b23de011a289282b04367d2bc3447ec669687832c3ad24b8f7042af6ef349bfc

Resubmissions

29-03-2024 09:48

240329-ls6a8aec3v 10

26-03-2024 11:06

240326-m7deesgg23 10

Analysis

max time kernel
148s
max time network
159s
platform
android_x64
resource
android-x64-arm64-20240221-en
resource tags

androidarch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20240221-enlocale:en-usos:android-11-x64system
submitted
26-03-2024 11:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

731a58248c7b467bc9d9a7482d8cb010242b3a534904ddc39471fa0620752d22.apk
Size

4.5MB
MD5

4e51973921f1bf1c26b7d045d9716ae8
SHA1

be2c6aeb07af97d32f2b9ae6e990e4300ca09dcb
SHA256

731a58248c7b467bc9d9a7482d8cb010242b3a534904ddc39471fa0620752d22
SHA512

511f1c1b15273f58142d665bcc3156385833b14e6ebf9c2396feba0912281e77eb28e16d029a2ad4f33fdfa9928539fb071e3711a4edd3b3b3bf8f7cae306ce1
SSDEEP

98304:l9hinlhin6Vhinahinx1hin6hinshinUhinqydx+gd/stLfhHD26wRwcfWO8y:lbCzC6DC8CxjCcCyCKCqydE0/eLfhH/g

Score

8^/10

collection evasion persistence

Malware Config

Signatures

Makes use of the framework's Accessibility service 2 TTPs 2 IoCs

Retrieves information displayed on the phone screen using AccessibilityService.

collection evasion

Input Injection

T1516

Screen Capture

T1513

Processes:

com.apicolosi.newpro

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	com.apicolosi.newpro
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId	com.apicolosi.newpro

Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

Application may abuse the framework's foreground service to continue running in the foreground.

evasion persistence

Foreground Persistence

T1541

Processes:

com.apicolosi.newpro

description	ioc	Process
Framework service call	android.app.IActivityManager.setServiceForeground	com.apicolosi.newpro

Acquires the wake lock 1 IoCs

Processes:

com.apicolosi.newpro

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.apicolosi.newpro

com.apicolosi.newpro
1⤵
- Makes use of the framework's Accessibility service
- Makes use of the framework's foreground persistence service
- Acquires the wake lock
PID:4682

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Foreground Persistence

T1541

Privilege Escalation

Defense Evasion

Foreground Persistence

T1541

Input Injection

T1516

Credential Access

Discovery

Lateral Movement

Collection

Screen Capture

T1513

Command and Control

Exfiltration

Impact

Input Injection

T1516

Replay Monitor

Loading Replay Monitor...

Downloads

/data/user/0/com.apicolosi.newpro/cache/1

Filesize
309B

MD5
cad0d927c3585c0e21688980f14315a6

SHA1
17c76f4c6fe4bc006c3d5b9e6a5d4a37d8db2041

SHA256
4e5ab1c0cb9c537b3b4f64f1e7477151971ae9d53df6ae0c4404c9a8f824f44c

SHA512
c42000b1e16bfa2d316fd626f4d7ceab1c985e7257ed68bb3bcfa68f7356bc6e4bd125b09b0952a189aa522234d6fc1c56feac5a842cc1f7b8ae3c278dda697e

Download Submit
/data/user/0/com.apicolosi.newpro/cache/~test.test

Filesize
4B

MD5
098f6bcd4621d373cade4e832627b4f6

SHA1
a94a8fe5ccb19ba61c4c0873d391e987982fbbd3

SHA256
9f86d081884c7d659a2feaa0c55ad015a3bf4f1b2b0b822cd15d6c15b0f00a08

SHA512
ee26b0dd4af7e749aa1a8ee3c10ae9923f618980772e473f8819a5d4940e0db27ac185f8a0e1d5f84f88bc887fd67b143732c304cc5fa9ad8e6f57f50028a8ff

Download Submit
/data/user/0/com.apicolosi.newpro/files/db.db

Filesize
44KB

MD5
d5d190e1180c5e6858c40a93f7526f12

SHA1
0d054f2e34776c8d5bcfd54d743831b9919618fe

SHA256
274fe3e82fc2630d99809afd6a1c64768a77ed69c04b33e0df6a292a5a042203

SHA512
0d58df37359d6e35f02ef95e4edcfb05fac6c3bc57d1c3e56e49fa7b6c66aef3f99b383cb14dc5a01b52bc6a0d4685f275fb30279aa26e8339a5e0b8416ba85e

Download Submit
/data/user/0/com.apicolosi.newpro/files/loading.gif

Filesize
121KB

MD5
7b38720a0352dffa26411726c72dd2b0

SHA1
b15e687f42abcdc12427f146a3115ef2259211f8

SHA256
2013f490d45638cada331b3474ed65b9a43cec60da773accc98332e58c06336d

SHA512
0df28f87da4f9beb3ca8c108f54021a2a1a1434771abbb5ba67a2736097f2287b05e5220a33e92c42ee13ecae1144714a422b986763712794f69e65bc44c83e3

Download Submit
/data/user/0/com.apicolosi.newpro/files/txtscreensize.txt

Filesize
11B

MD5
1b65c10c6215685f9d621d797f911373

SHA1
cc50aaed5cd521a62ec8cf9fe0413153ec90f265

SHA256
2230c2b2787663a054c47450ecd1718f0296853ad768b8e5d306ecb912685e89

SHA512
5a9139f295dbe384b1584eff5c11f3f86759232f7b661b75f27fe92b996b4cdc0552e315f79b26f5f2c1f91756d9ae04cf0c3675b6172e91a3d373b9b314496f

Download Submit