Overview

overview

10

Static

static

7

aef6feeb7f...2a.apk

android_x86

10

aef6feeb7f...2a.apk

android_x64

10

aef6feeb7f...2a.apk

android_x64

Analysis

  • max time kernel
    677795s
  • max time network
    174s
  • platform
    android_x86
  • resource
    android-x86-arm-20220310-en
  • submitted
    03-06-2022 06:14

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    aef6feeb7fd1af99b5539e8d5a2b712a.apk

  • Size

    1.9MB

  • MD5

    aef6feeb7fd1af99b5539e8d5a2b712a

  • SHA1

    22754ea7447c2708420b883b567ec902ece8e56a

  • SHA256

    6fa4baef8a811f429cee4b383d7a4776b7b363b62551c8d8e0f93bad33adefbd

  • SHA512

    f4ec1af475246355ba6ea9c63b02a74742b613a6c63953ab764a7fbc4d6a66abc57d6967fba19b86d15dad08721331b94af7983c3b91ef22e84a53d262a709d6

Score
10/10
blackrockbankerinfostealerransomwaretrojan

Malware Config

Signatures

  • BlackRock

    BlackRock is an android banker based on Xerxes banking Trojan.

    bankertrojaninfostealerblackrock
  • BlackRock Payload 5 IoCs
  • Makes use of the framework's Accessibility service. 3 IoCs
  • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps). 1 IoCs
    banker
  • Acquires the wake lock. 1 IoCs
  • Loads dropped Dex/Jar 5 IoCs

    Runs executable file dropped to the device during analysis.

  • Uses Crypto APIs (Might try to encrypt user data). 1 IoCs
    ransomware

Processes

  • cmbmpqod.bfrtuduawoyhr.mlmrncmjbdecuc
    1⤵
    • Makes use of the framework's Accessibility service.
    • Acquires the wake lock.
    • Loads dropped Dex/Jar
    PID:5235
    • /system/bin/dex2oat --debuggable --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --debuggable --generate-mini-debug-info --dex-file=/data/user/0/cmbmpqod.bfrtuduawoyhr.mlmrncmjbdecuc/app_DynamicOptDex/FI.json --output-vdex-fd=43 --oat-fd=44 --oat-location=/data/user/0/cmbmpqod.bfrtuduawoyhr.mlmrncmjbdecuc/app_DynamicOptDex/oat/x86/FI.odex --compiler-filter=quicken --class-loader-context=&
      2⤵
      • Loads dropped Dex/Jar
      PID:5303
  • cmbmpqod.bfrtuduawoyhr.mlmrncmjbdecuc:cproc
    1⤵
    • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps).
    • Loads dropped Dex/Jar
    • Uses Crypto APIs (Might try to encrypt user data).
    PID:5432

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/user/0/cmbmpqod.bfrtuduawoyhr.mlmrncmjbdecuc/app_DynamicOptDex/FI.json
    Filesize

    480KB

    MD5

    29f361eba91eae385a43866444e29a40

    SHA1

    920f779b3b93a04f1986bf6b616b17b15390fbfe

    SHA256

    3b2e473ace0c2e5bb6d76353406f5386178b1f9be9df3a41b2b19e3aafe62d3e

    SHA512

    851e6ca89dd39542597ab096c27a5bd2ef6574bacadd930ad1c88f9abe17df982be2dd707276d2fe6222fdd50b20025ee5adb42c3b5d817b972fe004a7ee961f

    Download Submit
  • /data/user/0/cmbmpqod.bfrtuduawoyhr.mlmrncmjbdecuc/app_DynamicOptDex/FI.json
    Filesize

    480KB

    MD5

    8cfb576875bc98bf537d895d227d7a58

    SHA1

    71fbb13f519ac886c747103a8e5d93c6d0ca7cb7

    SHA256

    279c60682bf5cb7fe98df8e3f8ec41fe2404c35fa9c910938c97d11c8e0494b9

    SHA512

    6ce60e87992a21cb206675765962644121e6d9080d0afb348eb360a33592f3f717e7b7fdec3eece3a7ad202b882fe1bad31c9ecaf7c2ca9fa805ca17279f4d89

    Download Submit
  • /data/user/0/cmbmpqod.bfrtuduawoyhr.mlmrncmjbdecuc/app_DynamicOptDex/FI.json
    Filesize

    480KB

    MD5

    8cfb576875bc98bf537d895d227d7a58

    SHA1

    71fbb13f519ac886c747103a8e5d93c6d0ca7cb7

    SHA256

    279c60682bf5cb7fe98df8e3f8ec41fe2404c35fa9c910938c97d11c8e0494b9

    SHA512

    6ce60e87992a21cb206675765962644121e6d9080d0afb348eb360a33592f3f717e7b7fdec3eece3a7ad202b882fe1bad31c9ecaf7c2ca9fa805ca17279f4d89

    Download Submit
  • /data/user/0/cmbmpqod.bfrtuduawoyhr.mlmrncmjbdecuc/app_DynamicOptDex/FI.json
    Filesize

    480KB

    MD5

    8cfb576875bc98bf537d895d227d7a58

    SHA1

    71fbb13f519ac886c747103a8e5d93c6d0ca7cb7

    SHA256

    279c60682bf5cb7fe98df8e3f8ec41fe2404c35fa9c910938c97d11c8e0494b9

    SHA512

    6ce60e87992a21cb206675765962644121e6d9080d0afb348eb360a33592f3f717e7b7fdec3eece3a7ad202b882fe1bad31c9ecaf7c2ca9fa805ca17279f4d89

    Download Submit
  • /data/user/0/cmbmpqod.bfrtuduawoyhr.mlmrncmjbdecuc/app_DynamicOptDex/FI.json
    Filesize

    480KB

    MD5

    8cfb576875bc98bf537d895d227d7a58

    SHA1

    71fbb13f519ac886c747103a8e5d93c6d0ca7cb7

    SHA256

    279c60682bf5cb7fe98df8e3f8ec41fe2404c35fa9c910938c97d11c8e0494b9

    SHA512

    6ce60e87992a21cb206675765962644121e6d9080d0afb348eb360a33592f3f717e7b7fdec3eece3a7ad202b882fe1bad31c9ecaf7c2ca9fa805ca17279f4d89

    Download Submit
  • /data/user/0/cmbmpqod.bfrtuduawoyhr.mlmrncmjbdecuc/app_DynamicOptDex/FI.json
    Filesize

    480KB

    MD5

    8cfb576875bc98bf537d895d227d7a58

    SHA1

    71fbb13f519ac886c747103a8e5d93c6d0ca7cb7

    SHA256

    279c60682bf5cb7fe98df8e3f8ec41fe2404c35fa9c910938c97d11c8e0494b9

    SHA512

    6ce60e87992a21cb206675765962644121e6d9080d0afb348eb360a33592f3f717e7b7fdec3eece3a7ad202b882fe1bad31c9ecaf7c2ca9fa805ca17279f4d89

    Download Submit
  • /data/user/0/cmbmpqod.bfrtuduawoyhr.mlmrncmjbdecuc/app_DynamicOptDex/FI.json.x86.flock
    MD5

    d41d8cd98f00b204e9800998ecf8427e

    SHA1

    da39a3ee5e6b4b0d3255bfef95601890afd80709

    SHA256

    e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

    SHA512

    cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

    Download Submit
  • /data/user/0/cmbmpqod.bfrtuduawoyhr.mlmrncmjbdecuc/app_DynamicOptDex/FI.json.x86.flock
    MD5

    d41d8cd98f00b204e9800998ecf8427e

    SHA1

    da39a3ee5e6b4b0d3255bfef95601890afd80709

    SHA256

    e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

    SHA512

    cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

    Download Submit
  • /data/user/0/cmbmpqod.bfrtuduawoyhr.mlmrncmjbdecuc/app_DynamicOptDex/oat/FI.json.cur.prof
    MD5

    d41d8cd98f00b204e9800998ecf8427e

    SHA1

    da39a3ee5e6b4b0d3255bfef95601890afd80709

    SHA256

    e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

    SHA512

    cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

    Download Submit
  • /data/user/0/cmbmpqod.bfrtuduawoyhr.mlmrncmjbdecuc/app_DynamicOptDex/oat/x86/FI.odex
    MD5

    d41d8cd98f00b204e9800998ecf8427e

    SHA1

    da39a3ee5e6b4b0d3255bfef95601890afd80709

    SHA256

    e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

    SHA512

    cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

    Download Submit
  • /data/user/0/cmbmpqod.bfrtuduawoyhr.mlmrncmjbdecuc/app_DynamicOptDex/oat/x86/FI.vdex
    MD5

    d41d8cd98f00b204e9800998ecf8427e

    SHA1

    da39a3ee5e6b4b0d3255bfef95601890afd80709

    SHA256

    e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

    SHA512

    cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

    Download Submit