cad56908abd1508451a5af4a5304de092f0342ec6a24bbbeb9b3988683483c84

Resubmissions

16-05-2024 13:59

240516-ravpnagc75 10

16-05-2024 08:38

16-05-2024 08:34

16-05-2024 08:28

15-05-2024 07:41

Analysis

max time kernel
179s
max time network
184s
platform
android_x64
resource
android-x64-arm64-20240514-en
resource tags

androidarch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20240514-enlocale:en-usos:android-11-x64system
submitted
16-05-2024 08:38

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

cad56908abd1508451a5af4a5304de092f0342ec6a24bbbeb9b3988683483c84.apk
Size

4.6MB
MD5

f54c526d2937c59a44577fdb9852e793
SHA1

10a9ec85a15c0653cbdd368dafa71527825c4f4e
SHA256

cad56908abd1508451a5af4a5304de092f0342ec6a24bbbeb9b3988683483c84
SHA512

71c5b163c0fab875b79485a6eb42ea52aec0ca0c38b3eab4ffa52638e8b26a99edc26d8a689bb6d5b762807e8099891c3e33a1eb74e215b9519c7769c6801891
SSDEEP

98304:CkKdcW23OljvSyC28qG1VNBD0eoD0YD0ND0E+D0nAmD0aD0BD0HWW:ydcW23O56b28qGTNBDmDZDYDUDCjDrDf

Score

8^/10

collection credential_access discovery evasion impact

Malware Config

Signatures

Makes use of the framework's Accessibility service 4 TTPs 2 IoCs

Retrieves information displayed on the phone screen using AccessibilityService.

collection evasion credential_access

Input Injection

T1516

Screen Capture

T1513

Keylogging

T1417.001

GUI Input Capture

T1417.002

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	com.estifrumix.newicon
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId	com.estifrumix.newicon

Prevents application removal 1 TTPs 1 IoCs

Application may abuse the framework's APIs to prevent removal.

evasion

Prevent Application Removal

T1629.001

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction	com.estifrumix.newicon

Requests accessing notifications (often used to intercept notifications before users become aware). 1 TTPs 1 IoCs

collection credential_access

Access Notifications

T1517

description	ioc	Process
Intent action	android.settings.ACTION_NOTIFICATION_LISTENER_SETTINGS	com.estifrumix.newicon

Checks CPU information 2 TTPs 1 IoCs

Checks CPU information which indicate if the system is an emulator.

evasion discovery

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	com.estifrumix.newicon

Checks memory information 2 TTPs 1 IoCs

Checks memory information which indicate if the system is an emulator.

evasion discovery

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	com.estifrumix.newicon

Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs

Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.

collection credential_access impact

Clipboard Data

T1414

Transmitted Data Manipulation

T1641.001

description	ioc	Process
Framework service call	android.content.IClipboard.addPrimaryClipChangedListener	com.estifrumix.newicon

Acquires the wake lock 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.estifrumix.newicon

com.estifrumix.newicon
1⤵
- Makes use of the framework's Accessibility service
- Prevents application removal
- Requests accessing notifications (often used to intercept notifications before users become aware).
- Checks CPU information
- Checks memory information
- Obtains sensitive information copied to the device clipboard
- Acquires the wake lock
PID:4614

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Impair Defenses

T1629

Prevent Application Removal

T1629.001

Input Injection

T1516

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Access Notifications

T1517

Clipboard Data

T1414

Input Capture

T1417

GUI Input Capture

T1417.002

Keylogging

T1417.001

Discovery

System Information Discovery

T1426

Lateral Movement

Collection

Access Notifications

T1517

Clipboard Data

T1414

Input Capture

T1417

GUI Input Capture

T1417.002

Keylogging

T1417.001

Screen Capture

T1513

Command and Control

Exfiltration

Impact

Data Manipulation

T1641

Transmitted Data Manipulation

T1641.001

Input Injection

T1516

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.estifrumix.newicon/files/db.db

Filesize
44KB

MD5
d5d190e1180c5e6858c40a93f7526f12

SHA1
0d054f2e34776c8d5bcfd54d743831b9919618fe

SHA256
274fe3e82fc2630d99809afd6a1c64768a77ed69c04b33e0df6a292a5a042203

SHA512
0d58df37359d6e35f02ef95e4edcfb05fac6c3bc57d1c3e56e49fa7b6c66aef3f99b383cb14dc5a01b52bc6a0d4685f275fb30279aa26e8339a5e0b8416ba85e

Download Submit
/data/data/com.estifrumix.newicon/files/loading.gif

Filesize
121KB

MD5
7b38720a0352dffa26411726c72dd2b0

SHA1
b15e687f42abcdc12427f146a3115ef2259211f8

SHA256
2013f490d45638cada331b3474ed65b9a43cec60da773accc98332e58c06336d

SHA512
0df28f87da4f9beb3ca8c108f54021a2a1a1434771abbb5ba67a2736097f2287b05e5220a33e92c42ee13ecae1144714a422b986763712794f69e65bc44c83e3

Download Submit
/data/data/com.estifrumix.newicon/files/txtscreensize.txt

Filesize
11B

MD5
1b65c10c6215685f9d621d797f911373

SHA1
cc50aaed5cd521a62ec8cf9fe0413153ec90f265

SHA256
2230c2b2787663a054c47450ecd1718f0296853ad768b8e5d306ecb912685e89

SHA512
5a9139f295dbe384b1584eff5c11f3f86759232f7b661b75f27fe92b996b4cdc0552e315f79b26f5f2c1f91756d9ae04cf0c3675b6172e91a3d373b9b314496f

Download Submit

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads