General
- Target CarParkingMultiplayerHile.apk
- Size 8.5MB
- Sample260705-vynsssev4t
- SHA256 b33ea476f8b2d91f07a9e02a6c603379be35fa6be3e032af5b69319f0c89ef4f
- MD5 66ebb31d8df72e8e0c160a1db914a081
- SHA1 82dc4856058df007ef3a67bf2611335b2638e1dd
- SHA512 f5d04d6adf6c7f5c05ac77085adbdfebe3d4bb28f9f37c59986e2f92e54dacf044f999d33154fdb8e23bcfcaf34836cd00480a451eeb8fc36650841e81930ccf
- SSDEEP 49152:KTyJ5Uirwp/FY7YS3U9TQHou/U037dmzdzdGGJQTOQQUoYqH0cgZ+KE:te0L0n9TQHh/Z3pmzdzBGTS0tZq
- TLSH T14296E003F905CBC2C46C92F57A170FA82A671F98D591AAEB00583B5F7E362D60DE65CC
- MD5 SHA1 SHA512 SSDEEP TLSH
Behavioral task
behavioral1
Sample
CarParkingMultiplayerHile.apk
Resource
android-33-x64-arm64-20260325-en
Behavioral task
behavioral2
Sample
CarParkingMultiplayerHile.apk
Resource
android-x64-20260325-en
Behavioral task
behavioral3
Sample
CarParkingMultiplayerHile.apk
Resource
android-x64-arm64-20260325-en
Behavioral task
behavioral4
Sample
CarParkingMultiplayerHile.apk
Resource
android-34-x64-arm64-20260325.1-en
Behavioral task
behavioral5
Sample
CarParkingMultiplayerHile.apk
Resource
android-35-x64-arm64-20260325-en
Behavioral task
behavioral6
Sample
CarParkingMultiplayerHile.apk
Resource
android-x86-arm-20260325-en
Malware Config
Extracted
-
spynote
-
yfk8rt3wa.localto.net:4399
Targets
-
- Target CarParkingMultiplayerHile.apk
- Size 8.5MB
- SHA256 b33ea476f8b2d91f07a9e02a6c603379be35fa6be3e032af5b69319f0c89ef4f
- MD5 66ebb31d8df72e8e0c160a1db914a081
- SHA1 82dc4856058df007ef3a67bf2611335b2638e1dd
- SHA512 f5d04d6adf6c7f5c05ac77085adbdfebe3d4bb28f9f37c59986e2f92e54dacf044f999d33154fdb8e23bcfcaf34836cd00480a451eeb8fc36650841e81930ccf
- SSDEEP 49152:KTyJ5Uirwp/FY7YS3U9TQHou/U037dmzdzdGGJQTOQQUoYqH0cgZ+KE:te0L0n9TQHh/Z3pmzdzBGTS0tZq
- TLSH T14296E003F905CBC2C46C92F57A170FA82A671F98D591AAEB00583B5F7E362D60DE65CC
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Makes use of the framework's Accessibility service
Retrieves information displayed on the phone screen using AccessibilityService.
-
Acquires the wake lock
-
Makes use of the framework's foreground persistence service
Application may abuse the framework's foreground service to continue running in the foreground.
-
Performs UI accessibility actions on behalf of the user
Application may abuse the accessibility service to prevent their removal.
-
Requests disabling of battery optimizations (often used to enable hiding in the background).
MITRE ATT&CK Mobile v16
Persistence
Event Triggered Execution
1Broadcast Receivers
1Foreground Persistence
1Scheduled Task/Job
1Defense Evasion
Foreground Persistence
1Hide Artifacts
1User Evasion
1Impair Defenses
1Prevent Application Removal
1Input Injection
1