Analysis
- user interaction
yes - max time kernel
388s - max time network
392s - platform
android-11_x64 - resource
android-x64-arm64-20260325-en - resource tags
arch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20260325-enlocale:en-usos:android-11-x64system - submitted
10/08/2026, 00:05
Behavioral task
behavioral1
Sample
ready.apk
Resource
android-x64-20260325-en
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
ready.apk
Resource
android-x64-arm64-20260325-en
5 signatures
150 seconds
Behavioral task
behavioral3
Sample
ready.apk
Resource
android-33-x64-arm64-20260708-en
5 signatures
150 seconds
Behavioral task
behavioral4
Sample
ready.apk
Resource
android-34-x64-arm64-20260325.1-en
4 signatures
150 seconds
General
- Target ready.apk
- Size 3.7MB
- Sample260810-addrwafp8t
- SHA256 ca53f94f4a75bc5d42df92e04442efc6a7a8503d2b3b517b8b0e6efeff570b92
- MD5 4df204a0beda0d457df3ddf5c19a5427
- SHA1 1c5b71018f6bd523d1729b510c4c7dd99dba0a58
- SHA512 fdec17e284070369728e2d5354e76eab138ba9466a2402abcf3f53bc63f01c24f00ac035bae7a275775af56fab85e63081b8622402eaf47c90a7e21ecb439545
- SSDEEP 98304:3dqu1TJZkB+T7iOpDL2WmzjzBVTQ0t0hqYa4:3FFZVi62hz779O
- TLSH T16C06E047EF85CADBD4B983F16B330D992A170F19C642AAD70468367E2E771C11EC5A8C
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Makes use of the framework's Accessibility service 4 TTPs 1 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
description ioc Process Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId informative.gossip.grip - Acquires the wake lock 1 IoCs
description ioc Process Framework service call android.os.IPowerManager.acquireWakeLock informative.gossip.grip - Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
description ioc Process Framework service call android.app.IActivityManager.setServiceForeground informative.gossip.grip - Queries information about active data network 1 TTPs 1 IoCs
description ioc Process Framework service call android.net.IConnectivityManager.getActiveNetworkInfo informative.gossip.grip - Schedules tasks to execute at a specified time 1 TTPs 1 IoCs
Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.
description ioc Process Framework service call android.app.job.IJobScheduler.schedule informative.gossip.grip
Processes
Network
MITRE ATT&CK Mobile v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path /storage/emulated/0/Config/sys/apps/log/log-2026-08-10.txt
- Size 25B
- SHA256 a1ea0cecec3d74e34e9874060753be7786995c8cc62e1daa420f930122f43eec
- MD5 29c860eaf6f36678345f0a9f6b9cc0d9
- SHA1 7ffbfbc250be31fd70760cb9f0536e6e4f45c6ef
- SHA512 290f920dbee3dd59bd258ec398f0816ee24a620392ce8deaad0e6d1eaa1208f891393522d8125aea4aef9163f9011a02b3463e2d41a4e24bde065fcbad57ed20
- MD5 SHA1 SHA512