c8fc5f99153b79529f0f5f4fa5dcf46e0a75ecb2804a39512ac589e7bbd1bd49

Analysis

max time kernel
179s
max time network
131s
platform
android_x86
resource
android-x86-arm-20240514-en
resource tags

androidarch:armarch:x86image:android-x86-arm-20240514-enlocale:en-usos:android-9-x86system
submitted
15-05-2024 09:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8a91bf9ba1250e5f0977384101f5ff3c1d7dc121e7ed304e2580bac1082b7d61.apk
Size

786KB
MD5

572589492cf56c19140b0f35e5205dbd
SHA1

8fb0fe21bb0f3ee43702167c5b57f76397882264
SHA256

8a91bf9ba1250e5f0977384101f5ff3c1d7dc121e7ed304e2580bac1082b7d61
SHA512

ef08cf54f52b21826cddb9c1784c667471851687a14c907786b9df21201df27dc9f830555c8d55dda2c2b0249bd2e1e88d4552cd53e503ab75838b97c3399101
SSDEEP

12288:QLcfa1a8Lzezw+8RB/lwlW75WmpYshXZPbGwidNpgY:ta1amebkBtwlW75WmD9idNpf

Score

8^/10

banker discovery evasion impact persistence privilege_escalation

Malware Config

Signatures

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
banker discovery

Security Software Discovery
T1418.001
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
evasion persistence

Foreground Persistence
T1541

Processes:

cmf0.c3b5bm90zq.patch

description ioc process

Framework service call android.app.IActivityManager.setServiceForeground cmf0.c3b5bm90zq.patch
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
persistence

Broadcast Receivers
T1624.001

Processes:

cmf0.c3b5bm90zq.patch

description ioc process

Framework service call android.app.IActivityManager.registerReceiver cmf0.c3b5bm90zq.patch
Requests enabling of the accessibility settings. 1 IoCs

Processes:

cmf0.c3b5bm90zq.patch

description ioc process

Intent action android.settings.ACCESSIBILITY_SETTINGS cmf0.c3b5bm90zq.patch
Tries to add a device administrator. 2 TTPs 1 IoCs
privilege_escalation impact

Device Administrator Permissions
T1626.001

Account Access Removal
T1640

Processes:

cmf0.c3b5bm90zq.patch

description ioc process

Intent action android.app.action.ADD_DEVICE_ADMIN cmf0.c3b5bm90zq.patch

description	ioc	process
Framework service call	android.app.IActivityManager.setServiceForeground	cmf0.c3b5bm90zq.patch

description	ioc	process
Framework service call	android.app.IActivityManager.registerReceiver	cmf0.c3b5bm90zq.patch

description	ioc	process
Intent action	android.settings.ACCESSIBILITY_SETTINGS	cmf0.c3b5bm90zq.patch

description	ioc	process
Intent action	android.app.action.ADD_DEVICE_ADMIN	cmf0.c3b5bm90zq.patch

cmf0.c3b5bm90zq.patch
1⤵
- Makes use of the framework's foreground persistence service
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Requests enabling of the accessibility settings.
- Tries to add a device administrator.
PID:4258

su
2⤵
PID:4288

su
2⤵
PID:4325

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Foreground Persistence

T1541

Privilege Escalation

Abuse Elevation Control Mechanism

T1626

Device Administrator Permissions

T1626.001

Defense Evasion

Foreground Persistence

T1541

Credential Access

Discovery

Software Discovery

T1418

Security Software Discovery

T1418.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Account Access Removal

T1640

Replay Monitor

Loading Replay Monitor...

Downloads

/storage/emulated/0/service player/config15-05-2024.log
Filesize
63B

MD5
2399861ffe0c68a62ca6fa12d764428a

SHA1
7c668d02e074559fc2f04a7aeef54971f9789c6f

SHA256
ee1ca4a9e321d1edeb2549a3b2b0cfafd6a0d89bac23f78d84a274a0e2a7ef97

SHA512
0c2588bbce96814d6bfc1b2216fca2ebcd024389d8c22d99f2ec7f5e70250c9749fd701e3f955c5b262e162d6b14f1fe7fbe5b3ee50af1a7df50389c1876e893

Download Submit