fb825ef009699254ad149bd936857905b5ba48a833991113fba9ea3a75874784

Analysis

max time kernel
148s
max time network
132s
platform
android_x64
resource
android-x64-arm64-20240506-en
resource tags

androidarch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20240506-enlocale:en-usos:android-11-x64system
submitted
13-05-2024 17:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6008975dfd2aaa07fcb307b12d0c8a273aa6f4882749e29bac1f29e26a035c8f.apk
Size

760KB
MD5

54d58ec4d05f837a101fa08f94bb98db
SHA1

77a2853ad6f0402183806899d801b79c0091cf61
SHA256

6008975dfd2aaa07fcb307b12d0c8a273aa6f4882749e29bac1f29e26a035c8f
SHA512

47b66a05d9b8e9588b5a82eeff367c79a4ff0102388f2c3cf0202cd6ae2ca306b5c12c450877d4c66d60ca9fc1855e5523f16cdcb7de9d65a25e9ccca2b295ab
SSDEEP

12288:Lw8MOAsa1a8Lde9/NhRmmw5WmpYshXZPbGwidNpg/FD:LwL0a1a6e9fRmmw5WmD9idNpyN

Score

8^/10

banker discovery evasion impact persistence privilege_escalation stealth trojan

Malware Config

Signatures

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
banker discovery

T1418.001
Removes its main activity from the application launcher 1 TTPs 1 IoCs
stealth trojan evasion

T1628.001

Processes:

cmf0.c3b5bm90zq.patch

pid process

4903 cmf0.c3b5bm90zq.patch
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
evasion persistence

T1541

Processes:

cmf0.c3b5bm90zq.patch

description ioc process

Framework service call android.app.IActivityManager.setServiceForeground cmf0.c3b5bm90zq.patch
Requests enabling of the accessibility settings. 1 IoCs

Processes:

cmf0.c3b5bm90zq.patch

description ioc process

Intent action android.settings.ACCESSIBILITY_SETTINGS cmf0.c3b5bm90zq.patch
Tries to add a device administrator. 2 TTPs 1 IoCs
privilege_escalation impact

T1626.001

T1640

Processes:

cmf0.c3b5bm90zq.patch

description ioc process

Intent action android.app.action.ADD_DEVICE_ADMIN cmf0.c3b5bm90zq.patch

pid	process
4903	cmf0.c3b5bm90zq.patch

description	ioc	process
Framework service call	android.app.IActivityManager.setServiceForeground	cmf0.c3b5bm90zq.patch

description	ioc	process
Intent action	android.settings.ACCESSIBILITY_SETTINGS	cmf0.c3b5bm90zq.patch

description	ioc	process
Intent action	android.app.action.ADD_DEVICE_ADMIN	cmf0.c3b5bm90zq.patch

cmf0.c3b5bm90zq.patch
1⤵
- Removes its main activity from the application launcher
- Makes use of the framework's foreground persistence service
- Requests enabling of the accessibility settings.
- Tries to add a device administrator.
PID:4903

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

/storage/emulated/0/service player/config13-05-2024.log
Filesize
39B

MD5
0781e4c35ca7a8024f3f8e77773b643f

SHA1
b00b24fa8b0994debe29fc2cbad71be084d5f694

SHA256
653546e8ffee485251c3ad4e375f33afdcd04e0c1fe7ecf220c82ca8b12c0301

SHA512
0dc3686902bc3a244135fcf44411f91bca845324e5b8c1be3b66065b567c419b9a32a8da6a174387b9be4c7f869130f6fca1f3aa0d0468a6d431afdb5938b85e

Download Submit
/storage/emulated/0/service player/config13-05-2024.log
Filesize
68B

MD5
b9f245e03a2fe67666123d7613265422

SHA1
299ee34eae61fb70ef5e08326d9702aa04dabf50

SHA256
ed9a197bf4d892fca6f45dc52fd0ce13ba25fdb3e458a0a679e7027fb48ad726

SHA512
c4f1767c2ec32049516105cbf8da8b8347c966712162ad373aa9775742ef136913ad58d0d3210ab895c0b36e9177906045e095b5eee23c6cd818af7edf7f2b03

Download Submit
/storage/emulated/0/service player/config13-05-2024.log
Filesize
59B

MD5
5f6d6273e461a421503877f611d837f2

SHA1
a2da6b739d69a1881c896fbabe7010eb5f6dc6ee

SHA256
366dd2c4aba30ef23c9c2de90b672699288e7b68f4b015a79a40795a0fc59df4

SHA512
ff5510f5d36a78117be19fec349d456c3fb83d1385ffd6f0ab47823a2ee0feeb50203847ab9046d7e21ce89f5b2c274a1e98b63559379fcff83bcd02e244d7f9

Download Submit
/storage/emulated/0/service player/config13-05-2024.log
Filesize
54B

MD5
7dad5b26077371c33af8a8429b91fded

SHA1
c2a08a1346fb5fd3ee778bc12c2bd9558d20f0fa

SHA256
3765408d8f281daa1f7c7b573848251dc5a9f7ec0649dfa01fafa164a510c884

SHA512
3e9fc8c198643a654882fdbd0cd953a0756e3f9c5fb207893a513ffdd95b24eabc8846c794f458fd77953c8e96ae5526c45c697d1cf6a69c54ca255c0401a1e2

Download Submit
/storage/emulated/0/service player/config13-05-2024.log
Filesize
60B

MD5
2bbbc22cc6e3881e6247452ec032ea85

SHA1
c141480d6e2050d9bf6343f771a7d17bf0d61b21

SHA256
64342b782e975ac26c7af89db567a96cf75e514f16e53216901e66267b46e6e0

SHA512
f5403c74ffa8cda19376878119d7013ce327d3c0d34befcaadc1eb41a796ad6c3944a17d471461754298c5cfe2bfc24c77dc2fffca9447a2be8cacf71bd0614d

Download Submit
/storage/emulated/0/service player/config13-05-2024.log
Filesize
288B

MD5
e1fed1012af5c5ab10a5b9d15dfe41fb

SHA1
e07703d8768a87916813ddd58d0f30dc4c41638a

SHA256
06d379ed36ffc468f0d9f60986b4779e47f7263ea63ecf24c7d82e9527d874b1

SHA512
008733693e931625f52eb099ba94b50c335bbfc9be54ff6bbf8a5ee513c3d802c6e9b0db95dd59ba87559d3cd7d1ca70ed7d9f8c91f4184ecc88b2b97b7b82be

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads