ca47cb20b6aeba1629c66111b5912bf22a0079986cfa249173b635a2548695c6

Analysis

max time kernel
1076s
max time network
1020s
platform
android_x64
resource
android-33-x64-arm64-20240514-en
resource tags

androidarch:arm64arch:x64image:android-33-x64-arm64-20240514-enlocale:en-usos:android-13-x64system
submitted
17-05-2024 18:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

GameGuardian.apk
Size

20.5MB
MD5

92d8a3f23ebeaec7f7aff61dddd8c01e
SHA1

d3f285df1842e6f79fbb3bc65d5465aebbea3886
SHA256

ca47cb20b6aeba1629c66111b5912bf22a0079986cfa249173b635a2548695c6
SHA512

7b13448e98ef732849ae515efa4b94e48ac568693197a47146a1670d377185276dca3a5f3de4d1baba2cbc96b52de1eda267ac28e0f210a2a218781b837c168b
SSDEEP

393216:0RSbMt2q/AnsT4ZDR6iA5ycdDf5Yc2RRDM2CX1:0RQ3q/Ws6LGjxYcgM1

Score

8^/10

banker discovery evasion impact persistence privilege_escalation

Malware Config

Signatures

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
banker discovery

Security Software Discovery
T1418.001
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
evasion persistence

Foreground Persistence
T1541

Processes:

cmf0.c3b5bm90zq.patch

description ioc process

Framework service call android.app.IActivityManager.setServiceForeground cmf0.c3b5bm90zq.patch
Requests enabling of the accessibility settings. 1 IoCs

Processes:

cmf0.c3b5bm90zq.patch

description ioc process

Intent action android.settings.ACCESSIBILITY_SETTINGS cmf0.c3b5bm90zq.patch
Tries to add a device administrator. 2 TTPs 1 IoCs
privilege_escalation impact

Device Administrator Permissions
T1626.001

Account Access Removal
T1640

Processes:

cmf0.c3b5bm90zq.patch

description ioc process

Intent action android.app.action.ADD_DEVICE_ADMIN cmf0.c3b5bm90zq.patch

description	ioc	process
Framework service call	android.app.IActivityManager.setServiceForeground	cmf0.c3b5bm90zq.patch

description	ioc	process
Intent action	android.settings.ACCESSIBILITY_SETTINGS	cmf0.c3b5bm90zq.patch

description	ioc	process
Intent action	android.app.action.ADD_DEVICE_ADMIN	cmf0.c3b5bm90zq.patch

cmf0.c3b5bm90zq.patch
1⤵
- Makes use of the framework's foreground persistence service
- Requests enabling of the accessibility settings.
- Tries to add a device administrator.
PID:4321

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Foreground Persistence

T1541

Privilege Escalation

Abuse Elevation Control Mechanism

T1626

Device Administrator Permissions

T1626.001

Defense Evasion

Foreground Persistence

T1541

Credential Access

Discovery

Software Discovery

T1418

Security Software Discovery

T1418.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Account Access Removal

T1640

Replay Monitor

Loading Replay Monitor...

Downloads

/storage/emulated/0/gameguardian.net/config17-05-2024.log
Filesize
78B

MD5
cc99010343f608fd6f43513bf6d5d199

SHA1
a159beaf973a1728b4b788c12e94d5f113ea047e

SHA256
d9cdd80fb11e92a1ac916f951d8793ac757cb3b3142db2eb1c9094d411b9d883

SHA512
f56c233640c94d456890a7afe80c7d3e72b6aa40ecbeacf1e75dd6e64d84b4c541323b771de19121e3bac816cde4672dc11028f44ed0dc9cf6d0daaca9842b31

Download Submit
/storage/emulated/0/gameguardian.net/config17-05-2024.log
Filesize
85B

MD5
0c557643afd6951abe91f90c25a6afe3

SHA1
3028db6a342880c2c58e57462f6b34fb516df0f5

SHA256
944d6103032480cce6c952f4ec97276b2028a2ed9cb5e45b25e467c2ddd53df4

SHA512
fadc5267ec270061286f09a949b8560e7682ecd4b4a1ac76c75ad1e49dd38d60c53477060812748e7dfa4b8b4d48b8c490c519157fcb5e71ed5cb5ce7f1dff78

Download Submit
/storage/emulated/0/gameguardian.net/config17-05-2024.log
Filesize
360B

MD5
53e0de28baee4d1c2350340fd3045838

SHA1
98410c5d24ea391096fbcce7c2175fbfcee3498d

SHA256
2b82286bd65f8c691c6a97ef6d9982459ce5fb02df090d4904126a5e5a6b135b

SHA512
f2afe030bc91bc509f750124ccf5a379291d9365dd896fce847fffa50ba06970e9d8621eda76e2667741e63ad930074a6752202fccd0dccacec897910936107a

Download Submit