e98a8f8ba020b53e2999b4784d53e462edece22ea32f7413a94b825669f31ec1

Analysis

max time kernel
20s
max time network
147s
platform
android_x64
resource
android-x64-arm64-20240221-en
resource tags

androidarch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20240221-enlocale:en-usos:android-11-x64system
submitted
23-03-2024 11:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

client.apk
Size

80.2MB
MD5

f85233d95dbececd20ca40f00a7e5cdd
SHA1

d3f0ffa097665e258f102ff70063c87b3ca964b7
SHA256

e98a8f8ba020b53e2999b4784d53e462edece22ea32f7413a94b825669f31ec1
SHA512

4938bc2d53232385a602ba0403f4ef821d90b46dd9e09f022188f871b9b54a4069bae62eb0c083134d3e5343cccd6485cfc854db363245e5b2f1f6d3b8870279
SSDEEP

1572864:+CsR7MfORqjlUL+XV/+BBC3EXnhvSkKZDMq8PUAAcl6puM2Mh7ga5N7I5YM:fDORqjly+XVGeknhUZDMqMAQah7ga5Yz

Score

8^/10

banker discovery evasion persistence privilege_escalation

Malware Config

Signatures

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs 1 IoCs
banker discovery

Security Software Discovery
T1418.001

Processes:

cmf0.c3b5bm90zq.patch

description ioc process

Framework service call android.content.pm.IPackageManager.getInstalledApplications cmf0.c3b5bm90zq.patch
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
evasion persistence

Foreground Persistence
T1541

Processes:

cmf0.c3b5bm90zq.patch

description ioc process

Framework service call android.app.IActivityManager.setServiceForeground cmf0.c3b5bm90zq.patch
Tries to add a device administrator. 1 TTPs 1 IoCs
privilege_escalation

Device Administrator Permissions
T1626.001

Processes:

cmf0.c3b5bm90zq.patch

description ioc process

Intent action android.app.action.ADD_DEVICE_ADMIN cmf0.c3b5bm90zq.patch
Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service
T1102

Processes:

flow ioc

30 0.tcp.eu.ngrok.io
43 0.tcp.eu.ngrok.io

description	ioc	process
Framework service call	android.content.pm.IPackageManager.getInstalledApplications	cmf0.c3b5bm90zq.patch

description	ioc	process
Framework service call	android.app.IActivityManager.setServiceForeground	cmf0.c3b5bm90zq.patch

description	ioc	process
Intent action	android.app.action.ADD_DEVICE_ADMIN	cmf0.c3b5bm90zq.patch

flow	ioc
30	0.tcp.eu.ngrok.io
43	0.tcp.eu.ngrok.io

cmf0.c3b5bm90zq.patch
1⤵
- Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)
- Makes use of the framework's foreground persistence service
- Tries to add a device administrator.
PID:4574

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Foreground Persistence

T1541

Privilege Escalation

Abuse Elevation Control Mechanism

T1626

Device Administrator Permissions

T1626.001