Analysis
-
max time kernel
141s -
max time network
153s -
platform
android_x86 -
resource
android-x86-arm-20231215-en -
resource tags
-
submitted
08-02-2024 22:09
General
-
Target
bad130c229078f0770b1f958467700438fabe5f9a08f443b8c40ee2ddec96e90.apk
-
Size
1.9MB
-
MD5
a028bf4b01db506f72b580866408e3ee
-
SHA1
45bdcbbde5b7f78e572592e8f3ae7805890ef7e7
-
SHA256
bad130c229078f0770b1f958467700438fabe5f9a08f443b8c40ee2ddec96e90
-
SHA512
767b74acf154033e86896fe27d4ced3414859aaed14da6b6a6aabaa83a8eb7a9784a5e58a4c2cd6718b03881fd53a6c956cd706c7f506d14a03caf2318c6a57c
-
SSDEEP
49152:yCTtPdNQnI/kwszd/TNangK7Ct8Y5rDwzeDJPH:XRCIvsBTNagMC2YhDwzeJPH
Malware Config
Signatures
-
BlackRock
BlackRock is an android banker based on Xerxes banking Trojan.
-
BlackRock payload 1 IoCs
-
Makes use of the framework's Accessibility service 1 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 IoCs
-
Removes its main activity from the application launcher 1 IoCs
-
Loads dropped Dex/Jar 5 IoCs
Runs executable file dropped to the device during analysis.
-
Requests enabling of the accessibility settings. 1 IoCs
-
Acquires the wake lock 1 IoCs
-
Uses Crypto APIs (Might try to encrypt user data) 1 IoCs
Processes
-
ezmjhdiumgiyhfjdp.bjucshsqxhkigwyqqma.gqncehdcknrtcekingi1⤵
- Makes use of the framework's Accessibility service
- Removes its main activity from the application launcher
- Loads dropped Dex/Jar
- Acquires the wake lock
-
/system/bin/dex2oat --debuggable --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --debuggable --generate-mini-debug-info --dex-file=/data/user/0/ezmjhdiumgiyhfjdp.bjucshsqxhkigwyqqma.gqncehdcknrtcekingi/app_DynamicOptDex/DCK.json --output-vdex-fd=42 --oat-fd=43 --oat-location=/data/user/0/ezmjhdiumgiyhfjdp.bjucshsqxhkigwyqqma.gqncehdcknrtcekingi/app_DynamicOptDex/oat/x86/DCK.odex --compiler-filter=quicken --class-loader-context=&2⤵
- Loads dropped Dex/Jar
-
ezmjhdiumgiyhfjdp.bjucshsqxhkigwyqqma.gqncehdcknrtcekingi:cproc1⤵
- Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)
- Loads dropped Dex/Jar
- Requests enabling of the accessibility settings.
- Uses Crypto APIs (Might try to encrypt user data)
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
/data/data/ezmjhdiumgiyhfjdp.bjucshsqxhkigwyqqma.gqncehdcknrtcekingi/app_DynamicOptDex/DCK.jsonFilesize
541KB
MD5bb76f8c4737dd53297bb1ae45544a4cc
SHA11d7b1f323c4f991bcc4333ce60f4feb9d599d866
SHA256ff93d86e094f424de4788a7af379353cfb41beacf3c7213795d17064e0ffc6a4
SHA512c4a4da1b2461edf57b9b8584088fe3a90e260e5f3efc3d8e2774fc9b1975cdf07e858df835d48dd4e49306847e20735319bd540c9cabe481e73cf53feb1b8037
-
/data/data/ezmjhdiumgiyhfjdp.bjucshsqxhkigwyqqma.gqncehdcknrtcekingi/app_DynamicOptDex/DCK.jsonFilesize
541KB
MD5999bc64ddb8466436ac709364f7c7a1b
SHA1da94e605da0f1292c86e5834de7e21b60c2ce47c
SHA256dbe96617fdc88b3fc1fe4af43c38a5613c307e9b60a3355c008b105f2e8a1020
SHA5125a1637130e2e99cc7c6a135db653f04b67fcb6d6986db0b74b7f04aeacee981e9d962fdb87f1b3f0ebd13d053c8893c381723e3dedb90a594c64e3595a01ce34
-
/data/user/0/ezmjhdiumgiyhfjdp.bjucshsqxhkigwyqqma.gqncehdcknrtcekingi/app_DynamicOptDex/DCK.jsonFilesize
448KB
MD5c14cf24c7150c6c5bb1da38a64184baa
SHA19b012b3c08b3f603ae0fdbc80d9a33caab05e2be
SHA256663dcbc355b127389a36172598f2e29156ad6328d8267efb37c861875418d9f0
SHA51233ec9e08244ad3e6ff55c1c4d5b5e766975473a092a59a1a641350562a4ae315ad267af282daf67e36fa3a2c8edbe0b43da4898c9d133b1f78a6b9c3ed182882