9762eba15b893609b9461125c5adbcaf3bac7fea9536ffca72566abfa1bed084

Analysis

max time kernel
152s
max time network
159s
platform
android_x64
resource
android-x64-arm64-20240221-en
resource tags

androidarch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20240221-enlocale:en-usos:android-11-x64system
submitted
04-04-2024 22:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

9762eba15b893609b9461125c5adbcaf3bac7fea9536ffca72566abfa1bed084.apk
Size

4.5MB
MD5

99c2d9582ecc4a34e466cf71e6054e84
SHA1

bd73f00c40464602f9a16ce6aeb0cbce62fb6451
SHA256

9762eba15b893609b9461125c5adbcaf3bac7fea9536ffca72566abfa1bed084
SHA512

7398dbccf7f84370280d3c6ed342c9f14e49c78a33930ab437e042f8d1baaf702d2da11c95c7430e4155081576307c64cc4db7bbf2718ba21ff68654b5c342db
SSDEEP

98304:+rrhinthin6thinyhinxdhinihinkhin8hin+r4Kx2N4tOUHKt/TFiqa1:+CrC6rCECx7CUC6CiC+r4KYatOUHY5K

Score

8^/10

collection discovery evasion persistence

Malware Config

Signatures

Makes use of the framework's Accessibility service 2 TTPs 2 IoCs

Retrieves information displayed on the phone screen using AccessibilityService.

collection evasion

Input Injection

T1516

Screen Capture

T1513

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	com.bnltokensicuroappnuova.apk
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId	com.bnltokensicuroappnuova.apk

Checks CPU information 2 TTPs 1 IoCs

Checks CPU information which indicate if the system is an emulator.

evasion discovery

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	com.bnltokensicuroappnuova.apk

Checks memory information 2 TTPs 1 IoCs

Checks memory information which indicate if the system is an emulator.

evasion discovery

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	com.bnltokensicuroappnuova.apk

Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

Application may abuse the framework's foreground service to continue running in the foreground.

evasion persistence

Foreground Persistence

T1541

description	ioc	Process
Framework service call	android.app.IActivityManager.setServiceForeground	com.bnltokensicuroappnuova.apk

Acquires the wake lock 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.bnltokensicuroappnuova.apk

com.bnltokensicuroappnuova.apk
1⤵
- Makes use of the framework's Accessibility service
- Checks CPU information
- Checks memory information
- Makes use of the framework's foreground persistence service
- Acquires the wake lock
PID:4585

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Foreground Persistence

T1541

Privilege Escalation

Defense Evasion

Foreground Persistence

T1541

Input Injection

T1516

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Discovery

System Information Discovery

T1426

Lateral Movement

Collection

Screen Capture

T1513

Command and Control

Exfiltration

Impact

Input Injection

T1516

Replay Monitor

Loading Replay Monitor...

Downloads

/data/user/0/com.bnltokensicuroappnuova.apk/cache/1

Filesize
311B

MD5
255b6ffd48a6b3d674a2da2d4d491e5b

SHA1
22c76043ca4289193bbeba01148a23a14dbb9695

SHA256
e666049caaabf41dd239f8455cca9cd2e555b4ec0978a894dfe7bf71ff2e7d15

SHA512
38b5442611b2cdba70bd1fad2a7f9882843a3f8ad929a936e8bffcdcd090e3e4facfda96646b7ad67c3459f3d30ffc4fc7eeb8ecda0739eaff02ebbab668b7f2

Download Submit
/data/user/0/com.bnltokensicuroappnuova.apk/cache/~test.test

Filesize
4B

MD5
098f6bcd4621d373cade4e832627b4f6

SHA1
a94a8fe5ccb19ba61c4c0873d391e987982fbbd3

SHA256
9f86d081884c7d659a2feaa0c55ad015a3bf4f1b2b0b822cd15d6c15b0f00a08

SHA512
ee26b0dd4af7e749aa1a8ee3c10ae9923f618980772e473f8819a5d4940e0db27ac185f8a0e1d5f84f88bc887fd67b143732c304cc5fa9ad8e6f57f50028a8ff

Download Submit
/data/user/0/com.bnltokensicuroappnuova.apk/files/db.db

Filesize
44KB

MD5
d5d190e1180c5e6858c40a93f7526f12

SHA1
0d054f2e34776c8d5bcfd54d743831b9919618fe

SHA256
274fe3e82fc2630d99809afd6a1c64768a77ed69c04b33e0df6a292a5a042203

SHA512
0d58df37359d6e35f02ef95e4edcfb05fac6c3bc57d1c3e56e49fa7b6c66aef3f99b383cb14dc5a01b52bc6a0d4685f275fb30279aa26e8339a5e0b8416ba85e

Download Submit
/data/user/0/com.bnltokensicuroappnuova.apk/files/loading.gif

Filesize
73KB

MD5
b939bfddae63d6eeb43f71e60c5fe2e5

SHA1
d20e224ddfac3efc818ca7ec35327b3a549f0e70

SHA256
8b0f662fc6a3c42378b9abe0a47963997a054eba207dd5a1ce8b2c6dbbe71d6e

SHA512
4987a75bf83e843607b7d8a76dcd0fb944298568103f7e9bdbec3b538582e2adaf514ca8d182f8be7dd381a2774fa40146124e58b1e755554c297fbdabb0bb4a

Download Submit
/data/user/0/com.bnltokensicuroappnuova.apk/files/txtscreensize.txt

Filesize
11B

MD5
1b65c10c6215685f9d621d797f911373

SHA1
cc50aaed5cd521a62ec8cf9fe0413153ec90f265

SHA256
2230c2b2787663a054c47450ecd1718f0296853ad768b8e5d306ecb912685e89

SHA512
5a9139f295dbe384b1584eff5c11f3f86759232f7b661b75f27fe92b996b4cdc0552e315f79b26f5f2c1f91756d9ae04cf0c3675b6172e91a3d373b9b314496f

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads