23c51ed174a6014b3207b41a82c2aee0eea16df8fa1cd14c2864fb3307215070

Analysis

max time kernel
149s
max time network
159s
platform
android_x64
resource
android-x64-20240221-en
resource tags

androidarch:x64arch:x86image:android-x64-20240221-enlocale:en-usos:android-10-x64system
submitted
06-03-2024 22:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

23c51ed174a6014b3207b41a82c2aee0eea16df8fa1cd14c2864fb3307215070.apk
Size

4.3MB
MD5

c09e5ec180e2ba9ef8229136b7edfd06
SHA1

548747e87edf2d49c1182ce46735517b2a92a613
SHA256

23c51ed174a6014b3207b41a82c2aee0eea16df8fa1cd14c2864fb3307215070
SHA512

f086bd8304043858cf826beae74280e6e9697051f0405e982e0b60f9f31cc4d02adb02bb418a482ebdc60d25f0319c232b86df2927757976c4fe9cfb8ba687d0
SSDEEP

98304:DQrETnOllY4f8GB0BOydEl1LKTXVquJ+WEFjmYVcysKz2DhTiE:swTOl2s8zdqK5qt1cyxch+E

Score

8^/10

collection evasion

Malware Config

Signatures

Makes use of the framework's Accessibility service 2 TTPs 1 IoCs

Retrieves information displayed on the phone screen using AccessibilityService.

collection evasion

Input Injection

T1516

Screen Capture

T1513

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	com.example.securityprotector

Loads dropped Dex/Jar 1 TTPs 2 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/com.example.securityprotector/app_ded/RzpypC6mimRo8IMhPrfd7kS6AfWiZas3.dex	5054	com.example.securityprotector
/data/user/0/com.example.securityprotector/app_ded/RzpypC6mimRo8IMhPrfd7kS6AfWiZas3.dex	5054	com.example.securityprotector

Acquires the wake lock 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.example.securityprotector

Uses Crypto APIs (Might try to encrypt user data) 1 IoCs

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	com.example.securityprotector

com.example.securityprotector
1⤵
- Makes use of the framework's Accessibility service
- Loads dropped Dex/Jar
- Acquires the wake lock
- Uses Crypto APIs (Might try to encrypt user data)
PID:5054

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Input Injection

T1516

Credential Access

Discovery

Lateral Movement

Collection

Screen Capture

T1513

Command and Control

Exfiltration

Impact

Input Injection

T1516

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.example.securityprotector/app_ded/RzpypC6mimRo8IMhPrfd7kS6AfWiZas3.dex

Filesize
3.1MB

MD5
e06cf1893d943fbbea3550aba29819e8

SHA1
f799ab4febc1da1c2ad942bb5ceb90beaa14d3ab

SHA256
6a141907d0e45420367a220a4d6609bb4d13a5c5b6463ac116285dc7805b8353

SHA512
e93fc6c95a3adf40346f2cbcf6b5241d2b74b22600702dc98f897bffa344ac3033d51c4e6e94a721ed88244271a7866d2ffa68ac5d56d2e817284ef758838b55

Download Submit
/data/data/com.example.securityprotector/databases/firestore.%5BDEFAULT%5D.braindroid-f00d3.%28default%29

Filesize
12KB

MD5
163b0e3f017becbc89b9d7f330b78f09

SHA1
1ef9cd8ac8655190468d0ccece0a4738634ab0f9

SHA256
cf01452c3b494692386f6c5faac340eb3eb894bd416391002d56645aa8a9ea36

SHA512
6a85a30d16fa58a4fbbb05d469778ee69ca79deaa74316ccb5be3ee07fdf78dde22e95db3edb1b88b18478e8747047445f85baaf9556b9a1e55d9a02a80baffd

Download Submit
/data/data/com.example.securityprotector/databases/firestore.%5BDEFAULT%5D.braindroid-f00d3.%28default%29-journal

Filesize
512B

MD5
dc5b498ad90917f5608df4cdb1103679

SHA1
57cbfd782eb6b8f1eb32e590d607cff317575680

SHA256
690aa9f1cbd5a73755e1a3b05081226c165f9199805035eb41905e25c1f5bd43

SHA512
f13c9438582ef60c7791b3d6e2d4b7dcee3faa7eab9d2e3cbe152be65119d0ca12bb061bb0995dba97c7dbf80a05dd14247c1652bde2d2ebb69c6159850f082f

Download Submit
/data/data/com.example.securityprotector/databases/firestore.%5BDEFAULT%5D.braindroid-f00d3.%28default%29-journal

Filesize
8KB

MD5
6c73508d7ee733814aec15f3d961a7d1

SHA1
fa359d37d2aae888f62205912338df148dba8065

SHA256
36473805e3a91bf40d79f03f5976121884b7db1d49be6e05bbbe2e6d43ed5ddd

SHA512
e98ff21be3be0cc2990426c087e2e00d2f6207df8c8fd2961531d10804e87ecc50a1325bdb63332340cf259d99e22bbaf78e10014a6f3545b89357715b45998e

Download Submit
/data/data/com.example.securityprotector/databases/firestore.%5BDEFAULT%5D.braindroid-f00d3.%28default%29-journal

Filesize
8KB

MD5
81bf6fc73abfb9bbb5f9bb4dd3f84067

SHA1
6a2c90495dbe5495af5a5a47a9602fef07aea3e8

SHA256
b0de89065447c2017af27d706950c7160621d5c6875456fa52b50a29152d24fa

SHA512
04e2db4f07f03191bcf3c7e9eda309953ecc27a974f631caaecfaa8f807966d69019261d90aa2c591896c74df3cbc94ddf396baf99c0e6bd4256780518c6c942

Download Submit
/data/data/com.example.securityprotector/databases/google_app_measurement_local.db

Filesize
16KB

MD5
008976b443b358376c1986b48df4a7ae

SHA1
ac6616f5b1fb7af8f046292569fbabb83d1288c2

SHA256
7aa1d53605d2575c909f1f99137cb6402c3c8384581950055872bc893b3e44da

SHA512
a616734ee46aea08d6841f4e85be89b8a9e62bca6bf57cf65c06735d4e5a0707569b5d38483bcc3d294272579c979827c69409d019f8aac76debb4231c1b761d

Download Submit
/data/data/com.example.securityprotector/databases/google_app_measurement_local.db

Filesize
16KB

MD5
ed400b53e6bdbfe1041a2732e13341d0

SHA1
f26b4f4c27c43f405de17cda4bfc0934b655dc7c

SHA256
82ac330189933d0c947a3fbdc092fc699bac9e88fb8c772b9121c3f838805096

SHA512
4f938419cd526257ca236f342c74436f368ab2142801dbf991e7f014e69fd20338fd5c059a5114bf9d79f5a025ebb6f42a7f82916fcffc3919eb7eba0e6e3141

Download Submit
/data/data/com.example.securityprotector/databases/google_app_measurement_local.db

Filesize
16KB

MD5
44006af8865610a2c9fa348423face88

SHA1
626bef6bd4aa1d06b15a3173063a89211d19f945

SHA256
3a77d54dc4625ab9b927e5355668f508035851f60aa14807ea8777cf69a0d28d

SHA512
a2082b5cde334a8cd46f8e78e55cbd4971c6fa7073a65fcc8ad7266cea70ba885aa164eaa8fcc0d871a87361cc9480a08dcc9741ccb5935babb8cebac0b986a8

Download Submit
/data/data/com.example.securityprotector/databases/google_app_measurement_local.db

Filesize
16KB

MD5
75532484c485f84a7cec416fded21f11

SHA1
3b045a15b9fcd78e4b90074515d523a98c6bb543

SHA256
26431405fc858241f26e4e22644b5762957744d9f234ac5a186ce0ee64a533dd

SHA512
c271e2e8be473278c99475012deb4f73458f124f2789ba62ff63237480bcedb0152aac91d8e64f9a7cf4c3499e4e48b817ae61414aeda75106b1d0c1db049d30

Download Submit
/data/data/com.example.securityprotector/databases/google_app_measurement_local.db

Filesize
16KB

MD5
2d38d9958db7b09afed08a63e0661de6

SHA1
8aff28cd663770e6a49653214010608392d55db4

SHA256
b7965df914297101d903937bf0b000dadaa2291acfd6fa15982ed3069c04e22c

SHA512
6d96a06cc919d99ab0997482aa634e65c1c6111c8b4fc559f38528b50b605cba04559a6af9542799ca16688b25e73ce3c4be0f16ba1913e715f8595c21d7a24d

Download Submit
/data/data/com.example.securityprotector/databases/google_app_measurement_local.db-journal

Filesize
8KB

MD5
31e6386960493a0ecfedbb6b9e2892fe

SHA1
81865e78896519950c083e9a9f1156533b613880

SHA256
35105fd1223c42bdc2544f05104122e86ecd8dd160a2f25f543e18492f5d1ebd

SHA512
3f7039a0d1c6836232e5a9795fd291df53f7651939017c80b2de53b00f7634aca7d137ed478b77d7088c4e8ae99354337bac2d0305309d4c3872a0a36cb853e9

Download Submit
/data/data/com.example.securityprotector/files/PersistedInstallation2853810339539019967tmp

Filesize
90B

MD5
0d3268471aed7c26a2b65e8fe19f52c4

SHA1
53e746fac767080980659f885d25ff27feeec3c0

SHA256
0afd5f87382c8f4468e242687f48d4f97c39ec6d37a293958bed57cd128f4633

SHA512
b445e79dc15cadaa180ddb196d6b717144d5bb6057e54a65e04cdfb63aa7de1da5fccddf69536ccae65c9710e10a4da0f40471066f735a4d297ccc889be29134

Download Submit
/data/data/com.example.securityprotector/files/profileInstalled

Filesize
24B

MD5
ef82574956fdc0f32e49123c768659a4

SHA1
b144fa766238e966089d2d25d5a916bfe1ff7395

SHA256
a8776091d2c6f9740420ea13fa36386230444c3c52b21484869e04c051d0ac2c

SHA512
d4e1f6c60c794a289de31f00df2d3484bd5d48d99592ef36243c6f077e4a53df7e72a9983443898b24163bccd574b9497b71cfbd110ea73983a7917886fee9c3

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads