
Filesize
219B
MD52d4c570b2be850769a88839f2fe14004
SHA1c1018888a27acc7d3f2eb455fd932b27079882e3
SHA2562af2673848170ebcd407dc15372271e230ac33b24d8ee8ab0abef4f7ed8c8fa8
SHA512ebe7bf8407a7b4d346735c25eaf99ae944435f30689c783b71bdc14f2adb03ac042c45f630ecfa00b687f54afe0d552c58829fc97bc1715cd508001510ca8bbb
-
Filesize
272B
MD5a684756e646ecb9150bfabbacdf749ac
SHA16d5e1a5447fc7d5f5c6434aa98c181eb3f26e6b7
SHA256aa3ce320e72cbcced80e8c38214178a5eb69c60177120d1b5c281eb5cd6eab7a
SHA512de1db9e5c8d8cf81ac968c633de393c5811e79a06a6d3163f9767dbf62fc17707ec3c5fff62ec07442950704cf7c0ed0060648bb8fff87f478b4fbd8567e0647