d2b5dd74b5950953028cabf5d62c40366b14a2e803fb091500c6b6826f03f95e

General

Target

74c96a71cd95e6fab924deb1ddb0a498.apk
Size

1.4MB
MD5

74c96a71cd95e6fab924deb1ddb0a498
SHA1

7420f8e52a6f890531cbe3e3c4adf2c15e9e423b
SHA256

d2b5dd74b5950953028cabf5d62c40366b14a2e803fb091500c6b6826f03f95e
SHA512

288ffaa98b853942847367a7ec4f48863d14aa4355234be9b45791a69c88e83f3248a725c0243637cb2a8b1dc62f14346a6b807a5218325a35e8598a6f0287be
SSDEEP

24576:Bc1LRTK8hDfBWjuWgMJbJ1VVmw63d+KGZtWSF9ymB7R8uQzgpjbM/4zgdS:BKNzhj4jjg87VVmw6NpGZoSF9nxnQzgF

Score

8^/10

collection credential_access discovery evasion impact persistence

Malware Config

Signatures

Makes use of the framework's Accessibility service 4 TTPs 2 IoCs

Retrieves information displayed on the phone screen using AccessibilityService.

collection evasion credential_access

T1516

T1513

T1417.001

T1417.002

Processes:

com.zejapizehiyuki.yijoro

description	ioc	process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	com.zejapizehiyuki.yijoro
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByText	com.zejapizehiyuki.yijoro

Loads dropped Dex/Jar 1 TTPs 2 IoCs

Runs executable file dropped to the device during analysis.

evasion

T1407

Processes:

com.zejapizehiyuki.yijoro

ioc	pid	process
/system_ext/framework/androidx.window.sidecar.jar	4458	com.zejapizehiyuki.yijoro
/system_ext/framework/androidx.window.sidecar.jar	4458	com.zejapizehiyuki.yijoro

Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
evasion persistence

T1541

Processes:

com.zejapizehiyuki.yijoro

description ioc process

Framework service call android.app.IActivityManager.setServiceForeground com.zejapizehiyuki.yijoro
Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.
discovery

T1421

Processes:

com.zejapizehiyuki.yijoro

description ioc process

Framework service call android.net.wifi.IWifiManager.getConnectionInfo com.zejapizehiyuki.yijoro
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
discovery

T1422

Processes:

com.zejapizehiyuki.yijoro

description ioc process

Framework service call com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone com.zejapizehiyuki.yijoro
Queries the phone number (MSISDN for GSM devices) 1 TTPs
discovery

T1422
Requests enabling of the accessibility settings. 1 IoCs

Processes:

com.zejapizehiyuki.yijoro

description ioc process

Intent action android.settings.ACCESSIBILITY_SETTINGS com.zejapizehiyuki.yijoro
Acquires the wake lock 1 IoCs

Processes:

com.zejapizehiyuki.yijoro

description ioc process

Framework service call android.os.IPowerManager.acquireWakeLock com.zejapizehiyuki.yijoro
Reads information about phone network operator. 1 TTPs
discovery

T1422
Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
evasion

T1628.002

Processes:

com.zejapizehiyuki.yijoro

description ioc process

Intent action android.settings.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS com.zejapizehiyuki.yijoro
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
impact

T1471

Processes:

com.zejapizehiyuki.yijoro

description ioc process

Framework API call javax.crypto.Cipher.doFinal com.zejapizehiyuki.yijoro

description	ioc	process
Framework service call	android.app.IActivityManager.setServiceForeground	com.zejapizehiyuki.yijoro

description	ioc	process
Framework service call	android.net.wifi.IWifiManager.getConnectionInfo	com.zejapizehiyuki.yijoro

description	ioc	process
Framework service call	com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone	com.zejapizehiyuki.yijoro

description	ioc	process
Intent action	android.settings.ACCESSIBILITY_SETTINGS	com.zejapizehiyuki.yijoro

description	ioc	process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.zejapizehiyuki.yijoro

description	ioc	process
Intent action	android.settings.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS	com.zejapizehiyuki.yijoro

description	ioc	process
Framework API call	javax.crypto.Cipher.doFinal	com.zejapizehiyuki.yijoro

com.zejapizehiyuki.yijoro
1⤵
- Makes use of the framework's Accessibility service
- Loads dropped Dex/Jar
- Makes use of the framework's foreground persistence service
- Queries information about the current Wi-Fi connection
- Queries the mobile country code (MCC)
- Requests enabling of the accessibility settings.
- Acquires the wake lock
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Uses Crypto APIs (Might try to encrypt user data)
PID:4458

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

/data/user/0/com.zejapizehiyuki.yijoro/no_backup/androidx.work.workdb
Filesize
4KB

MD5
7e858c4054eb00fcddc653a04e5cd1c6

SHA1
2e056bf31a8d78df136f02a62afeeca77f4faccf

SHA256
9010186c5c083155a45673017d1e31c2a178e63cc15a57bbffde4d1956a23dad

SHA512
d0c7a120940c8e637d5566ef179d01eff88a2c2650afda69ad2a46aad76533eaace192028bba3d60407b4e34a950e7560f95d9f9b8eebe361ef62897d88b30cb

Download Submit
/data/user/0/com.zejapizehiyuki.yijoro/no_backup/androidx.work.workdb-journal
Filesize
512B

MD5
824d0c3f599e5df65eac431942db59f3

SHA1
0516b502193a143b7638110250dc3482d2d58f8c

SHA256
e3b172d1e653f2e109d37947fbe386d4e70231884567a99fb2a38f07b4a570db

SHA512
8d18decb81d0e4ffbb7ba2f5872099af2e48925d993604f3057ef8f57af6c25a4a73c4c0c55c0d8deaf4359c6cf1578da7090872980bc7975e415ba35f635008

Download Submit
/data/user/0/com.zejapizehiyuki.yijoro/no_backup/androidx.work.workdb-shm
Filesize
32KB

MD5
bb7df04e1b0a2570657527a7e108ae23

SHA1
5188431849b4613152fd7bdba6a3ff0a4fd6424b

SHA256
c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479

SHA512
768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

Download Submit
/data/user/0/com.zejapizehiyuki.yijoro/no_backup/androidx.work.workdb-wal
Filesize
16KB

MD5
e2749c777dae89a2ea8ff249cc910a75

SHA1
ae23dd7366992bf066ce0cc8226c3001dc0026e9

SHA256
72297828b823a4538da37d3d76d62a62414ddfe5e4498412d567ba4c19777646

SHA512
2301bdc9d467cfdf8ae4e7bf8729f53c9d3bdfad25705187b106c8d2aeb719e9150fcc11ae05c2862f3e799de0fcc477b713c2cdfcfa110b7c0628c3d8127f05

Download Submit
/data/user/0/com.zejapizehiyuki.yijoro/no_backup/androidx.work.workdb-wal
Filesize
112KB

MD5
bf568d6e141d14ecb8747f04a8ff2be7

SHA1
1d3f1508e1c4ecd9401d89995e043afe7649fd8a

SHA256
c139288b8ec41ccac44965ad5b86ea33aded42027812c095e1edafef212d858e

SHA512
e50a3c7412eb30c063cc6163e177642f05b8e7234d7b0d1dcaec9a7d09f94b28e6f96b6d72599feaf8eb486227d3417447df2a81688ea1260def146240c404d2

Download Submit
/data/user/0/com.zejapizehiyuki.yijoro/no_backup/androidx.work.workdb-wal
Filesize
177KB

MD5
85c8375807799fe1ff444f2eb68ea236

SHA1
91ad5425dfb19bedecb48449fd77eb1cbba28893

SHA256
6193c7019f6edf60972d210671ea283865cf0915b7cf8d5a30f1345a792558f5

SHA512
3aa7648a813263de4c36cd66d9d53a4434b90a4df3610ae1013afea50dfacb959183d664209683d4ee7b0b2d268c0da159d2ac9417ed861c852c9652dc728343

Download Submit
/system_ext/framework/androidx.window.sidecar.jar
Filesize
12KB

MD5
bdf3529e80318eb14e53a5bf3720c10d

SHA1
25c9ace4b1af6e80ebb2572345972c56505969ba

SHA256
bbc8300dd1e9cd08de8f66560c1ac2c928615b72b51cef9649f88974f586d64b

SHA512
48b9c2d01171bb651b9b54826baa51f4add48431a3efd8ceb5f7cc3bcd6f8f37edf47fabb24349dd15b3a02329cd450f90a8d164bf4f8dfae554bf3b35a8a55b

Download Submit

Analysis

Sharing