Analysis
-
max time kernel
148s -
max time network
150s -
platform
android-11_x64 -
resource
android-x64-arm64-20240910-en -
resource tags
-
submitted
01/04/2025, 21:18
General
-
Target
ready.apk
-
Size
6.2MB
-
MD5
993ce07c326f1148aa7e974d1b2ff586
-
SHA1
59b112a67355733265427f7381a699b7eb88168d
-
SHA256
6bc89cfaccf3aa3eb5135637d97b9b60de345334f622bb44bc6bcf96123f001b
-
SHA512
a61cb2804c5fe34b3f54c88f19f14f119c5542640ee379be95e61f48823b118de7795325198008636cbe741ddadea195c3b2c09ef40154cb0ece755698451bc5
-
SSDEEP
24576:8U5ViDCh94bszIs/LhU/5gxvY/u5xcb0lgYrVRBL9fn:8U5ViDk94bstLhUB+vYm5xcbDYL/
Malware Config
Signatures
-
Makes use of the framework's Accessibility service 4 TTPs 3 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs
Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
-
Acquires the wake lock 1 IoCs
-
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
-
Queries information about active data network 1 TTPs 1 IoCs
-
Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
-
Schedules tasks to execute at a specified time 1 TTPs 1 IoCs
Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.
-
Checks CPU information 2 TTPs 1 IoCs
-
Checks memory information 2 TTPs 1 IoCs
Processes
-
consult.invoice.grab1⤵
- Makes use of the framework's Accessibility service
- Obtains sensitive information copied to the device clipboard
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Queries information about active data network
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Schedules tasks to execute at a specified time
- Checks CPU information
- Checks memory information
Network
MITRE ATT&CK Mobile v15
Defense Evasion
Foreground Persistence
1Hide Artifacts
1User Evasion
1Input Injection
1Virtualization/Sandbox Evasion
2System Checks
2Credential Access
Clipboard Data
1Input Capture
2GUI Input Capture
1Keylogging
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
21B
MD5e81dad6079896188f0c67a4d8f3e26f7
SHA15850ef11fbc141051e8e8e3f5ea1b6535533c25d
SHA256a6549b6961a6b18c7e3c181f84e2cc6f4e2c02496fc2ae85d18173e22638a88b
SHA512be92424be019ed9293829fbf8fdaf3465afe295e3684b1bed061f2519f12ee52855bc8d8a1a61ac17411d155cfdb9bc7b72961a35c228d13a30c3f1f1353beb5
-
Filesize
33B
MD5cccac2c2a5ccbbc19de1e65f4a713fde
SHA18f81bdc29817ff1359ce9cf1f86a6e5ca6bd4839
SHA256b0a40190c703a9589642e774b871e2c82ccc0d47351d225d3cd39073b0ad4570
SHA5121356bc74b373ea3bd39fe7220019d85734ebcf632f30dfce7af89c80c744a1567ef2ec50d3476394665d302aa5ddee7debdbdef66ff5bc5b66ed7db3d6fc39d3
-
Filesize
219B
MD52d4c570b2be850769a88839f2fe14004
SHA1c1018888a27acc7d3f2eb455fd932b27079882e3
SHA2562af2673848170ebcd407dc15372271e230ac33b24d8ee8ab0abef4f7ed8c8fa8
SHA512ebe7bf8407a7b4d346735c25eaf99ae944435f30689c783b71bdc14f2adb03ac042c45f630ecfa00b687f54afe0d552c58829fc97bc1715cd508001510ca8bbb
-
Filesize
272B
MD56ed267a20c83978e9d25820a8de550ae
SHA173f572574e827b4b611dfc53a36b240646976693
SHA256344aa4d9a9c096fae8fbb4833b84d7b5d97293ac0ed0e7ac4a629186bea023ac
SHA51293b7b9138196868dcc7cb1100af2f8f7049228ca38779e7894cc03fef0971b497d4e91c9b07fe537f540aae49eddc82f5525dd0812126f17a7f44c533dee7078