d4ab75f8a7b5abb3bab5989a7e426561230da50087da3c60b9ef15c616ebcbee

Analysis

max time kernel
177s
max time network
183s
platform
android_x64
resource
android-x64-arm64-20240514-en
resource tags

androidarch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20240514-enlocale:en-usos:android-11-x64system
submitted
23-05-2024 22:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d4ab75f8a7b5abb3bab5989a7e426561230da50087da3c60b9ef15c616ebcbee.apk
Size

1.7MB
MD5

81f16f031a0161b6710cec80b2ea07db
SHA1

5f3507471c0db78cd4fcac12daac634f54bb2339
SHA256

d4ab75f8a7b5abb3bab5989a7e426561230da50087da3c60b9ef15c616ebcbee
SHA512

635581baf1654e8f5546191f129e772388a14280dd919079c4440642747ea208525d4ed4eaac8bbaf8be73a219b252cf8fd761f0c2a017305414737c789dd58d
SSDEEP

24576:hY13wSGgvt2B6TqRp68TGtUdfZ4hs18jzVTl/JA177eqrjpF8jIDqyx9GkwEes:hY1F+Uu6AZ4hFnv/J47PdD/T

Score

8^/10

collection credential_access evasion

Malware Config

Signatures

Makes use of the framework's Accessibility service 4 TTPs 2 IoCs

Retrieves information displayed on the phone screen using AccessibilityService.

collection evasion credential_access

Input Injection

T1516

Screen Capture

T1513

Keylogging

T1417.001

GUI Input Capture

T1417.002

Processes:

org.zzzz.aaa

description	ioc	process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	org.zzzz.aaa
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByText	org.zzzz.aaa

org.zzzz.aaa
1⤵
- Makes use of the framework's Accessibility service
PID:4618

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Input Injection

T1516

Credential Access

Input Capture

T1417

GUI Input Capture

T1417.002

Keylogging

T1417.001

Discovery

Lateral Movement

Collection

Input Capture

T1417

GUI Input Capture

T1417.002

Keylogging

T1417.001

Screen Capture

T1513

Command and Control

Exfiltration

Impact

Input Injection

T1516

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/org.zzzz.aaa/files/profileinstaller_profileWrittenFor_lastUpdateTime.dat

Filesize
8B

MD5
992bdf3f4d4d2389c2adf0d9fb7907d4

SHA1
88dbff3dd66d27fa49dce78a328c2fc080880ad9

SHA256
6592f056da31ca4b0f26ce9b8c27965c5b25ab582c4ae1405379b0854cfc030d

SHA512
2cabd58a275245d3218ce2db1945f81562d44243c8db9138df03ed4afd7e8dc8ca6acde746da411a9e357bd7d7bc48f17e04ca957971afe937b04d49a0b90d9b

Download Submit
/data/misc/profiles/cur/0/org.zzzz.aaa/primary.prof

Filesize
1KB

MD5
ee96573db4c28671a3777136da873e32

SHA1
0f993097d632f1d33d5e2ff6b72a1f3cd82dfa61

SHA256
6e3883b340234b84b3a8e5c6d90c5e44bd7bf9d9dd6766b35e829d696b42b4c1

SHA512
76c1f2bfc8f8027dccdda397adf5bf85449e6112e8239cd671a231619ee77610ff32206b479517701dce1a79e40bcac1e0245677c9dc9632f83705615841bb04

Download Submit
/data/misc/profiles/cur/0/org.zzzz.aaa/primary.prof

Filesize
2KB

MD5
6f4601d95b44e5bc34206ac41706883c

SHA1
51030be589562a014f2aaf512bd38841bab31078

SHA256
530e80c2472aef4a8054bd4d09074963e98868ae29f45d1c6cf1c77606a8cf3a

SHA512
260a32a035be1362641e4b34e2ef9a91e260aa6c54e83323685fbbe9317e7817187b5bdd1bf4f979261f11fe263afb3cb277eaba512a5a437a774e59bfab69be

Download Submit