Analysis
-
max time kernel
126s -
max time network
132s -
platform
android_x64 -
resource
android-x64-arm64-20240624-en -
resource tags
androidarch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20240624-enlocale:en-usos:android-11-x64system -
submitted
30-06-2024 22:03
Static task
static1
Behavioral task
behavioral1
Sample
d9df98e040b3c9539961518ca58d10377b9debd204a81d17e18dc5a44bec843d.apk
Resource
android-x86-arm-20240624-en
Behavioral task
behavioral2
Sample
d9df98e040b3c9539961518ca58d10377b9debd204a81d17e18dc5a44bec843d.apk
Resource
android-x64-20240624-en
Behavioral task
behavioral3
Sample
d9df98e040b3c9539961518ca58d10377b9debd204a81d17e18dc5a44bec843d.apk
Resource
android-x64-arm64-20240624-en
General
-
Target
d9df98e040b3c9539961518ca58d10377b9debd204a81d17e18dc5a44bec843d.apk
-
Size
1.8MB
-
MD5
be51439499a88c59a614f62bec25f6ba
-
SHA1
f86b7a0124b871ece97c00b50d552d5045951bf9
-
SHA256
d9df98e040b3c9539961518ca58d10377b9debd204a81d17e18dc5a44bec843d
-
SHA512
d36185b6c7c6ca7593c446af2e5549fa16bfe1a83719d90f96e732b6ededc9d95bd018c495fd4590000169ef0e17c13c5943b337ffc7908b3a0f273974ac5e70
-
SSDEEP
24576:VY1JtfmsTMkxsVcQKLaL/+xh31Zs0qVDfTIqjTsjM1BEc79w2P5GlcOyPzIz2h1p:VY1WsAkquRL+/+L3LqZLItjKdc2B
Malware Config
Signatures
-
Makes use of the framework's Accessibility service 4 TTPs 2 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
Processes:
org.zzzz.aaadescription ioc process Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId org.zzzz.aaa Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByText org.zzzz.aaa
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
/data/data/org.zzzz.aaa/files/profileinstaller_profileWrittenFor_lastUpdateTime.datFilesize
8B
MD5d5208dc4b6caa4188ef6ac4d3ec156be
SHA18918e96305dc42f7a3aa99e3f0723c195a64a608
SHA256d93c4df1e92fc4743b4b74527d8c3f6d9c6f957ca4ce01f625dc5c53ae2c1709
SHA5127d48e4aeedafb6c237fc4a4794dbd20231ce1bb2e0149037758417f31f5d418762451757602b828731a46bf5570263841e9202b582c6af85438db472439b9849
-
/data/misc/profiles/cur/0/org.zzzz.aaa/primary.profFilesize
1KB
MD530e8f9f0d065da376c5f929b00d66d99
SHA130e1cf6db1af33a5179c7c2bd00ee5f3e1176433
SHA2566f1a126d9dc2045a00e1b20c233ca64d1d86bea7c005f01392d9cd8ad9aa53ce
SHA512d5c0489bb984bc30ff90fc2455d2cb39b7c202d9f2c615ab2acc8198225b3339e117310f417a5830a363087b63b1c84515a7148ff94b0e5136bd61014ed3ee52
-
/data/misc/profiles/cur/0/org.zzzz.aaa/primary.profFilesize
2KB
MD5ebbce72790ffd338e8fc8e7da024ace8
SHA12fafdc6eb75f097f2e3706903a6214d0d831fce9
SHA2565bfc9ed9663217a9779d5ada9ff2410c77b70ad55bf424931b5d9303840a4fa7
SHA51221816f7f4c95398b9583377f80445fcb4ffcec28633c9cd125f0223d6a46f85737071528741677a16cc6ad8580009135c639df1f12983dbf5d123265d5945a05