Analysis
-
max time kernel
149s -
max time network
151s -
platform
android-9_x86 -
resource
android-x86-arm-20240910-en -
resource tags
-
submitted
04/04/2025, 01:53
General
-
Target
Viceversa.apk
-
Size
3.6MB
-
MD5
42cc3f3e6f92a049cb0d15e3bb20b2d9
-
SHA1
e91e646ec9c2b7268fb2c4f8696009421503018b
-
SHA256
71351a9013e7cfbe959d1ea78d1f7bf4bc2cb08a5716725c8434a911149099f3
-
SHA512
d471ed7bffd97a61eafadcdf29b27d06f7bc65fcd63c7145e6b2f2e57f1bfc859c9c846c9ba1bfc25ad23f29b4d379ebf44fcac95430af1fc6aaeedf32add1ff
-
SSDEEP
49152:EmXomFJBLNKNbJUnsd5XUqpvSTt4KNoWxLyz/tX9pBNuhmzjzdGGSQTORqUfYqAn:EcBMbJpjEKKnNoWxLtmzjzB9TD0t+jt
Malware Config
Signatures
-
Removes its main activity from the application launcher 1 TTPs 1 IoCs
-
Makes use of the framework's Accessibility service 4 TTPs 3 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
-
Acquires the wake lock 1 IoCs
-
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
-
Performs UI accessibility actions on behalf of the user 1 TTPs 12 IoCs
Application may abuse the accessibility service to prevent their removal.
-
Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
-
Requests enabling of the accessibility settings. 1 IoCs
-
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
-
Schedules tasks to execute at a specified time 1 TTPs 1 IoCs
Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.
Processes
-
imagine.galleries.child1⤵
- Removes its main activity from the application launcher
- Makes use of the framework's Accessibility service
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Performs UI accessibility actions on behalf of the user
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Requests enabling of the accessibility settings.
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Schedules tasks to execute at a specified time
Network
MITRE ATT&CK Mobile v15
Persistence
Event Triggered Execution
1Broadcast Receivers
1Foreground Persistence
1Scheduled Task/Job
1Defense Evasion
Foreground Persistence
1Hide Artifacts
2Suppress Application Icon
1User Evasion
1Impair Defenses
1Prevent Application Removal
1Input Injection
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
25B
MD5ba30336bf53d54ed3c0ea69dd545de8c
SHA1ce99c6724c75b93b7448e2d9fac16ca702a5711f
SHA2562d6988fb5afdaafc4e33fa1f71d6f10c95ab5a49a8ec820add5b13eef05439af
SHA512eea34ca526e03349e746d3687ea660b4748f0174fe2ffdb65161e232e08630b345e03329614852ce881a71362ba68575e9dd08fa361a416e5b2fb231e21a0a3e
-
Filesize
41B
MD5a37f5a459060ba49263f50df8817df5e
SHA18830e32021fec8cf86e9afe7b7313376adf87701
SHA25622b5b05eb198c5611cb1757c095a15f72049adabd2cfa7d6bd7e25aa04483071
SHA5123c7ab0c2736e5c9615bad5733fe4f75e5f44b8af8ef9c99c7bd947bf08acfccf955f04de27748c04e86d2299e1684a0904026563f245e82fbdaff75a86a688ad
-
Filesize
25B
MD5fd8ed43ac31bbf329c395582c15753cd
SHA13c76ee3fa79dde645c0447d6b23d6f435efb3b72
SHA256049d51bf61bf26d7b9e55391560cc23ec59d2240453ac81b87f2e81153b0fcaf
SHA51277bb10d1eeeea15fc35f7232af698c951d3f47a5fff56682bbc32f6bea9ebecc997d89ed88c6dff9c226c09446261f184ecbac9697f95799753d73a71e6c4d37
-
Filesize
284B
MD5c5dd2a1be183cffc38ca3628e917af1e
SHA1af29427cc0aaa002486760df5714720c8ade963f
SHA256f18d1be86769007abcf494c448674948b9ff2c19d8b389bf3100b09eddc72592
SHA5121275048cfc97d986c8b3804cd3bc34075e6078310cc5c0986c04a095e8e6e0a055f7f597e954a4b723a1e7b24ef4931dc39daad6514dd80f1908366d28f5d23a