Overview

overview

10

Static

static

10

promo.apk

android-9-x86

promo.apk

android-10-x64

7

promo.apk

android-11-x64

7

Analysis

  • max time kernel
    149s
  • max time network
    151s
  • platform
    android-11_x64
  • resource
    android-x64-arm64-20240910-en
  • resource tags

    arch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20240910-enlocale:en-usos:android-11-x64system
  • submitted
    04/04/2025, 08:25

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    promo.apk

  • Size

    12.1MB

  • MD5

    3f2506a80d5065e2d545899500e447fc

  • SHA1

    a3718e2fdfb21896e1c20ed5d13b9faf0a63f699

  • SHA256

    84421ce74388dc68fdb45dfcf8420910991e829b69ace11a6c70e0507163f2ff

  • SHA512

    9fb52c9c25097751d852e380964102e9de2c8a8de62d13ef921bcf6ec31eff38da7f6d32e1b340212a76b66f38e9c1adc66efef3e018aae0e6630cd08bbc028b

  • SSDEEP

    196608:E0ER65tEBBDjodumjbdvgdjr7+2LOD3+FHr2p9LvDEcGnWwpcKMKBYv:c6XEvDW3dvv2LOjQHip9Lv6nVTZ6v

Score
7/10
collectioncredential_accessdefense_evasionexecutionpersistence

Malware Config

Signatures

  • Makes use of the framework's Accessibility service 4 TTPs 1 IoCs

    Retrieves information displayed on the phone screen using AccessibilityService.

    collectiondefense_evasioncredential_access
  • Acquires the wake lock 1 IoCs
  • Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

    Application may abuse the framework's foreground service to continue running in the foreground.

    defense_evasionpersistence
  • Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
    defense_evasion
  • Schedules tasks to execute at a specified time 1 TTPs 1 IoCs

    Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.

    executionpersistence

Processes

  • com.mbon.cocoleens9000k
    1⤵
    • Makes use of the framework's Accessibility service
    • Acquires the wake lock
    • Makes use of the framework's foreground persistence service
    • Requests disabling of battery optimizations (often used to enable hiding in the background).
    • Schedules tasks to execute at a specified time
    PID:4635

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • /storage/emulated/0/Config/sys/apps/log/log-2025-04-04.txt
    Filesize

    20B

    MD5

    d6ea019461671ae729691261cbdb2e45

    SHA1

    980a183c51b94314887117d2d150883a42f83b84

    SHA256

    1ed4ca672c92b231ac046c50cb0b4f4b688104b9a318a48ae566cd2f0bf6d523

    SHA512

    d4329310857942f95628dedda7cf4d3f0e2c9f0dcaae56e048b40f803d940a0867d18f5f2f1931ffac45f179dccc3ad5fafdbf1ec9ae5fd0186ea64faf93fd91

    Download Submit