Overview

overview

10

Static

static

10

bfc71fa8f8...78.apk

android-9-x86

7

bfc71fa8f8...78.apk

android-10-x64

7

bfc71fa8f8...78.apk

android-11-x64

7

Analysis

  • max time kernel
    299s
  • max time network
    301s
  • platform
    android_x86
  • resource
    android-x86-arm-20240624-en
  • resource tags

    androidarch:armarch:x86image:android-x86-arm-20240624-enlocale:en-usos:android-9-x86system
  • submitted
    01-07-2024 04:42

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    bfc71fa8f865d6c05c02f4b94c8df31368abfa099f640bccafaba7c802ac3c78.apk

  • Size

    9.5MB

  • MD5

    116e803e46bf16f43840c4c6a9e22390

  • SHA1

    bd5327098de0abeea6dbbb9889631e17e655488d

  • SHA256

    bfc71fa8f865d6c05c02f4b94c8df31368abfa099f640bccafaba7c802ac3c78

  • SHA512

    aa1a98203f77a9e3c9f63415b5460b2a26586b89d3a1f803a8eb4afbe1f44302abdb1578f7ee1fbb732b99ded0c0a8bf2173c938efb3146ce3801b4a892cab19

  • SSDEEP

    98304:dsdsCCjEgZNh/vmrc8yioDt4Cmz7zBHT/0tctbM9:dSEEebOLat4tzdwYG

Score
7/10
collectioncredential_accessevasionexecutionpersistence

Malware Config

Signatures

  • Makes use of the framework's Accessibility service 4 TTPs 1 IoCs

    Retrieves information displayed on the phone screen using AccessibilityService.

    collectionevasioncredential_access
  • Acquires the wake lock 1 IoCs
  • Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

    Application may abuse the framework's foreground service to continue running in the foreground.

    evasionpersistence
  • Requests enabling of the accessibility settings. 1 IoCs
  • Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
    persistence
  • Schedules tasks to execute at a specified time 1 TTPs 1 IoCs

    Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.

    executionpersistence

Processes

  • humanity.holding.usr
    1⤵
    • Makes use of the framework's Accessibility service
    • Acquires the wake lock
    • Makes use of the framework's foreground persistence service
    • Requests enabling of the accessibility settings.
    • Registers a broadcast receiver at runtime (usually for listening for system events)
    • Schedules tasks to execute at a specified time
    PID:4254

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • /storage/emulated/0/Config/sys/apps/log/log-2024-07-01.txt
    Filesize

    13B

    MD5

    de2c41a51ee9246eb1708f65b511add0

    SHA1

    2f442d634c8a18760a232c8829d4b5d74a52f074

    SHA256

    ad2d914ca347cd1930e32f21c6d5448c34104bea181b93abc85ec518985653ab

    SHA512

    7cdfbd001594503644e9ed80ae852f90ef9e841a8382e2eec6979e149a2c400a3b83055d205b4d1d66e1600e5127482932d5127eb5800d35a4ee5673fe34d84a

    Download Submit
  • /storage/emulated/0/Config/sys/apps/log/log-2024-07-01.txt
    Filesize

    25B

    MD5

    ba30336bf53d54ed3c0ea69dd545de8c

    SHA1

    ce99c6724c75b93b7448e2d9fac16ca702a5711f

    SHA256

    2d6988fb5afdaafc4e33fa1f71d6f10c95ab5a49a8ec820add5b13eef05439af

    SHA512

    eea34ca526e03349e746d3687ea660b4748f0174fe2ffdb65161e232e08630b345e03329614852ce881a71362ba68575e9dd08fa361a416e5b2fb231e21a0a3e

    Download Submit
  • /storage/emulated/0/Config/sys/apps/log/log-2024-07-01.txt
    Filesize

    260B

    MD5

    c0f7b14f0ac88d8d70e8b54b0deae49c

    SHA1

    0a511e2b96db844554319ba8b2f815c2296bb0c3

    SHA256

    62c988b24b08b0f0f85e693d7e2f13e2f86a298454546ebb6e457d3f51f76751

    SHA512

    9dbfc277a9401e30ebaf5d85368bb544f21d20a78fb7df6b2d9a97e4a8ceb8b63042ce24f23fe7f657100c279d261a3e8cc593a26adfe86a4fab310f72c0e63a

    Download Submit