878bb68727daf025c0c9619d1d12337c289489f1190410ca4025c47f39357aa5

Analysis

max time kernel
152s
max time network
161s
platform
android_x64
resource
android-x64-arm64-20240221-en
resource tags

androidarch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20240221-enlocale:en-usos:android-11-x64system
submitted
22-03-2024 22:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

878bb68727daf025c0c9619d1d12337c289489f1190410ca4025c47f39357aa5.apk
Size

4.4MB
MD5

6eb2123c58bb283790a43b5fdaef1c25
SHA1

67deca3fe3025a3b384240aa76c8c986818b21ea
SHA256

878bb68727daf025c0c9619d1d12337c289489f1190410ca4025c47f39357aa5
SHA512

d6362dbffb762fba634159a7f390595fcd77574e47a6b338a65b4080a379d3a983fe00c0bf8a7f2f513ba0397538d52c712376246d02385300a70ee6a7f0676a
SSDEEP

98304:Lhinlhin6Vhinahinx1hin6hinshinUhinh3vkBcgOjq6lJC1Em770k:lCzC6DC8CxjCcCyCKChf0OjjGkk

Score

8^/10

collection evasion persistence

Malware Config

Signatures

Makes use of the framework's Accessibility service 2 TTPs 2 IoCs

Retrieves information displayed on the phone screen using AccessibilityService.

collection evasion

Input Injection

T1516

Screen Capture

T1513

Processes:

com.ibl.apk

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	com.ibl.apk
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId	com.ibl.apk

Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

Application may abuse the framework's foreground service to continue running in the foreground.

evasion persistence

Foreground Persistence

T1541

Processes:

com.ibl.apk

description	ioc	Process
Framework service call	android.app.IActivityManager.setServiceForeground	com.ibl.apk

Acquires the wake lock 1 IoCs

Processes:

com.ibl.apk

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.ibl.apk

com.ibl.apk
1⤵
- Makes use of the framework's Accessibility service
- Makes use of the framework's foreground persistence service
- Acquires the wake lock
PID:4432

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Foreground Persistence

T1541

Privilege Escalation

Defense Evasion

Foreground Persistence

T1541

Input Injection

T1516

Credential Access

Discovery

Lateral Movement

Collection

Screen Capture

T1513

Command and Control

Exfiltration

Impact

Input Injection

T1516

Replay Monitor

Loading Replay Monitor...

Downloads

/data/user/0/com.ibl.apk/cache/1

Filesize
309B

MD5
cad0d927c3585c0e21688980f14315a6

SHA1
17c76f4c6fe4bc006c3d5b9e6a5d4a37d8db2041

SHA256
4e5ab1c0cb9c537b3b4f64f1e7477151971ae9d53df6ae0c4404c9a8f824f44c

SHA512
c42000b1e16bfa2d316fd626f4d7ceab1c985e7257ed68bb3bcfa68f7356bc6e4bd125b09b0952a189aa522234d6fc1c56feac5a842cc1f7b8ae3c278dda697e

Download Submit
/data/user/0/com.ibl.apk/cache/~test.test

Filesize
4B

MD5
098f6bcd4621d373cade4e832627b4f6

SHA1
a94a8fe5ccb19ba61c4c0873d391e987982fbbd3

SHA256
9f86d081884c7d659a2feaa0c55ad015a3bf4f1b2b0b822cd15d6c15b0f00a08

SHA512
ee26b0dd4af7e749aa1a8ee3c10ae9923f618980772e473f8819a5d4940e0db27ac185f8a0e1d5f84f88bc887fd67b143732c304cc5fa9ad8e6f57f50028a8ff

Download Submit
/data/user/0/com.ibl.apk/files/db.db

Filesize
40KB

MD5
0f846d61a922fcd3852c7241f99dc9bc

SHA1
2198433f3a500dcf88048096d0dbdb9f26b7ce47

SHA256
39ced8a590d3e71780b7d787db9b98065d9cd7a9f987dda085fb837a012cff8d

SHA512
d2380af9ad7c68ffdca1745f6dc3f747cc5ff5622ad1c6a1b1af79267c8d3d1f28fe6e01c435797a77309ec31ce085a3c6866503b01bc9850f679ffb34ea3c08

Download Submit
/data/user/0/com.ibl.apk/files/loading.gif

Filesize
11KB

MD5
3b410e587b90cc366d961a412a87d66f

SHA1
a0d7f04026670eb33eb51b4f882c13e423e5437c

SHA256
12a675972116561df733e5aa651ca2a85e1fd4ebd56bb96bc84f35b2b932e60a

SHA512
df88972bfd94d089f226f660c27680b57d1aecd72f67dcc226662a6fab2e10535d02b9c49a292166246906593a710bcc0493e9dd5f27a1021b76d95b6604646c

Download Submit
/data/user/0/com.ibl.apk/files/txtscreensize.txt

Filesize
11B

MD5
1b65c10c6215685f9d621d797f911373

SHA1
cc50aaed5cd521a62ec8cf9fe0413153ec90f265

SHA256
2230c2b2787663a054c47450ecd1718f0296853ad768b8e5d306ecb912685e89

SHA512
5a9139f295dbe384b1584eff5c11f3f86759232f7b661b75f27fe92b996b4cdc0552e315f79b26f5f2c1f91756d9ae04cf0c3675b6172e91a3d373b9b314496f

Download Submit