blackrock | 51f9c37c3eec0b6f8325aa1c8fe64a0615ab920584042df557426473b1270b40

Analysis

max time kernel
679231s
max time network
159s
platform
android_x86
resource
android-x86-arm-20220310-en
submitted
03-06-2022 06:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

36cd2ea94bcf9f9a9959dc4c1c489933.apk
Size

1.8MB
MD5

36cd2ea94bcf9f9a9959dc4c1c489933
SHA1

828c76b5d980c893147bdee72eb3832227aff7f2
SHA256

51f9c37c3eec0b6f8325aa1c8fe64a0615ab920584042df557426473b1270b40
SHA512

d829d6969f53a3b1b929cf6b964af454f4087bb9075afccf0303007409188bac21df06a1cab5bd2615360fae40202fd3dbb1a861ce397a8d09e8ce86bbc102c4

Score

10^/10

blackrock banker infostealer ransomware trojan

Malware Config

Signatures

BlackRock
BlackRock is an android banker based on Xerxes banking Trojan.
banker trojan infostealer blackrock

BlackRock Payload 5 IoCs

Processes:

resource	yara_rule
/data/user/0/ayxzygxgagiqhdnjnfduerzbeh.hme.egybgkeziplb/app_DynamicOptDex/DP.json	family_blackrock
/data/user/0/ayxzygxgagiqhdnjnfduerzbeh.hme.egybgkeziplb/app_DynamicOptDex/DP.json	family_blackrock
/data/user/0/ayxzygxgagiqhdnjnfduerzbeh.hme.egybgkeziplb/app_DynamicOptDex/DP.json	family_blackrock
/data/user/0/ayxzygxgagiqhdnjnfduerzbeh.hme.egybgkeziplb/app_DynamicOptDex/DP.json	family_blackrock
/data/user/0/ayxzygxgagiqhdnjnfduerzbeh.hme.egybgkeziplb/app_DynamicOptDex/DP.json	family_blackrock

Makes use of the framework's Accessibility service. 3 IoCs

Processes:

ayxzygxgagiqhdnjnfduerzbeh.hme.egybgkeziplb

description	ioc	process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	ayxzygxgagiqhdnjnfduerzbeh.hme.egybgkeziplb
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId	ayxzygxgagiqhdnjnfduerzbeh.hme.egybgkeziplb
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByText	ayxzygxgagiqhdnjnfduerzbeh.hme.egybgkeziplb

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps). 1 IoCs

banker

Processes:

ayxzygxgagiqhdnjnfduerzbeh.hme.egybgkeziplb:cproc

description	ioc	process
Framework service call	android.content.pm.IPackageManager.getInstalledApplications	ayxzygxgagiqhdnjnfduerzbeh.hme.egybgkeziplb:cproc

Acquires the wake lock. 1 IoCs

Processes:

ayxzygxgagiqhdnjnfduerzbeh.hme.egybgkeziplb

description ioc process

Framework service call android.os.IPowerManager.acquireWakeLock ayxzygxgagiqhdnjnfduerzbeh.hme.egybgkeziplb

description	ioc	process
Framework service call	android.os.IPowerManager.acquireWakeLock	ayxzygxgagiqhdnjnfduerzbeh.hme.egybgkeziplb

Loads dropped Dex/Jar 5 IoCs

Runs executable file dropped to the device during analysis.

Processes:

ayxzygxgagiqhdnjnfduerzbeh.hme.egybgkeziplb/system/bin/dex2oat --debuggable --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --debuggable --generate-mini-debug-info --dex-file=/data/user/0/ayxzygxgagiqhdnjnfduerzbeh.hme.egybgkeziplb/app_DynamicOptDex/DP.json --output-vdex-fd=42 --oat-fd=43 --oat-location=/data/user/0/ayxzygxgagiqhdnjnfduerzbeh.hme.egybgkeziplb/app_DynamicOptDex/oat/x86/DP.odex --compiler-filter=quicken --class-loader-context=&ayxzygxgagiqhdnjnfduerzbeh.hme.egybgkeziplb:cproc

ioc	pid	process
/data/user/0/ayxzygxgagiqhdnjnfduerzbeh.hme.egybgkeziplb/app_DynamicOptDex/DP.json	5122	ayxzygxgagiqhdnjnfduerzbeh.hme.egybgkeziplb
/data/user/0/ayxzygxgagiqhdnjnfduerzbeh.hme.egybgkeziplb/app_DynamicOptDex/DP.json	5190	/system/bin/dex2oat --debuggable --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --debuggable --generate-mini-debug-info --dex-file=/data/user/0/ayxzygxgagiqhdnjnfduerzbeh.hme.egybgkeziplb/app_DynamicOptDex/DP.json --output-vdex-fd=42 --oat-fd=43 --oat-location=/data/user/0/ayxzygxgagiqhdnjnfduerzbeh.hme.egybgkeziplb/app_DynamicOptDex/oat/x86/DP.odex --compiler-filter=quicken --class-loader-context=&
/data/user/0/ayxzygxgagiqhdnjnfduerzbeh.hme.egybgkeziplb/app_DynamicOptDex/DP.json	5122	ayxzygxgagiqhdnjnfduerzbeh.hme.egybgkeziplb
/data/user/0/ayxzygxgagiqhdnjnfduerzbeh.hme.egybgkeziplb/app_DynamicOptDex/DP.json	5242	ayxzygxgagiqhdnjnfduerzbeh.hme.egybgkeziplb:cproc
/data/user/0/ayxzygxgagiqhdnjnfduerzbeh.hme.egybgkeziplb/app_DynamicOptDex/DP.json	5242	ayxzygxgagiqhdnjnfduerzbeh.hme.egybgkeziplb:cproc

Uses Crypto APIs (Might try to encrypt user data). 1 IoCs
ransomware

Processes:

ayxzygxgagiqhdnjnfduerzbeh.hme.egybgkeziplb:cproc

description ioc process

Framework API call javax.crypto.Cipher.doFinal ayxzygxgagiqhdnjnfduerzbeh.hme.egybgkeziplb:cproc

description	ioc	process
Framework API call	javax.crypto.Cipher.doFinal	ayxzygxgagiqhdnjnfduerzbeh.hme.egybgkeziplb:cproc

ayxzygxgagiqhdnjnfduerzbeh.hme.egybgkeziplb
1⤵
- Makes use of the framework's Accessibility service.
- Acquires the wake lock.
- Loads dropped Dex/Jar
PID:5122
- /system/bin/dex2oat --debuggable --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --debuggable --generate-mini-debug-info --dex-file=/data/user/0/ayxzygxgagiqhdnjnfduerzbeh.hme.egybgkeziplb/app_DynamicOptDex/DP.json --output-vdex-fd=42 --oat-fd=43 --oat-location=/data/user/0/ayxzygxgagiqhdnjnfduerzbeh.hme.egybgkeziplb/app_DynamicOptDex/oat/x86/DP.odex --compiler-filter=quicken --class-loader-context=&
  2⤵
  - Loads dropped Dex/Jar
  PID:5190

ayxzygxgagiqhdnjnfduerzbeh.hme.egybgkeziplb:cproc
1⤵
- Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps).
- Loads dropped Dex/Jar
- Uses Crypto APIs (Might try to encrypt user data).
PID:5242

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

/data/user/0/ayxzygxgagiqhdnjnfduerzbeh.hme.egybgkeziplb/app_DynamicOptDex/DP.json

Filesize
455KB

MD5
52458d72b03f9774a9a1ff30e1750c51

SHA1
0d544f3cee770eba7d7febaf38c4081c08fc1ffc

SHA256
bf812b9febc89fe729fada34d625919021c858fcb0aa29cc2d7e2b72b4a8656b

SHA512
1e5325eae4aa35b59116360a40a3ecd5f87187275bf5e6673a5e8088ab064c662255cc43fe0c451808b9faa19e9a3cfe6279b624278486aea94049763f91375c

Download Submit
/data/user/0/ayxzygxgagiqhdnjnfduerzbeh.hme.egybgkeziplb/app_DynamicOptDex/DP.json

Filesize
455KB

MD5
af68c2b989210302d650a740daf14a87

SHA1
e80815b10aa0caf260abac6bee1f33d4ae3d063a

SHA256
733d4a43d7090b72c1a2e1e2f46eda78de9326e77fff5562443ed1c193cd58e3

SHA512
773f689ebd4f8c571e845ae737ea0be28467f7a5f9c67dc6a50ad26176e685023868d0524864edd92ac39f63711d0d21cfd0a1f5d6eb918fa2f531213711a6a9

Download Submit
/data/user/0/ayxzygxgagiqhdnjnfduerzbeh.hme.egybgkeziplb/app_DynamicOptDex/DP.json

Filesize
455KB

MD5
af68c2b989210302d650a740daf14a87

SHA1
e80815b10aa0caf260abac6bee1f33d4ae3d063a

SHA256
733d4a43d7090b72c1a2e1e2f46eda78de9326e77fff5562443ed1c193cd58e3

SHA512
773f689ebd4f8c571e845ae737ea0be28467f7a5f9c67dc6a50ad26176e685023868d0524864edd92ac39f63711d0d21cfd0a1f5d6eb918fa2f531213711a6a9

Download Submit
/data/user/0/ayxzygxgagiqhdnjnfduerzbeh.hme.egybgkeziplb/app_DynamicOptDex/DP.json

Filesize
455KB

MD5
af68c2b989210302d650a740daf14a87

SHA1
e80815b10aa0caf260abac6bee1f33d4ae3d063a

SHA256
733d4a43d7090b72c1a2e1e2f46eda78de9326e77fff5562443ed1c193cd58e3

SHA512
773f689ebd4f8c571e845ae737ea0be28467f7a5f9c67dc6a50ad26176e685023868d0524864edd92ac39f63711d0d21cfd0a1f5d6eb918fa2f531213711a6a9

Download Submit
/data/user/0/ayxzygxgagiqhdnjnfduerzbeh.hme.egybgkeziplb/app_DynamicOptDex/DP.json

Filesize
455KB

MD5
af68c2b989210302d650a740daf14a87

SHA1
e80815b10aa0caf260abac6bee1f33d4ae3d063a

SHA256
733d4a43d7090b72c1a2e1e2f46eda78de9326e77fff5562443ed1c193cd58e3

SHA512
773f689ebd4f8c571e845ae737ea0be28467f7a5f9c67dc6a50ad26176e685023868d0524864edd92ac39f63711d0d21cfd0a1f5d6eb918fa2f531213711a6a9

Download Submit
/data/user/0/ayxzygxgagiqhdnjnfduerzbeh.hme.egybgkeziplb/app_DynamicOptDex/DP.json

Filesize
455KB

MD5
af68c2b989210302d650a740daf14a87

SHA1
e80815b10aa0caf260abac6bee1f33d4ae3d063a

SHA256
733d4a43d7090b72c1a2e1e2f46eda78de9326e77fff5562443ed1c193cd58e3

SHA512
773f689ebd4f8c571e845ae737ea0be28467f7a5f9c67dc6a50ad26176e685023868d0524864edd92ac39f63711d0d21cfd0a1f5d6eb918fa2f531213711a6a9

Download Submit
/data/user/0/ayxzygxgagiqhdnjnfduerzbeh.hme.egybgkeziplb/app_DynamicOptDex/DP.json.x86.flock

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/ayxzygxgagiqhdnjnfduerzbeh.hme.egybgkeziplb/app_DynamicOptDex/DP.json.x86.flock

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/ayxzygxgagiqhdnjnfduerzbeh.hme.egybgkeziplb/app_DynamicOptDex/oat/DP.json.cur.prof

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/ayxzygxgagiqhdnjnfduerzbeh.hme.egybgkeziplb/app_DynamicOptDex/oat/x86/DP.odex

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/ayxzygxgagiqhdnjnfduerzbeh.hme.egybgkeziplb/app_DynamicOptDex/oat/x86/DP.vdex

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit