fb825ef009699254ad149bd936857905b5ba48a833991113fba9ea3a75874784

Analysis

max time kernel
148s
max time network
132s
platform
android_x64
resource
android-x64-arm64-20240506-en
resource tags

androidarch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20240506-enlocale:en-usos:android-11-x64system
submitted
13-05-2024 17:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6008975dfd2aaa07fcb307b12d0c8a273aa6f4882749e29bac1f29e26a035c8f.apk
Size

760KB
MD5

54d58ec4d05f837a101fa08f94bb98db
SHA1

77a2853ad6f0402183806899d801b79c0091cf61
SHA256

6008975dfd2aaa07fcb307b12d0c8a273aa6f4882749e29bac1f29e26a035c8f
SHA512

47b66a05d9b8e9588b5a82eeff367c79a4ff0102388f2c3cf0202cd6ae2ca306b5c12c450877d4c66d60ca9fc1855e5523f16cdcb7de9d65a25e9ccca2b295ab
SSDEEP

12288:Lw8MOAsa1a8Lde9/NhRmmw5WmpYshXZPbGwidNpg/FD:LwL0a1a6e9fRmmw5WmD9idNpyN

Score

8^/10

banker discovery evasion impact persistence privilege_escalation stealth trojan

Malware Config

Signatures

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
banker discovery

Security Software Discovery
T1418.001

Removes its main activity from the application launcher 1 TTPs 1 IoCs

stealth trojan evasion

Suppress Application Icon

T1628.001

pid	Process
4903	cmf0.c3b5bm90zq.patch

Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

Application may abuse the framework's foreground service to continue running in the foreground.

evasion persistence

Foreground Persistence

T1541

description	ioc	Process
Framework service call	android.app.IActivityManager.setServiceForeground	cmf0.c3b5bm90zq.patch

Requests enabling of the accessibility settings. 1 IoCs

description	ioc	Process
Intent action	android.settings.ACCESSIBILITY_SETTINGS	cmf0.c3b5bm90zq.patch

Tries to add a device administrator. 2 TTPs 1 IoCs

privilege_escalation impact

Device Administrator Permissions

T1626.001

Account Access Removal

T1640

description	ioc	Process
Intent action	android.app.action.ADD_DEVICE_ADMIN	cmf0.c3b5bm90zq.patch

cmf0.c3b5bm90zq.patch
1⤵
- Removes its main activity from the application launcher
- Makes use of the framework's foreground persistence service
- Requests enabling of the accessibility settings.
- Tries to add a device administrator.
PID:4903

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Foreground Persistence

T1541

Privilege Escalation

Abuse Elevation Control Mechanism

T1626

Device Administrator Permissions

T1626.001

Defense Evasion

Foreground Persistence

T1541

Hide Artifacts

T1628

Suppress Application Icon

T1628.001

Credential Access

Discovery

Software Discovery

T1418

Security Software Discovery

T1418.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Account Access Removal

T1640

Replay Monitor

Loading Replay Monitor...

Downloads

/storage/emulated/0/service player/config13-05-2024.log

Filesize
39B

MD5
0781e4c35ca7a8024f3f8e77773b643f

SHA1
b00b24fa8b0994debe29fc2cbad71be084d5f694

SHA256
653546e8ffee485251c3ad4e375f33afdcd04e0c1fe7ecf220c82ca8b12c0301

SHA512
0dc3686902bc3a244135fcf44411f91bca845324e5b8c1be3b66065b567c419b9a32a8da6a174387b9be4c7f869130f6fca1f3aa0d0468a6d431afdb5938b85e

Download Submit
/storage/emulated/0/service player/config13-05-2024.log

Filesize
68B

MD5
b9f245e03a2fe67666123d7613265422

SHA1
299ee34eae61fb70ef5e08326d9702aa04dabf50

SHA256
ed9a197bf4d892fca6f45dc52fd0ce13ba25fdb3e458a0a679e7027fb48ad726

SHA512
c4f1767c2ec32049516105cbf8da8b8347c966712162ad373aa9775742ef136913ad58d0d3210ab895c0b36e9177906045e095b5eee23c6cd818af7edf7f2b03

Download Submit
/storage/emulated/0/service player/config13-05-2024.log

Filesize
59B

MD5
5f6d6273e461a421503877f611d837f2

SHA1
a2da6b739d69a1881c896fbabe7010eb5f6dc6ee

SHA256
366dd2c4aba30ef23c9c2de90b672699288e7b68f4b015a79a40795a0fc59df4

SHA512
ff5510f5d36a78117be19fec349d456c3fb83d1385ffd6f0ab47823a2ee0feeb50203847ab9046d7e21ce89f5b2c274a1e98b63559379fcff83bcd02e244d7f9

Download Submit
/storage/emulated/0/service player/config13-05-2024.log

Filesize
54B

MD5
7dad5b26077371c33af8a8429b91fded

SHA1
c2a08a1346fb5fd3ee778bc12c2bd9558d20f0fa

SHA256
3765408d8f281daa1f7c7b573848251dc5a9f7ec0649dfa01fafa164a510c884

SHA512
3e9fc8c198643a654882fdbd0cd953a0756e3f9c5fb207893a513ffdd95b24eabc8846c794f458fd77953c8e96ae5526c45c697d1cf6a69c54ca255c0401a1e2

Download Submit
/storage/emulated/0/service player/config13-05-2024.log

Filesize
60B

MD5
2bbbc22cc6e3881e6247452ec032ea85

SHA1
c141480d6e2050d9bf6343f771a7d17bf0d61b21

SHA256
64342b782e975ac26c7af89db567a96cf75e514f16e53216901e66267b46e6e0

SHA512
f5403c74ffa8cda19376878119d7013ce327d3c0d34befcaadc1eb41a796ad6c3944a17d471461754298c5cfe2bfc24c77dc2fffca9447a2be8cacf71bd0614d

Download Submit
/storage/emulated/0/service player/config13-05-2024.log

Filesize
288B

MD5
e1fed1012af5c5ab10a5b9d15dfe41fb

SHA1
e07703d8768a87916813ddd58d0f30dc4c41638a

SHA256
06d379ed36ffc468f0d9f60986b4779e47f7263ea63ecf24c7d82e9527d874b1

SHA512
008733693e931625f52eb099ba94b50c335bbfc9be54ff6bbf8a5ee513c3d802c6e9b0db95dd59ba87559d3cd7d1ca70ed7d9f8c91f4184ecc88b2b97b7b82be

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads