d90c0971f2377c01e97ae5a5fa39b174dcbd9915e4a5044bd6789c179706ccdf | Triage

Analysis

max time kernel
761808s
max time network
159s
platform
android_x64
resource
android-x64-20230831-en
resource tags

androidarch:x64arch:x86image:android-x64-20230831-enlocale:en-usos:android-10-x64system
submitted
13-10-2023 21:50

Sharing

Report Analysis Logs

General

Target

STandoffGOLDA (1).apk
Size

760KB
MD5

6902f2ad3987835b1187ebf93e69e804
SHA1

42fda334335d69fe8d7dc4d12ecede00abd68a8c
SHA256

d90c0971f2377c01e97ae5a5fa39b174dcbd9915e4a5044bd6789c179706ccdf
SHA512

7d7e9c0262623427eeeafeb96e55b80e7e3e95e4f917642500f1e3bbf314abc1458316f6978b0b16c62bef6b66d609d8ee797ee6870a0a847ccbda034b805ca3
SSDEEP

12288:SRjom0a1a8LzeJjph1v+c5WmpYshXZPbGwidNpgU:Sd0a1ameJb1v+c5WmD9idNpD

Score

8^/10

banker

Malware Config

Signatures

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps). 1 IoCs
banker

Processes:

cmf0.c3b5bm90zq.patch

description ioc process

Framework service call android.content.pm.IPackageManager.getInstalledApplications cmf0.c3b5bm90zq.patch
Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

cmf0.c3b5bm90zq.patch
1⤵
- Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps).
PID:5001

su
2⤵
PID:5035

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads