4daf21a708afc06c0da4ee6e192a6db6405efb1e3a9eb6905cc69d501e781c8b

Analysis

max time kernel
153s
max time network
159s
platform
android_x64
resource
android-x64-arm64-20240221-en
resource tags

androidarch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20240221-enlocale:en-usos:android-11-x64system
submitted
24-03-2024 22:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4daf21a708afc06c0da4ee6e192a6db6405efb1e3a9eb6905cc69d501e781c8b.apk
Size

4.5MB
MD5

1ec0f8696578e0e427140fd256ec4e4f
SHA1

dee29fb458a62b82e63a8f1cc570b4b2136faa1c
SHA256

4daf21a708afc06c0da4ee6e192a6db6405efb1e3a9eb6905cc69d501e781c8b
SHA512

5d8c4b1c6190af462101145713b8f53317a63c94fe737d413e758b3c3f404b2ffeba18aaa988cf2e8cfbc6304b8e6e0d51fe3f57f82e165dda83e5b0260b61f9
SSDEEP

98304:gLUhinlhin6Vhinahinx1hin6hinshinUhindbB1N9XruuBogd9PRlO:gLKCzC6DC8CxjCcCyCKCdbnnXquh9PRs

Score

8^/10

collection evasion persistence

Malware Config

Signatures

Makes use of the framework's Accessibility service 2 TTPs 2 IoCs

Retrieves information displayed on the phone screen using AccessibilityService.

collection evasion

Input Injection

T1516

Screen Capture

T1513

Processes:

com.bbvacodicoappnuevaapppapk.apk

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	com.bbvacodicoappnuevaapppapk.apk
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId	com.bbvacodicoappnuevaapppapk.apk

Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

Application may abuse the framework's foreground service to continue running in the foreground.

evasion persistence

Foreground Persistence

T1541

Processes:

com.bbvacodicoappnuevaapppapk.apk

description	ioc	Process
Framework service call	android.app.IActivityManager.setServiceForeground	com.bbvacodicoappnuevaapppapk.apk

Acquires the wake lock 1 IoCs

Processes:

com.bbvacodicoappnuevaapppapk.apk

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.bbvacodicoappnuevaapppapk.apk

com.bbvacodicoappnuevaapppapk.apk
1⤵
- Makes use of the framework's Accessibility service
- Makes use of the framework's foreground persistence service
- Acquires the wake lock
PID:4589

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Foreground Persistence

T1541

Privilege Escalation

Defense Evasion

Foreground Persistence

T1541

Input Injection

T1516

Credential Access

Discovery

Lateral Movement

Collection

Screen Capture

T1513

Command and Control

Exfiltration

Impact

Input Injection

T1516

Replay Monitor

Loading Replay Monitor...

Downloads

/data/user/0/com.bbvacodicoappnuevaapppapk.apk/cache/1

Filesize
309B

MD5
cad0d927c3585c0e21688980f14315a6

SHA1
17c76f4c6fe4bc006c3d5b9e6a5d4a37d8db2041

SHA256
4e5ab1c0cb9c537b3b4f64f1e7477151971ae9d53df6ae0c4404c9a8f824f44c

SHA512
c42000b1e16bfa2d316fd626f4d7ceab1c985e7257ed68bb3bcfa68f7356bc6e4bd125b09b0952a189aa522234d6fc1c56feac5a842cc1f7b8ae3c278dda697e

Download Submit
/data/user/0/com.bbvacodicoappnuevaapppapk.apk/cache/~test.test

Filesize
4B

MD5
098f6bcd4621d373cade4e832627b4f6

SHA1
a94a8fe5ccb19ba61c4c0873d391e987982fbbd3

SHA256
9f86d081884c7d659a2feaa0c55ad015a3bf4f1b2b0b822cd15d6c15b0f00a08

SHA512
ee26b0dd4af7e749aa1a8ee3c10ae9923f618980772e473f8819a5d4940e0db27ac185f8a0e1d5f84f88bc887fd67b143732c304cc5fa9ad8e6f57f50028a8ff

Download Submit
/data/user/0/com.bbvacodicoappnuevaapppapk.apk/files/loading.gif

Filesize
19KB

MD5
13004fba1ccec1f26a21b195421d0a2c

SHA1
664a5d48832f2a052564f770963054cebdb7a0b3

SHA256
f2bed336251b1a2d935789163338cc3766c783a79cdd325417074bee54ad1eda

SHA512
9c2b29620163964d0750dccd30aae3adab135eac76be802ef708cf9eb89795715824911605dd34825d3246ada9edead66a275bde7a890d9ba1a0dc5c758dd42d

Download Submit