24138429cc3fd83cf3e344240b6239c7271a272a8352b613dc302430d8550706

Analysis

max time kernel
3s
max time network
150s
platform
android-10_x64
resource
android-x64-20240910-en
resource tags

arch:x64arch:x86image:android-x64-20240910-enlocale:en-usos:android-10-x64system
submitted
09/04/2025, 22:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

24138429cc3fd83cf3e344240b6239c7271a272a8352b613dc302430d8550706.apk
Size

1009KB
MD5

17a01801c020bb847bfe00385a0ec48b
SHA1

e6ec9c7c2ff624fa09062c539fa88d82fb5a7947
SHA256

24138429cc3fd83cf3e344240b6239c7271a272a8352b613dc302430d8550706
SHA512

a3300519e34bccbb3c399c28442625d53d83fe11a72ab317580c3f501522b8f549421d35fe422888cbc653d9a4d4d0d4e61fff1cf75b03554da4e0435fe460c0
SSDEEP

24576:XRx+HPcNxa1ZGJargUmB9zFf/zFffgZSH58g/5UB:XXGcNQGUSBhZ8g/S

Score

6^/10

defense_evasion discovery impact persistence

Malware Config

Signatures

Acquires the wake lock 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.keliduvesomote.vodusu

Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

Application may abuse the framework's foreground service to continue running in the foreground.

defense_evasion persistence

Foreground Persistence

T1541

description	ioc	Process
Framework service call	android.app.IActivityManager.setServiceForeground	com.keliduvesomote.vodusu

Queries the mobile country code (MCC) 1 TTPs 1 IoCs

discovery

System Network Configuration Discovery

T1422

description	ioc	Process
Framework service call	com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone	com.keliduvesomote.vodusu

Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

impact

Data Encrypted for Impact

T1471

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	com.keliduvesomote.vodusu

com.keliduvesomote.vodusu
1⤵
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Queries the mobile country code (MCC)
- Uses Crypto APIs (Might try to encrypt user data)
PID:5067

Network

MITRE ATT&CK Mobile v16

Initial Access

Execution

Persistence

Foreground Persistence

T1541

Privilege Escalation

Defense Evasion

Foreground Persistence

T1541

Credential Access

Discovery

System Network Configuration Discovery

T1422

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

T1471

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v16

Replay Monitor

Loading Replay Monitor...

Downloads