728518dcb95a8c648c30d7227a3c759eb70313a514d1b81133eccf3faa9c6e65

Analysis

max time kernel
78s
max time network
68s
platform
android_x64
resource
android-x64-arm64-20240514-en
resource tags

androidarch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20240514-enlocale:en-usos:android-11-x64system
submitted
20-05-2024 14:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

client.apk
Size

3.9MB
MD5

6e4216b44ae4adc7af7ba8951ba99abc
SHA1

9bd313c7a47aa6f2036b6c0495afb51ffc246b01
SHA256

728518dcb95a8c648c30d7227a3c759eb70313a514d1b81133eccf3faa9c6e65
SHA512

73813fba39d2b39e1cc2cd275e839d8e1c9e947edeb3c063401dbf9c21a1be1083d6c4f3bd4c45beafe86423baa1274e5340529e7fe961f153e21eea8ff529da
SSDEEP

98304:LrCGu4qYobgTa+vKDQ82/MQJnmuFLdg/l86o:3Ru4WbUN8wBLdg/l8j

Score

8^/10

banker discovery evasion impact persistence privilege_escalation

Malware Config

Signatures

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
banker discovery

Security Software Discovery
T1418.001
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
evasion persistence

Foreground Persistence
T1541

Processes:

cmf0.c3b5bm90zq.patch

description ioc process

Framework service call android.app.IActivityManager.setServiceForeground cmf0.c3b5bm90zq.patch
Requests enabling of the accessibility settings. 1 IoCs

Processes:

cmf0.c3b5bm90zq.patch

description ioc process

Intent action android.settings.ACCESSIBILITY_SETTINGS cmf0.c3b5bm90zq.patch
Tries to add a device administrator. 2 TTPs 1 IoCs
privilege_escalation impact

Device Administrator Permissions
T1626.001

Account Access Removal
T1640

Processes:

cmf0.c3b5bm90zq.patch

description ioc process

Intent action android.app.action.ADD_DEVICE_ADMIN cmf0.c3b5bm90zq.patch

description	ioc	process
Framework service call	android.app.IActivityManager.setServiceForeground	cmf0.c3b5bm90zq.patch

description	ioc	process
Intent action	android.settings.ACCESSIBILITY_SETTINGS	cmf0.c3b5bm90zq.patch

description	ioc	process
Intent action	android.app.action.ADD_DEVICE_ADMIN	cmf0.c3b5bm90zq.patch

cmf0.c3b5bm90zq.patch
1⤵
- Makes use of the framework's foreground persistence service
- Requests enabling of the accessibility settings.
- Tries to add a device administrator.
PID:4614

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Foreground Persistence

T1541

Privilege Escalation

Abuse Elevation Control Mechanism

T1626

Device Administrator Permissions

T1626.001

Defense Evasion

Foreground Persistence

T1541

Credential Access

Discovery

Software Discovery

T1418

Security Software Discovery

T1418.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Account Access Removal

T1640

Replay Monitor

Loading Replay Monitor...

Downloads

/storage/emulated/0/systeminformation.android.app/config20-05-2024.log
Filesize
39B

MD5
ed07792f15b829018b63335ace93b1cd

SHA1
465bc3e328196b76c7bd84da284cef4d5adec294

SHA256
972aeb8332df1634877ed5007e8c65f5cf1cbde3dd7d784f09d1f78bdf614f24

SHA512
760d8753674d37088205f104da34f8caab7be313b8414f191eb6926fc146a4dabd33327dc91fe0bd98604ebdd9b783669df8663714efc383bb295457af659476

Download Submit
/storage/emulated/0/systeminformation.android.app/config20-05-2024.log
Filesize
64B

MD5
d4e5bd4c338c80fff2af6e7640c0c27b

SHA1
bb9ab4f153e1400068e1752dc1d6aa0daff1c920

SHA256
0fd365a621351e9c6fd4266dbcd7ea923287920ac7c642b80960ab33bd9ef8fa

SHA512
8f93915647810ffeac11e25c2668e3044ac7d5c5c74694cbea7f206ad2a764d85e0e9d5579e521a2da682f1c14a3a536288d2820b5a8c59de843348a2a4ed69d

Download Submit
/storage/emulated/0/systeminformation.android.app/config20-05-2024.log
Filesize
115B

MD5
68f524077aa70b591eb07d32a9b80ff7

SHA1
7ad542f09192d335b389a8e9255bfd9029c5b17b

SHA256
b4263a0c2112b07b3e992549d0572aa456ac0b76446ed28b58683e4d53fecf59

SHA512
b17b4021968764823724be4a4ee0097584f27618905942d2f1764f604f9d34b6114402e0db38cb2595836bf82dccda2ddb1dd15b82e40fa3cf5a65c9fc8dd450

Download Submit
/storage/emulated/0/systeminformation.android.app/config20-05-2024.log
Filesize
60B

MD5
b40834f70e76b83c3d5da18f40f531fc

SHA1
b879fb036d85ec24bbac22228a7f3b1e8f3c75d4

SHA256
8b528d0d2e8f5e054c324f3a4b2485747d7bcb1a1f91ea8520ef6ceea9b3b0ec

SHA512
54b788299b3a52bb4e95405bf38fe341dc89cb68363f1c86dcf456209bb809577b1ec0db26d230c9f605e374775488739dd436f033b30971591d61b77bf2f25e

Download Submit
/storage/emulated/0/systeminformation.android.app/config20-05-2024.log
Filesize
85B

MD5
f33b99a6140cc73659546fcb5fb2246d

SHA1
d828e6b671ab91f4f44d35710ee27a73886bad2b

SHA256
e652a45b5082119126104606a4e9ef5c9f0fa053339501138596ceec546bb904

SHA512
21a76820f07486d14a31491f6ac149d69de428f82aa0645cb7efbf24a29181e15324408a85a8ee93344a524d0154715a74b0c45be0ab7183373a45733162e56b

Download Submit