4ae68d9dd21de0842f529016e1ea3d2da4a357c12706836f0ee164de87d3b598

Analysis

max time kernel
149s
max time network
153s
platform
android_x86
resource
android-x86-arm-20240221-en
resource tags

androidarch:armarch:x86image:android-x86-arm-20240221-enlocale:en-usos:android-9-x86system
submitted
26-03-2024 18:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

childapp.apk
Size

3.7MB
MD5

7a49bb6c08b7c390a73cf49e139037fd
SHA1

c290545a14118537a1136ed1ca63daa37e19cafa
SHA256

641c2ec268b01a91c57d84ebe1a9c9fafb24a258406ea6bf6d542d1b4c5296c7
SHA512

95905b1e8d92c2f45e14e9b8d6871a74d6d0d010d60cdf641ddfa6f62f45a2089ab19c24824876a230ed53a223d160647ee959615455181721f41c9908121954
SSDEEP

98304:zZOevPO5GOCsmqyF77KmznzB+Ty0t8sL6z:zPvxNsmqAlz4xy

Score

8^/10

banker collection discovery evasion stealth trojan

Malware Config

Signatures

Makes use of the framework's Accessibility service 2 TTPs 3 IoCs

Retrieves information displayed on the phone screen using AccessibilityService.

collection evasion

Input Injection

T1516

Screen Capture

T1513

Processes:

listing.material.pensions

description	ioc	process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	listing.material.pensions
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByText	listing.material.pensions
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId	listing.material.pensions

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs 1 IoCs
banker discovery

Security Software Discovery
T1418.001

Processes:

listing.material.pensions

description ioc process

Framework service call android.content.pm.IPackageManager.getInstalledApplications listing.material.pensions
Removes its main activity from the application launcher 1 TTPs 1 IoCs
stealth trojan evasion

Suppress Application Icon
T1628.001

Processes:

listing.material.pensions

pid process

4228 listing.material.pensions
Acquires the wake lock 1 IoCs

Processes:

listing.material.pensions

description ioc process

Framework service call android.os.IPowerManager.acquireWakeLock listing.material.pensions
Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
evasion

User Evasion
T1628.002

Processes:

listing.material.pensions

description ioc process

Intent action android.settings.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS listing.material.pensions

description	ioc	process
Framework service call	android.content.pm.IPackageManager.getInstalledApplications	listing.material.pensions

pid	process
4228	listing.material.pensions

description	ioc	process
Framework service call	android.os.IPowerManager.acquireWakeLock	listing.material.pensions

description	ioc	process
Intent action	android.settings.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS	listing.material.pensions

listing.material.pensions
1⤵
- Makes use of the framework's Accessibility service
- Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)
- Removes its main activity from the application launcher
- Acquires the wake lock
- Requests disabling of battery optimizations (often used to enable hiding in the background).
PID:4228

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

T1628

Suppress Application Icon

T1628.001

User Evasion

T1628.002

Input Injection

T1516

Credential Access

Discovery

Software Discovery

T1418

Security Software Discovery

T1418.001

Lateral Movement

Collection

Screen Capture

T1513

Command and Control

Exfiltration

Impact

Input Injection

T1516

Replay Monitor

Loading Replay Monitor...

Downloads

/storage/emulated/0/Config/sys/apps/log/log-2024-03-26.txt

Filesize
33B

MD5
8cdcd9f39a5d810b08a538b19a72cbd9

SHA1
b0567c6a07da5b51214e63c6e212e986d0a4762b

SHA256
d989029a0c83049ed3a02b564faca1df7cffa947667b3c2f9cce681cd8147b8c

SHA512
f182af48309f15aeedb4cebac41e2c8217e99270ee027fc079cd01dd6077a4b94bd1d960a392f327f997e3822c8de9c5d3e81d73cb45e5f0c030dbff59a718a4

Download Submit
/storage/emulated/0/Config/sys/apps/log/log-2024-03-26.txt

Filesize
25B

MD5
ba30336bf53d54ed3c0ea69dd545de8c

SHA1
ce99c6724c75b93b7448e2d9fac16ca702a5711f

SHA256
2d6988fb5afdaafc4e33fa1f71d6f10c95ab5a49a8ec820add5b13eef05439af

SHA512
eea34ca526e03349e746d3687ea660b4748f0174fe2ffdb65161e232e08630b345e03329614852ce881a71362ba68575e9dd08fa361a416e5b2fb231e21a0a3e

Download Submit
/storage/emulated/0/Config/sys/apps/log/log-2024-03-26.txt

Filesize
288B

MD5
3fa7c62da1acb6175a4c60f5e294a585

SHA1
813afe46b5f9343b713f1c953c62fbff65d20986

SHA256
afbffc47a61c20e5c53f3c8aac0157790b51f64bf47ad0de9a29415c8cba79bc

SHA512
e5e51620a857e8a12a4a1d3dd1294b82665414f7d92b6bb8db79d3e6ac997b518406973e45e5e656e64224daeef8f8b3b8c24ce3f4da5300d187b369ec9f249f

Download Submit
/storage/emulated/0/Config/sys/apps/log/log-2024-03-26.txt

Filesize
29B

MD5
c9db0aece56267f06c34e62d03659b4a

SHA1
e52a55ea4e5a0d30d70e90a5f5833a39370609d9

SHA256
d77bace5ecc67118face00462acf4fdb6724b5a1647a37b1283e8ca8d316ed80

SHA512
f8f1b07bbfe3837598288ac5935e7ad7e7ccaabbeb90b41903717a62d69a37cbbcc7a9ab63ada7b714f31a333270fd626abf40a27e26fad2a909e12a0d6468b2

Download Submit