blackrock | 6fa4baef8a811f429cee4b383d7a4776b7b363b62551c8d8e0f93bad33adefbd

Analysis

max time kernel
677795s
max time network
174s
platform
android_x86
resource
android-x86-arm-20220310-en
submitted
03-06-2022 06:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

aef6feeb7fd1af99b5539e8d5a2b712a.apk
Size

1.9MB
MD5

aef6feeb7fd1af99b5539e8d5a2b712a
SHA1

22754ea7447c2708420b883b567ec902ece8e56a
SHA256

6fa4baef8a811f429cee4b383d7a4776b7b363b62551c8d8e0f93bad33adefbd
SHA512

f4ec1af475246355ba6ea9c63b02a74742b613a6c63953ab764a7fbc4d6a66abc57d6967fba19b86d15dad08721331b94af7983c3b91ef22e84a53d262a709d6

Score

10^/10

blackrock banker infostealer ransomware trojan

Malware Config

Signatures

BlackRock
BlackRock is an android banker based on Xerxes banking Trojan.
banker trojan infostealer blackrock

BlackRock Payload 5 IoCs

Processes:

resource	yara_rule
/data/user/0/cmbmpqod.bfrtuduawoyhr.mlmrncmjbdecuc/app_DynamicOptDex/FI.json	family_blackrock
/data/user/0/cmbmpqod.bfrtuduawoyhr.mlmrncmjbdecuc/app_DynamicOptDex/FI.json	family_blackrock
/data/user/0/cmbmpqod.bfrtuduawoyhr.mlmrncmjbdecuc/app_DynamicOptDex/FI.json	family_blackrock
/data/user/0/cmbmpqod.bfrtuduawoyhr.mlmrncmjbdecuc/app_DynamicOptDex/FI.json	family_blackrock
/data/user/0/cmbmpqod.bfrtuduawoyhr.mlmrncmjbdecuc/app_DynamicOptDex/FI.json	family_blackrock

Makes use of the framework's Accessibility service. 3 IoCs

Processes:

cmbmpqod.bfrtuduawoyhr.mlmrncmjbdecuc

description	ioc	process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	cmbmpqod.bfrtuduawoyhr.mlmrncmjbdecuc
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId	cmbmpqod.bfrtuduawoyhr.mlmrncmjbdecuc
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByText	cmbmpqod.bfrtuduawoyhr.mlmrncmjbdecuc

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps). 1 IoCs
banker

Processes:

cmbmpqod.bfrtuduawoyhr.mlmrncmjbdecuc:cproc

description ioc process

Framework service call android.content.pm.IPackageManager.getInstalledApplications cmbmpqod.bfrtuduawoyhr.mlmrncmjbdecuc:cproc
Acquires the wake lock. 1 IoCs

Processes:

cmbmpqod.bfrtuduawoyhr.mlmrncmjbdecuc

description ioc process

Framework service call android.os.IPowerManager.acquireWakeLock cmbmpqod.bfrtuduawoyhr.mlmrncmjbdecuc

description	ioc	process
Framework service call	android.content.pm.IPackageManager.getInstalledApplications	cmbmpqod.bfrtuduawoyhr.mlmrncmjbdecuc:cproc

description	ioc	process
Framework service call	android.os.IPowerManager.acquireWakeLock	cmbmpqod.bfrtuduawoyhr.mlmrncmjbdecuc

Loads dropped Dex/Jar 5 IoCs

Runs executable file dropped to the device during analysis.

Processes:

cmbmpqod.bfrtuduawoyhr.mlmrncmjbdecuc/system/bin/dex2oat --debuggable --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --debuggable --generate-mini-debug-info --dex-file=/data/user/0/cmbmpqod.bfrtuduawoyhr.mlmrncmjbdecuc/app_DynamicOptDex/FI.json --output-vdex-fd=43 --oat-fd=44 --oat-location=/data/user/0/cmbmpqod.bfrtuduawoyhr.mlmrncmjbdecuc/app_DynamicOptDex/oat/x86/FI.odex --compiler-filter=quicken --class-loader-context=&cmbmpqod.bfrtuduawoyhr.mlmrncmjbdecuc:cproc

ioc	pid	process
/data/user/0/cmbmpqod.bfrtuduawoyhr.mlmrncmjbdecuc/app_DynamicOptDex/FI.json	5235	cmbmpqod.bfrtuduawoyhr.mlmrncmjbdecuc
/data/user/0/cmbmpqod.bfrtuduawoyhr.mlmrncmjbdecuc/app_DynamicOptDex/FI.json	5303	/system/bin/dex2oat --debuggable --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --debuggable --generate-mini-debug-info --dex-file=/data/user/0/cmbmpqod.bfrtuduawoyhr.mlmrncmjbdecuc/app_DynamicOptDex/FI.json --output-vdex-fd=43 --oat-fd=44 --oat-location=/data/user/0/cmbmpqod.bfrtuduawoyhr.mlmrncmjbdecuc/app_DynamicOptDex/oat/x86/FI.odex --compiler-filter=quicken --class-loader-context=&
/data/user/0/cmbmpqod.bfrtuduawoyhr.mlmrncmjbdecuc/app_DynamicOptDex/FI.json	5235	cmbmpqod.bfrtuduawoyhr.mlmrncmjbdecuc
/data/user/0/cmbmpqod.bfrtuduawoyhr.mlmrncmjbdecuc/app_DynamicOptDex/FI.json	5432	cmbmpqod.bfrtuduawoyhr.mlmrncmjbdecuc:cproc
/data/user/0/cmbmpqod.bfrtuduawoyhr.mlmrncmjbdecuc/app_DynamicOptDex/FI.json	5432	cmbmpqod.bfrtuduawoyhr.mlmrncmjbdecuc:cproc

Uses Crypto APIs (Might try to encrypt user data). 1 IoCs
ransomware

Processes:

cmbmpqod.bfrtuduawoyhr.mlmrncmjbdecuc:cproc

description ioc process

Framework API call javax.crypto.Cipher.doFinal cmbmpqod.bfrtuduawoyhr.mlmrncmjbdecuc:cproc

description	ioc	process
Framework API call	javax.crypto.Cipher.doFinal	cmbmpqod.bfrtuduawoyhr.mlmrncmjbdecuc:cproc

cmbmpqod.bfrtuduawoyhr.mlmrncmjbdecuc
1⤵
- Makes use of the framework's Accessibility service.
- Acquires the wake lock.
- Loads dropped Dex/Jar
PID:5235
- /system/bin/dex2oat --debuggable --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --debuggable --generate-mini-debug-info --dex-file=/data/user/0/cmbmpqod.bfrtuduawoyhr.mlmrncmjbdecuc/app_DynamicOptDex/FI.json --output-vdex-fd=43 --oat-fd=44 --oat-location=/data/user/0/cmbmpqod.bfrtuduawoyhr.mlmrncmjbdecuc/app_DynamicOptDex/oat/x86/FI.odex --compiler-filter=quicken --class-loader-context=&
  2⤵
  - Loads dropped Dex/Jar
  PID:5303

cmbmpqod.bfrtuduawoyhr.mlmrncmjbdecuc:cproc
1⤵
- Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps).
- Loads dropped Dex/Jar
- Uses Crypto APIs (Might try to encrypt user data).
PID:5432

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

/data/user/0/cmbmpqod.bfrtuduawoyhr.mlmrncmjbdecuc/app_DynamicOptDex/FI.json

Filesize
480KB

MD5
29f361eba91eae385a43866444e29a40

SHA1
920f779b3b93a04f1986bf6b616b17b15390fbfe

SHA256
3b2e473ace0c2e5bb6d76353406f5386178b1f9be9df3a41b2b19e3aafe62d3e

SHA512
851e6ca89dd39542597ab096c27a5bd2ef6574bacadd930ad1c88f9abe17df982be2dd707276d2fe6222fdd50b20025ee5adb42c3b5d817b972fe004a7ee961f

Download Submit
/data/user/0/cmbmpqod.bfrtuduawoyhr.mlmrncmjbdecuc/app_DynamicOptDex/FI.json

Filesize
480KB

MD5
8cfb576875bc98bf537d895d227d7a58

SHA1
71fbb13f519ac886c747103a8e5d93c6d0ca7cb7

SHA256
279c60682bf5cb7fe98df8e3f8ec41fe2404c35fa9c910938c97d11c8e0494b9

SHA512
6ce60e87992a21cb206675765962644121e6d9080d0afb348eb360a33592f3f717e7b7fdec3eece3a7ad202b882fe1bad31c9ecaf7c2ca9fa805ca17279f4d89

Download Submit
/data/user/0/cmbmpqod.bfrtuduawoyhr.mlmrncmjbdecuc/app_DynamicOptDex/FI.json

Filesize
480KB

MD5
8cfb576875bc98bf537d895d227d7a58

SHA1
71fbb13f519ac886c747103a8e5d93c6d0ca7cb7

SHA256
279c60682bf5cb7fe98df8e3f8ec41fe2404c35fa9c910938c97d11c8e0494b9

SHA512
6ce60e87992a21cb206675765962644121e6d9080d0afb348eb360a33592f3f717e7b7fdec3eece3a7ad202b882fe1bad31c9ecaf7c2ca9fa805ca17279f4d89

Download Submit
/data/user/0/cmbmpqod.bfrtuduawoyhr.mlmrncmjbdecuc/app_DynamicOptDex/FI.json

Filesize
480KB

MD5
8cfb576875bc98bf537d895d227d7a58

SHA1
71fbb13f519ac886c747103a8e5d93c6d0ca7cb7

SHA256
279c60682bf5cb7fe98df8e3f8ec41fe2404c35fa9c910938c97d11c8e0494b9

SHA512
6ce60e87992a21cb206675765962644121e6d9080d0afb348eb360a33592f3f717e7b7fdec3eece3a7ad202b882fe1bad31c9ecaf7c2ca9fa805ca17279f4d89

Download Submit
/data/user/0/cmbmpqod.bfrtuduawoyhr.mlmrncmjbdecuc/app_DynamicOptDex/FI.json

Filesize
480KB

MD5
8cfb576875bc98bf537d895d227d7a58

SHA1
71fbb13f519ac886c747103a8e5d93c6d0ca7cb7

SHA256
279c60682bf5cb7fe98df8e3f8ec41fe2404c35fa9c910938c97d11c8e0494b9

SHA512
6ce60e87992a21cb206675765962644121e6d9080d0afb348eb360a33592f3f717e7b7fdec3eece3a7ad202b882fe1bad31c9ecaf7c2ca9fa805ca17279f4d89

Download Submit
/data/user/0/cmbmpqod.bfrtuduawoyhr.mlmrncmjbdecuc/app_DynamicOptDex/FI.json

Filesize
480KB

MD5
8cfb576875bc98bf537d895d227d7a58

SHA1
71fbb13f519ac886c747103a8e5d93c6d0ca7cb7

SHA256
279c60682bf5cb7fe98df8e3f8ec41fe2404c35fa9c910938c97d11c8e0494b9

SHA512
6ce60e87992a21cb206675765962644121e6d9080d0afb348eb360a33592f3f717e7b7fdec3eece3a7ad202b882fe1bad31c9ecaf7c2ca9fa805ca17279f4d89

Download Submit
/data/user/0/cmbmpqod.bfrtuduawoyhr.mlmrncmjbdecuc/app_DynamicOptDex/FI.json.x86.flock

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/cmbmpqod.bfrtuduawoyhr.mlmrncmjbdecuc/app_DynamicOptDex/FI.json.x86.flock

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/cmbmpqod.bfrtuduawoyhr.mlmrncmjbdecuc/app_DynamicOptDex/oat/FI.json.cur.prof

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/cmbmpqod.bfrtuduawoyhr.mlmrncmjbdecuc/app_DynamicOptDex/oat/x86/FI.odex

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/cmbmpqod.bfrtuduawoyhr.mlmrncmjbdecuc/app_DynamicOptDex/oat/x86/FI.vdex

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit