blackrock | da96daccff18c40dbed7ca1ff2b2922bd9a90bb1ac4b1a0df0f5babaa06fa1d7

Analysis

max time kernel
3844208s
max time network
155s
platform
android_x64
resource
android-x64-arm64-20220310-en
submitted
21-05-2022 03:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

da96daccff18c40dbed7ca1ff2b2922bd9a90bb1ac4b1a0df0f5babaa06fa1d7.apk
Size

4.4MB
MD5

6810a90564f60dc65d8ea806438d6cce
SHA1

deb428f6c99b187906ec9e8faad5cb198443afc7
SHA256

da96daccff18c40dbed7ca1ff2b2922bd9a90bb1ac4b1a0df0f5babaa06fa1d7
SHA512

aadb2ec062bec607a57bd4596d0902eb237e0e5253ca64921808d0259ea6e6af9ed64ed5cc994662fb37ce97f20bba852bd5b92e74c5df01150580ae3ccf6af5

Score

10^/10

blackrock banker infostealer trojan

Malware Config

Signatures

BlackRock
BlackRock is an android banker based on Xerxes banking Trojan.
banker trojan infostealer blackrock

BlackRock Payload 2 IoCs

Processes:

resource	yara_rule
behavioral3/memory/6941-0.dex	family_blackrock
behavioral3/memory/6984-0.dex	family_blackrock

Makes use of the framework's Accessibility service. 3 IoCs

Processes:

com.mkfjvtla

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	com.mkfjvtla
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId	com.mkfjvtla
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByText	com.mkfjvtla

Acquires the wake lock. 1 IoCs

Processes:

com.mkfjvtla

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.mkfjvtla

Loads dropped Dex/Jar 2 IoCs

Runs executable file dropped to the device during analysis.

Processes:

com.mkfjvtlacom.mkfjvtla:cproc

ioc	pid	Process
/data/user/0/com.mkfjvtla/cache/payload.jar	6941	com.mkfjvtla
/data/user/0/com.mkfjvtla/cache/payload.jar	6984	com.mkfjvtla:cproc

com.mkfjvtla
1⤵
- Makes use of the framework's Accessibility service.
- Acquires the wake lock.
- Loads dropped Dex/Jar
PID:6941

com.mkfjvtla:cproc
1⤵
- Loads dropped Dex/Jar
PID:6984

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

/data/user/0/com.mkfjvtla/cache/oat/payload.jar.cur.prof

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/com.mkfjvtla/cache/payload.jar

Filesize
138KB

MD5
1737570f4cb8a0bbdb3e9f9553af5981

SHA1
1458ea294654f402f909410bdff9f17d762d76f6

SHA256
72f9423cf2474b42269a57f92ae5fdec23294899d88f08421496245f4f125d66

SHA512
48f4d48840bdc8e0abafed856fba1b77a3e190975e475a40d74cc9dc6375f3a80d2d0e8f5cc161a60a1c856ffeb36be52409df3f92a359dbb4910a893bf645f9

Download Submit
/data/user/0/com.mkfjvtla/cache/payload.jar

Filesize
138KB

MD5
1737570f4cb8a0bbdb3e9f9553af5981

SHA1
1458ea294654f402f909410bdff9f17d762d76f6

SHA256
72f9423cf2474b42269a57f92ae5fdec23294899d88f08421496245f4f125d66

SHA512
48f4d48840bdc8e0abafed856fba1b77a3e190975e475a40d74cc9dc6375f3a80d2d0e8f5cc161a60a1c856ffeb36be52409df3f92a359dbb4910a893bf645f9

Download Submit
/data/user/0/com.mkfjvtla/cache/payload.jar

Filesize
300KB

MD5
710a5677d720564f8e40b144fac89588

SHA1
1f1508653c60068c2fbaeebf6ef73aca57a3eec9

SHA256
084c2ae46d6e3f6cc8081dc2a24dd358228b28b55b219fa935e3b02c7d4fe686

SHA512
2e8546001aca1fa218e53b11d2693cd3e87221f4e5e969e35441fbbfb9180e5a3247c7d4b6cef2c24c3b4fbac8629d04dd6cca4c7eef1da3738f8dc41d68c32c

Download Submit
/data/user/0/com.mkfjvtla/cache/payload.jar

Filesize
300KB

MD5
710a5677d720564f8e40b144fac89588

SHA1
1f1508653c60068c2fbaeebf6ef73aca57a3eec9

SHA256
084c2ae46d6e3f6cc8081dc2a24dd358228b28b55b219fa935e3b02c7d4fe686

SHA512
2e8546001aca1fa218e53b11d2693cd3e87221f4e5e969e35441fbbfb9180e5a3247c7d4b6cef2c24c3b4fbac8629d04dd6cca4c7eef1da3738f8dc41d68c32c

Download Submit