blackrock | da96daccff18c40dbed7ca1ff2b2922bd9a90bb1ac4b1a0df0f5babaa06fa1d7

General

Target

da96daccff18c40dbed7ca1ff2b2922bd9a90bb1ac4b1a0df0f5babaa06fa1d7.apk
Size

4.4MB
MD5

6810a90564f60dc65d8ea806438d6cce
SHA1

deb428f6c99b187906ec9e8faad5cb198443afc7
SHA256

da96daccff18c40dbed7ca1ff2b2922bd9a90bb1ac4b1a0df0f5babaa06fa1d7
SHA512

aadb2ec062bec607a57bd4596d0902eb237e0e5253ca64921808d0259ea6e6af9ed64ed5cc994662fb37ce97f20bba852bd5b92e74c5df01150580ae3ccf6af5

Score

10^/10

blackrock banker infostealer trojan

Malware Config

Signatures

BlackRock
BlackRock is an android banker based on Xerxes banking Trojan.
banker trojan infostealer blackrock

BlackRock Payload 3 IoCs

resource	yara_rule
behavioral1/memory/5258-0.dex	family_blackrock
behavioral1/memory/5168-0.dex	family_blackrock
behavioral1/memory/5426-0.dex	family_blackrock

Makes use of the framework's Accessibility service. 3 IoCs

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByText	com.mkfjvtla
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	com.mkfjvtla
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId	com.mkfjvtla

Acquires the wake lock. 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.mkfjvtla

Loads dropped Dex/Jar 3 IoCs

Runs executable file dropped to the device during analysis.

ioc	pid	Process
/data/user/0/com.mkfjvtla/cache/payload.jar	5258	/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.mkfjvtla/cache/payload.jar --output-vdex-fd=42 --oat-fd=43 --oat-location=/data/user/0/com.mkfjvtla/cache/oat/x86/payload.odex --compiler-filter=quicken --class-loader-context=&
/data/user/0/com.mkfjvtla/cache/payload.jar	5168	com.mkfjvtla
/data/user/0/com.mkfjvtla/cache/payload.jar	5426	com.mkfjvtla:cproc

com.mkfjvtla
1⤵
- Makes use of the framework's Accessibility service.
- Acquires the wake lock.
- Loads dropped Dex/Jar
PID:5168
- /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.mkfjvtla/cache/payload.jar --output-vdex-fd=42 --oat-fd=43 --oat-location=/data/user/0/com.mkfjvtla/cache/oat/x86/payload.odex --compiler-filter=quicken --class-loader-context=&
  2⤵
  - Loads dropped Dex/Jar
  PID:5258

com.mkfjvtla:cproc
1⤵
- Loads dropped Dex/Jar
PID:5426

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

/data/user/0/com.mkfjvtla/cache/payload.jar

Filesize
138KB

MD5
1737570f4cb8a0bbdb3e9f9553af5981

SHA1
1458ea294654f402f909410bdff9f17d762d76f6

SHA256
72f9423cf2474b42269a57f92ae5fdec23294899d88f08421496245f4f125d66

SHA512
48f4d48840bdc8e0abafed856fba1b77a3e190975e475a40d74cc9dc6375f3a80d2d0e8f5cc161a60a1c856ffeb36be52409df3f92a359dbb4910a893bf645f9

Download Submit
/data/user/0/com.mkfjvtla/cache/payload.jar

Filesize
138KB

MD5
1737570f4cb8a0bbdb3e9f9553af5981

SHA1
1458ea294654f402f909410bdff9f17d762d76f6

SHA256
72f9423cf2474b42269a57f92ae5fdec23294899d88f08421496245f4f125d66

SHA512
48f4d48840bdc8e0abafed856fba1b77a3e190975e475a40d74cc9dc6375f3a80d2d0e8f5cc161a60a1c856ffeb36be52409df3f92a359dbb4910a893bf645f9

Download Submit
/data/user/0/com.mkfjvtla/cache/payload.jar

Filesize
300KB

MD5
44e74feb3da65096284a67a9dca15fe5

SHA1
d3d62c39bcf508758ea0a85632278b7495052f81

SHA256
7b51f9604525b2c48f2f8cdc72a7b1fd3a1aa2301800809fa4c1254c1d8f3cde

SHA512
989e20bd308bc1863ae015926268ad51e0f56de9486147959d65e88c6923b6fba59ec290292daea238215d9bf7fc3803533e701c866d27a02fcc8bdcc7dca63e

Download Submit
/data/user/0/com.mkfjvtla/cache/payload.jar

Filesize
300KB

MD5
710a5677d720564f8e40b144fac89588

SHA1
1f1508653c60068c2fbaeebf6ef73aca57a3eec9

SHA256
084c2ae46d6e3f6cc8081dc2a24dd358228b28b55b219fa935e3b02c7d4fe686

SHA512
2e8546001aca1fa218e53b11d2693cd3e87221f4e5e969e35441fbbfb9180e5a3247c7d4b6cef2c24c3b4fbac8629d04dd6cca4c7eef1da3738f8dc41d68c32c

Download Submit
/data/user/0/com.mkfjvtla/cache/payload.jar

Filesize
300KB

MD5
44e74feb3da65096284a67a9dca15fe5

SHA1
d3d62c39bcf508758ea0a85632278b7495052f81

SHA256
7b51f9604525b2c48f2f8cdc72a7b1fd3a1aa2301800809fa4c1254c1d8f3cde

SHA512
989e20bd308bc1863ae015926268ad51e0f56de9486147959d65e88c6923b6fba59ec290292daea238215d9bf7fc3803533e701c866d27a02fcc8bdcc7dca63e

Download Submit

Analysis

Sharing