Resubmissions
15/09/2026, 13:50
260915-q5jp7syake1023/07/2026, 16:33
260723-t2yxhasgjg1023/07/2026, 16:28
260723-ty6g6ssfpf1005/11/2025, 18:24
251105-w11qtahq9y10Analysis
- max time kernel
149s - max time network
151s - platform
android-10_x64 - resource
android-x64-20260325-en - resource tags
- submitted
15/09/2026, 13:50
General
- Target seeham.apk
- Size 2.3MB
- Sample260915-q5jp7syake
- SHA256 000e9bc41614fed11331af33052cd360f9347ec8190bc812c18550bbd3b65efb
Malware Config
Signatures
- Makes use of the framework's Accessibility service 4 TTPs 2 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
- Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
- Unexpected DNS network traffic destination 64 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
- Acquires the wake lock 1 IoCs
- Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
- Performs UI accessibility actions on behalf of the user 1 TTPs 5 IoCs
Application may abuse the accessibility service to prevent their removal.
- Queries information about active data network 1 TTPs 1 IoCs
- Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
- Schedules tasks to execute at a specified time 1 TTPs 1 IoCs
Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.
- Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
Processes
-
t3mjg717.ui3rqy.g07dx89cfd50081⤵
- Makes use of the framework's Accessibility service
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Performs UI accessibility actions on behalf of the user
- Queries information about active data network
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Schedules tasks to execute at a specified time
- Uses Crypto APIs (Might try to encrypt user data)
Network
MITRE ATT&CK Mobile v16
Persistence
Event Triggered Execution
1Broadcast Receivers
1Foreground Persistence
1Scheduled Task/Job
1Defense Evasion
Foreground Persistence
1Impair Defenses
1Prevent Application Removal
1Input Injection
1Discovery
Software Discovery
1Security Software Discovery
1System Network Connections Discovery
1Replay Monitor
Loading Replay Monitor...
Downloads
profileInstalled
profileinstaller_profileWrittenFor_lastUpdateTime.dat
androidx.work.workdb
androidx.work.workdb-journal
androidx.work.workdb-shm
androidx.work.workdb-wal
androidx.work.workdb-wal
androidx.work.workdb-wal
primary.prof
primary.prof
primary.prof