blackrock | 294637e7938e0894842e502a1a5ffaf5922bbb8dac7a948e1ca02bf66279e274

Analysis

max time kernel
2734504s
max time network
170s
platform
android_x64
resource
android-x64-arm64-20220310-en
submitted
08-05-2022 06:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

294637e7938e0894842e502a1a5ffaf5922bbb8dac7a948e1ca02bf66279e274.apk
Size

4.2MB
MD5

b05cf3251a5b9fc46f0c540f7db5b37a
SHA1

c2c3e89f168465cfbb4b62ad60e74de8557156ad
SHA256

294637e7938e0894842e502a1a5ffaf5922bbb8dac7a948e1ca02bf66279e274
SHA512

bd818b4ac8f36ff933aa138e5cc74cbe813735339d802a4c13afa8e4404f713a3bcf92d33c3de8fb8b91f814442ac6fd4d07817abae54fa7159bb65da2042709

Score

10^/10

blackrock banker infostealer trojan

Malware Config

Signatures

BlackRock
BlackRock is an android banker based on Xerxes banking Trojan.
banker trojan infostealer blackrock

BlackRock Payload 2 IoCs

Processes:

resource	yara_rule
/data/user/0/com.ldxalw/cache/payload.jar	family_blackrock
/data/user/0/com.ldxalw/cache/payload.jar	family_blackrock

Makes use of the framework's Accessibility service. 3 IoCs

Processes:

com.ldxalw

description	ioc	process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	com.ldxalw
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId	com.ldxalw
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByText	com.ldxalw

Acquires the wake lock. 1 IoCs

Processes:

com.ldxalw

description ioc process

Framework service call android.os.IPowerManager.acquireWakeLock com.ldxalw
Loads dropped Dex/Jar 2 IoCs
Runs executable file dropped to the device during analysis.

Processes:

com.ldxalwcom.ldxalw:cproc

ioc pid process

/data/user/0/com.ldxalw/cache/payload.jar 6277 com.ldxalw
/data/user/0/com.ldxalw/cache/payload.jar 6575 com.ldxalw:cproc

description	ioc	process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.ldxalw

ioc	pid	process
/data/user/0/com.ldxalw/cache/payload.jar	6277	com.ldxalw
/data/user/0/com.ldxalw/cache/payload.jar	6575	com.ldxalw:cproc

com.ldxalw
1⤵
- Makes use of the framework's Accessibility service.
- Acquires the wake lock.
- Loads dropped Dex/Jar
PID:6277

com.ldxalw:cproc
1⤵
- Loads dropped Dex/Jar
PID:6575

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

/data/user/0/com.ldxalw/cache/oat/payload.jar.cur.prof

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/com.ldxalw/cache/payload.jar

Filesize
139KB

MD5
b947fedc579397df726bbbf6728500dd

SHA1
04be841ee419cc6cb6156c84dbc390dd9625fde2

SHA256
6362743cfc4998b0e2550f1e651ae196303d46fbbc4c8181869c3127cd19a73f

SHA512
72f5889d1fbdf4f80b36c1f4ff696e453ab6cee2f4958364b90a12a98c25839fef8efee1109d84260573adc5d8838e27bfecd31a03eab596bd25ac0af3c06776

Download Submit
/data/user/0/com.ldxalw/cache/payload.jar

Filesize
139KB

MD5
b947fedc579397df726bbbf6728500dd

SHA1
04be841ee419cc6cb6156c84dbc390dd9625fde2

SHA256
6362743cfc4998b0e2550f1e651ae196303d46fbbc4c8181869c3127cd19a73f

SHA512
72f5889d1fbdf4f80b36c1f4ff696e453ab6cee2f4958364b90a12a98c25839fef8efee1109d84260573adc5d8838e27bfecd31a03eab596bd25ac0af3c06776

Download Submit
/data/user/0/com.ldxalw/cache/payload.jar

Filesize
299KB

MD5
69f5b3017036984a4a79ccaa24a0124b

SHA1
7de9346958439794634f11cf84d4bc231da06de6

SHA256
81399b155ddb80f3acbe8cba67c0f6fc3b631935835ca2df572eff4a9cca7d39

SHA512
3429ad1e329cf12ea995ffc14660ec70c29aa1909d8abf5a3a48d4ec1f7bc8e48637f4fd758b4e72b820031ac7849b50ec0551cd1c23bdd48a9f7f88b7cf956b

Download Submit
/data/user/0/com.ldxalw/cache/payload.jar

Filesize
299KB

MD5
69f5b3017036984a4a79ccaa24a0124b

SHA1
7de9346958439794634f11cf84d4bc231da06de6

SHA256
81399b155ddb80f3acbe8cba67c0f6fc3b631935835ca2df572eff4a9cca7d39

SHA512
3429ad1e329cf12ea995ffc14660ec70c29aa1909d8abf5a3a48d4ec1f7bc8e48637f4fd758b4e72b820031ac7849b50ec0551cd1c23bdd48a9f7f88b7cf956b

Download Submit