4ae68d9dd21de0842f529016e1ea3d2da4a357c12706836f0ee164de87d3b598

Analysis

max time kernel
154s
max time network
155s
platform
android_x64
resource
android-x64-20240221-en
resource tags

androidarch:x64arch:x86image:android-x64-20240221-enlocale:en-usos:android-10-x64system
submitted
26-03-2024 18:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

childapp.apk
Size

3.7MB
MD5

7a49bb6c08b7c390a73cf49e139037fd
SHA1

c290545a14118537a1136ed1ca63daa37e19cafa
SHA256

641c2ec268b01a91c57d84ebe1a9c9fafb24a258406ea6bf6d542d1b4c5296c7
SHA512

95905b1e8d92c2f45e14e9b8d6871a74d6d0d010d60cdf641ddfa6f62f45a2089ab19c24824876a230ed53a223d160647ee959615455181721f41c9908121954
SSDEEP

98304:zZOevPO5GOCsmqyF77KmznzB+Ty0t8sL6z:zPvxNsmqAlz4xy

Score

8^/10

banker collection discovery evasion

Malware Config

Signatures

Makes use of the framework's Accessibility service 2 TTPs 3 IoCs

Retrieves information displayed on the phone screen using AccessibilityService.

collection evasion

Input Injection

T1516

Screen Capture

T1513

Processes:

listing.material.pensions

description	ioc	process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByText	listing.material.pensions
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId	listing.material.pensions
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	listing.material.pensions

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs 1 IoCs
banker discovery

Security Software Discovery
T1418.001

Processes:

listing.material.pensions

description ioc process

Framework service call android.content.pm.IPackageManager.getInstalledApplications listing.material.pensions
Acquires the wake lock 1 IoCs

Processes:

listing.material.pensions

description ioc process

Framework service call android.os.IPowerManager.acquireWakeLock listing.material.pensions

description	ioc	process
Framework service call	android.content.pm.IPackageManager.getInstalledApplications	listing.material.pensions

description	ioc	process
Framework service call	android.os.IPowerManager.acquireWakeLock	listing.material.pensions

listing.material.pensions
1⤵
- Makes use of the framework's Accessibility service
- Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)
- Acquires the wake lock
PID:5010

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Input Injection

T1516

Credential Access

Discovery

Software Discovery

T1418

Security Software Discovery

T1418.001

Lateral Movement

Collection

Screen Capture

T1513

Command and Control

Exfiltration

Impact

Input Injection

T1516

Replay Monitor

Loading Replay Monitor...

Downloads

/storage/emulated/0/Config/sys/apps/log/log-2024-03-26.txt

Filesize
33B

MD5
8cdcd9f39a5d810b08a538b19a72cbd9

SHA1
b0567c6a07da5b51214e63c6e212e986d0a4762b

SHA256
d989029a0c83049ed3a02b564faca1df7cffa947667b3c2f9cce681cd8147b8c

SHA512
f182af48309f15aeedb4cebac41e2c8217e99270ee027fc079cd01dd6077a4b94bd1d960a392f327f997e3822c8de9c5d3e81d73cb45e5f0c030dbff59a718a4

Download Submit
/storage/emulated/0/Config/sys/apps/log/log-2024-03-26.txt

Filesize
25B

MD5
ba30336bf53d54ed3c0ea69dd545de8c

SHA1
ce99c6724c75b93b7448e2d9fac16ca702a5711f

SHA256
2d6988fb5afdaafc4e33fa1f71d6f10c95ab5a49a8ec820add5b13eef05439af

SHA512
eea34ca526e03349e746d3687ea660b4748f0174fe2ffdb65161e232e08630b345e03329614852ce881a71362ba68575e9dd08fa361a416e5b2fb231e21a0a3e

Download Submit
/storage/emulated/0/Config/sys/apps/log/log-2024-03-26.txt

Filesize
288B

MD5
9510a1f00380b394b4abfc231cdf533c

SHA1
02eb631b1c0437d2afa164a3420aea941de8db6e

SHA256
ec87cd51f36c0388c702b992ee9160bfdaaf64e65f2b30d12a8912566dae2216

SHA512
867ba23ba01a182d7892a7fdea956cc385c6b7369627cdf44421309ee81479097dbe8a3061c5a0c4c5d80829423959114afd198d0f6222ca72e8d7a9b29cadaa

Download Submit
/storage/emulated/0/Config/sys/apps/log/log-2024-03-26.txt

Filesize
57B

MD5
a9ec0c42a43c72d73c499e5c17ccbb8b

SHA1
731652fbfe61eac3fdb4b9d3e2eaa010848a0906

SHA256
6c5309ce3f31c9af3288b0de3305b7f5ddee97be60ca4ac1184f3c334480c05b

SHA512
5f8ed24a51f68cfa0627aceb9190d3a7febaee61bd5a89898ab113ddaa7ce2a41f129a28c4e200d5e5e4ddff7a483abc0393dc38e870782caf1c46d2ec0df2e3

Download Submit