0b72c22517fdefd4cf0466d8d4c634ca73b7667d378be688efe131af4ac3aed8

Analysis

max time kernel
37s
max time network
45s
platform
android_x64
resource
android-x64-arm64-20240221-en
resource tags

androidarch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20240221-enlocale:en-usos:android-11-x64system
submitted
05-03-2024 20:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

godfather.apk
Size

7.2MB
MD5

ec9f857999b4fc3dd007fdb786b7a8d1
SHA1

3fa48a36d22d848ad111b246ca94fa58088dbb7a
SHA256

0b72c22517fdefd4cf0466d8d4c634ca73b7667d378be688efe131af4ac3aed8
SHA512

51d9965e08fa3f5cd8850df3f2dd8503c47ce9f3668b2ae90d3560cc16acd0d4d1b3bbed651d957bc41ea7595a527a00b9c600b3726faa6095af380019e3d1e0
SSDEEP

98304:vDdInEpAOdLl2DfGjOmP34z09nmw3xAZMV8JiDQeZgUGdh0fr33dmh++0oEHi6Pz:5gE7tf3u09nmiOZmDid9h+CFZMXmwfXR

Score

8^/10

collection evasion

Malware Config

Signatures

Makes use of the framework's Accessibility service 2 TTPs 3 IoCs

Retrieves information displayed on the phone screen using AccessibilityService.

collection evasion

Input Injection

T1516

Screen Capture

T1513

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByText	com.rduzmauwns.jieliysagr
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId	com.rduzmauwns.jieliysagr
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	com.rduzmauwns.jieliysagr

Requests enabling of the accessibility settings. 1 IoCs

description	ioc	Process
Intent action	android.settings.ACCESSIBILITY_SETTINGS	com.rduzmauwns.jieliysagr

com.rduzmauwns.jieliysagr
1⤵
- Makes use of the framework's Accessibility service
- Requests enabling of the accessibility settings.
PID:4441

com.rduzmauwns.jieliysagr:remote
1⤵
PID:4487

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Input Injection

T1516

Credential Access

Discovery

Lateral Movement

Collection

Screen Capture

T1513

Command and Control

Exfiltration

Impact

Input Injection

T1516

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads