Analysis
-
max time kernel
139s -
max time network
160s -
platform
android_x64 -
resource
android-x64-arm64-20231215-en -
resource tags
-
submitted
08-02-2024 22:03
General
-
Target
746e5ebaf6b6d5c6ef3cc0be32fbd60380aca8632c3c10059e1021d99bfbee75.apk
-
Size
1.9MB
-
MD5
0cc4b6fbf14d7af736bfade09b229aa5
-
SHA1
6a2c67003bd89eb44e3ddee2977d207d83863198
-
SHA256
746e5ebaf6b6d5c6ef3cc0be32fbd60380aca8632c3c10059e1021d99bfbee75
-
SHA512
636f2c7d90308cab5df508c373cd31d61db37a3b0f99e18273f07d49aa6bfb89f3940bc7a46c2e7dd28fbf61520a8b397b0f47f1fc76567c280d042afc91a014
-
SSDEEP
49152:Zy/1YOQeYwhDLd/uDwz+zxPGYeipgqf+O:MQpQpuDwzexesuqGO
Malware Config
Signatures
-
BlackRock
BlackRock is an android banker based on Xerxes banking Trojan.
-
BlackRock payload 1 IoCs
-
Makes use of the framework's Accessibility service 3 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 IoCs
-
Removes its main activity from the application launcher 1 IoCs
-
Loads dropped Dex/Jar 4 IoCs
Runs executable file dropped to the device during analysis.
-
Requests enabling of the accessibility settings. 1 IoCs
-
Acquires the wake lock 1 IoCs
-
Uses Crypto APIs (Might try to encrypt user data) 1 IoCs
Processes
-
onpekpikylb.bcgdhxgzwd.dzlecjglpigjuc1⤵
- Makes use of the framework's Accessibility service
- Removes its main activity from the application launcher
- Loads dropped Dex/Jar
- Acquires the wake lock
-
onpekpikylb.bcgdhxgzwd.dzlecjglpigjuc:cproc1⤵
- Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)
- Loads dropped Dex/Jar
- Requests enabling of the accessibility settings.
- Uses Crypto APIs (Might try to encrypt user data)
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
/data/user/0/onpekpikylb.bcgdhxgzwd.dzlecjglpigjuc/app_DynamicOptDex/XmT.jsonFilesize
499KB
MD55f345bae59f434959dcd03b3c126befe
SHA187972001bb2b516d40b621187b0c4ce5d236d390
SHA256f9233150ccf12a404aa2ba7d7b66f3e4bbaa51aa92c1b48d62034ac35f8aa72a
SHA51210de19be3d0492b6d5a2321b05ae6dcae54b005bd6bfdff075cee57f67e6698302dea93c26e84eced515c5b4b37545fde70fba7d2a97764419111c5921cda6e3
-
/data/user/0/onpekpikylb.bcgdhxgzwd.dzlecjglpigjuc/app_DynamicOptDex/XmT.jsonFilesize
499KB
MD5895e2ba62c6014e1985977d5aef8d52b
SHA17723b303d72116d479f2f732e11c67dda25a89cc
SHA2568a25c724dd4e4ef2b0bc1944d4c7357a22f3b639a9d7112afa33b51bc39ef39b
SHA5122583ac310e28bb6bcc069d4efbd8e42bc6e8ce9119935d9b974cc27f81268594854f30ac5200395e5a0f0f8b4005f385b25f4ca49e580108875301c7adbe88a9
-
/data/user/0/onpekpikylb.bcgdhxgzwd.dzlecjglpigjuc/app_DynamicOptDex/XmT.jsonFilesize
304KB
MD582df1cd61164ad456de2bb61f5c0cbb6
SHA16d2c87bf1124fb431fdd3f2cc07f55ba74bd3729
SHA25614bbff12346172351a5fe351ddd86151fb8d646253caa73b4fab11691a838366
SHA512696a4b75fdcf7fcb0b55b0ac926a1cef8d42879f94be609c3dbbd30e910a51ea5eba7854691cfdafbc7dc1b2a82f3d9252a09ec6f054513fef4b24bdc14f95d7