f6975b1a9ab8935d45d6c2d94540b67b2374827734593c126785924afffb6634

General

Target

f6975b1a9ab8935d45d6c2d94540b67b2374827734593c126785924afffb6634.apk
Size

4.4MB
MD5

a95315ca7af6d857379adb2c87f27c72
SHA1

22e40aac894a8218aae2f1b5eeb79473922eb97c
SHA256

f6975b1a9ab8935d45d6c2d94540b67b2374827734593c126785924afffb6634
SHA512

0f33de6a47f34a9406f573d8d14c9cdab445b69c95489b2b1fd3521c3d9a3ab1ea275f6b21a52792167debea6a989d6c3a9d8d1849b56081bd1ba7e5292f6c4a
SSDEEP

98304:whinthin6thinyhinxdhinihinkhin8hinqA/pCIBd1sehPC+MHcl:WCrC6rCECx7CUC6CiCqud1sUPClHcl

Score

8^/10

banker collection discovery evasion persistence

Malware Config

Signatures

Makes use of the framework's Accessibility service 2 TTPs 2 IoCs

Retrieves information displayed on the phone screen using AccessibilityService.

collection evasion

Input Injection

T1516

Screen Capture

T1513

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	com.appagricolappnuovatoken.apk
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId	com.appagricolappnuovatoken.apk

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
banker discovery

Security Software Discovery
T1418.001

Checks CPU information 2 TTPs 1 IoCs

Checks CPU information which indicate if the system is an emulator.

evasion discovery

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	com.appagricolappnuovatoken.apk

Checks memory information 2 TTPs 1 IoCs

Checks memory information which indicate if the system is an emulator.

evasion discovery

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	com.appagricolappnuovatoken.apk

Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

Application may abuse the framework's foreground service to continue running in the foreground.

evasion persistence

Foreground Persistence

T1541

description	ioc	Process
Framework service call	android.app.IActivityManager.setServiceForeground	com.appagricolappnuovatoken.apk

Queries information about the current Wi-Fi connection. 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.wifi.IWifiManager.getConnectionInfo	com.appagricolappnuovatoken.apk

Requests enabling of the accessibility settings. 1 IoCs

description	ioc	Process
Intent action	android.settings.ACCESSIBILITY_SETTINGS	com.appagricolappnuovatoken.apk

Acquires the wake lock 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.appagricolappnuovatoken.apk

com.appagricolappnuovatoken.apk
1⤵
- Makes use of the framework's Accessibility service
- Checks CPU information
- Checks memory information
- Makes use of the framework's foreground persistence service
- Queries information about the current Wi-Fi connection.
- Requests enabling of the accessibility settings.
- Acquires the wake lock
PID:4279

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Foreground Persistence

1

T1541

Privilege Escalation

Defense Evasion

Foreground Persistence

Input Injection

Virtualization/Sandbox Evasion

2

T1633

System Checks

2

T1633.001

Credential Access

Discovery

Software Discovery

1

T1418

Security Software Discovery

1

T1418.001

System Information Discovery

2

T1426

System Network Connections Discovery

1

T1421

Lateral Movement

Collection

Screen Capture

1

T1513

Command and Control

Exfiltration

Impact

Input Injection

1

T1516

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.appagricolappnuovatoken.apk/cache/~test.test

Filesize
4B

MD5
098f6bcd4621d373cade4e832627b4f6

SHA1
a94a8fe5ccb19ba61c4c0873d391e987982fbbd3

SHA256
9f86d081884c7d659a2feaa0c55ad015a3bf4f1b2b0b822cd15d6c15b0f00a08

SHA512
ee26b0dd4af7e749aa1a8ee3c10ae9923f618980772e473f8819a5d4940e0db27ac185f8a0e1d5f84f88bc887fd67b143732c304cc5fa9ad8e6f57f50028a8ff

Download Submit
/data/data/com.appagricolappnuovatoken.apk/files/db.db

Filesize
44KB

MD5
d5d190e1180c5e6858c40a93f7526f12

SHA1
0d054f2e34776c8d5bcfd54d743831b9919618fe

SHA256
274fe3e82fc2630d99809afd6a1c64768a77ed69c04b33e0df6a292a5a042203

SHA512
0d58df37359d6e35f02ef95e4edcfb05fac6c3bc57d1c3e56e49fa7b6c66aef3f99b383cb14dc5a01b52bc6a0d4685f275fb30279aa26e8339a5e0b8416ba85e

Download Submit
/data/data/com.appagricolappnuovatoken.apk/files/db.db

Filesize
4KB

MD5
2c6fe773f7cc42d162630d93a98fa91f

SHA1
a0d76f9403df661aea3017a0d912de03c415e3a9

SHA256
3855acc95e1e3648649a16c91abdcb1e2eb81826ae6171a0ab25c5b74452f186

SHA512
20436ab982d11ec32d69267c93c378e4ad92d8f840f5b412984af5aa0240f0eb8df757fdfde5ab95a2649c6f9862d9b633cd8dfcab5c07c1a4533072600c39a6

Download Submit
/data/data/com.appagricolappnuovatoken.apk/files/db.db-journal

Filesize
4KB

MD5
d584d38a0d8da56974ee03e70e09f6fe

SHA1
e6e8c2eefa2c8552b8b8759e726a6c9ce9112512

SHA256
8658c593be1c2d8ac95fafaae586e5f83226bc9c420b0b6205705aa847514f40

SHA512
bdb899f642ddc0fb60f9fe0bd71641dbaf40d3e707c300e41a304ce716b0c71d450f3a3e51581c7cb4111c1b4373307557694320b3f10e1cae05fce49b14238c

Download Submit
/data/data/com.appagricolappnuovatoken.apk/files/db.db-shm

Filesize
32KB

MD5
bb7df04e1b0a2570657527a7e108ae23

SHA1
5188431849b4613152fd7bdba6a3ff0a4fd6424b

SHA256
c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479

SHA512
768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

Download Submit
/data/data/com.appagricolappnuovatoken.apk/files/loading.gif

Filesize
36KB

MD5
c148a2b5ea48fe0ec6680ae72dfb0e9e

SHA1
bae77de3e65b305bd02909442485c2a5119f75cc

SHA256
0926dd9074722201c9320d6b53183101163db8e31e208a57c1ffe68594035223

SHA512
86eb82ecfae2f635603bd77ae3c96a257700aa18f41d5914c0f326779d171f27778d2611aeb5c8360d955fd70ef8aa6f5d10cb484e5c36d9b88754b18ddaf56c

Download Submit
/data/data/com.appagricolappnuovatoken.apk/files/txtscreensize.txt

Filesize
11B

MD5
1b65c10c6215685f9d621d797f911373

SHA1
cc50aaed5cd521a62ec8cf9fe0413153ec90f265

SHA256
2230c2b2787663a054c47450ecd1718f0296853ad768b8e5d306ecb912685e89

SHA512
5a9139f295dbe384b1584eff5c11f3f86759232f7b661b75f27fe92b996b4cdc0552e315f79b26f5f2c1f91756d9ae04cf0c3675b6172e91a3d373b9b314496f

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads