Analysis
-
max time kernel
2244633s -
max time network
158s -
platform
android_x86 -
resource
android-x86-arm-20220310-en -
submitted
02-05-2022 15:35
General
-
Target
d8a4f7b3a7b23fdc6ebea7659b3e2143ed2271fe931fcd1a378c44f66b4c92c3.apk
-
Size
2.8MB
-
MD5
c9da19102483bfe55b12ed2e0938a149
-
SHA1
b783ad969487708381b59732f16d14325c6f50a2
-
SHA256
d8a4f7b3a7b23fdc6ebea7659b3e2143ed2271fe931fcd1a378c44f66b4c92c3
-
SHA512
db8d61866180bfa7486f81de15f9d57d7fcc5ef5a5939dfec722a8f32c8d7f09ea989531702e0d2ba31040c5b511150f6fb90fcae98aafb01760da8180f3cefd
Malware Config
Signatures
-
BlackRock
BlackRock is an android banker based on Xerxes banking Trojan.
-
BlackRock Payload 5 IoCs
-
Makes use of the framework's Accessibility service. 1 IoCs
-
Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps). 1 IoCs
-
Acquires the wake lock. 1 IoCs
-
Loads dropped Dex/Jar 5 IoCs
Runs executable file dropped to the device during analysis.
-
Uses Crypto APIs (Might try to encrypt user data). 1 IoCs
Processes
-
achieve.hidden.someone1⤵
- Makes use of the framework's Accessibility service.
- Acquires the wake lock.
- Loads dropped Dex/Jar
-
/system/bin/dex2oat --debuggable --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --debuggable --generate-mini-debug-info --dex-file=/data/user/0/achieve.hidden.someone/app_DynamicOptDex/XBo.json --output-vdex-fd=42 --oat-fd=43 --oat-location=/data/user/0/achieve.hidden.someone/app_DynamicOptDex/oat/x86/XBo.odex --compiler-filter=quicken --class-loader-context=&2⤵
- Loads dropped Dex/Jar
-
-
achieve.hidden.someone:cproc1⤵
- Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps).
- Loads dropped Dex/Jar
- Uses Crypto APIs (Might try to encrypt user data).
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
503KB
MD5574c59418371b4da099c2f07c43f64ac
SHA1c7136c97efe2e7efe088f38b6a89b45f503f0541
SHA25621ae6d1525928c29502becc16b624675b7af816bf5f08d39f499f7fb52bed5db
SHA5128ec04f42aa3482314c3ef7521d83005471e456f6c21b4d8d521d4eac1220c4e416260730098844500f2a3927872822c2f617c80eaf3c0d9f39cfff0c8bd3d84f
-
Filesize
503KB
MD52a66851d3d73f2327b74f3d4b94ee6bf
SHA1466818701217351cda42f8a7be98e0b3e8dc32e6
SHA256e46820614cc044fc10bb7f0b30eefcfb8cf4456fdb2290ae82956593b1319265
SHA5128b4fb234752fc8950ab811864865026515350dce62e758419cb8a5e260361bed604e616357353c0ecea034226a947bb616b7fa789efac2f1bac96b2afbcd2998
-
Filesize
503KB
MD52a66851d3d73f2327b74f3d4b94ee6bf
SHA1466818701217351cda42f8a7be98e0b3e8dc32e6
SHA256e46820614cc044fc10bb7f0b30eefcfb8cf4456fdb2290ae82956593b1319265
SHA5128b4fb234752fc8950ab811864865026515350dce62e758419cb8a5e260361bed604e616357353c0ecea034226a947bb616b7fa789efac2f1bac96b2afbcd2998
-
Filesize
503KB
MD52a66851d3d73f2327b74f3d4b94ee6bf
SHA1466818701217351cda42f8a7be98e0b3e8dc32e6
SHA256e46820614cc044fc10bb7f0b30eefcfb8cf4456fdb2290ae82956593b1319265
SHA5128b4fb234752fc8950ab811864865026515350dce62e758419cb8a5e260361bed604e616357353c0ecea034226a947bb616b7fa789efac2f1bac96b2afbcd2998
-
Filesize
503KB
MD52a66851d3d73f2327b74f3d4b94ee6bf
SHA1466818701217351cda42f8a7be98e0b3e8dc32e6
SHA256e46820614cc044fc10bb7f0b30eefcfb8cf4456fdb2290ae82956593b1319265
SHA5128b4fb234752fc8950ab811864865026515350dce62e758419cb8a5e260361bed604e616357353c0ecea034226a947bb616b7fa789efac2f1bac96b2afbcd2998
-
Filesize
503KB
MD52a66851d3d73f2327b74f3d4b94ee6bf
SHA1466818701217351cda42f8a7be98e0b3e8dc32e6
SHA256e46820614cc044fc10bb7f0b30eefcfb8cf4456fdb2290ae82956593b1319265
SHA5128b4fb234752fc8950ab811864865026515350dce62e758419cb8a5e260361bed604e616357353c0ecea034226a947bb616b7fa789efac2f1bac96b2afbcd2998