6c5c4af3695571f19dc981cc5d0e75bbd66f9d8042845edcde44403c2b53b966

Analysis

max time kernel
123s
max time network
150s
platform
android_x86
resource
android-x86-arm-20240514-en
resource tags

androidarch:armarch:x86image:android-x86-arm-20240514-enlocale:en-usos:android-9-x86system
submitted
26/05/2024, 15:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ef971d030c21decaa376a1c9130465d3.apk
Size 1.7MB
Sample240526-sfdtrsbc55
SHA256 6c5c4af3695571f19dc981cc5d0e75bbd66f9d8042845edcde44403c2b53b966
MD5 ef971d030c21decaa376a1c9130465d3
SHA1 96acc7982447c80f0a4ba3383641caccfd6d29f6
SHA512 425d42783559e15d3eba7f3819f795b3a1379b53d87cf6c128ee6995d53d3ec74f956eee70d20f2eccce59ddd94c225c53f00c083791046f91470640b227c734
SSDEEP 24576:7Y1Y0Aa+XVfe3fQMTVUh/fWcPtJpiA0sNyL0qgKldLeQx721jx1lCUGLWLDj8XpG:7Y1jQe3fQLecPtaA0sN7sdLu1FhG/4/
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

collection credential_access evasion

Malware Config

Signatures

Makes use of the framework's Accessibility service 4 TTPs 2 IoCs

Retrieves information displayed on the phone screen using AccessibilityService.

collection evasion credential_access

Input Injection

T1516

Screen Capture

T1513

Keylogging

T1417.001

GUI Input Capture

T1417.002

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	org.zzzz.aaa
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByText	org.zzzz.aaa

org.zzzz.aaa
1⤵
- Makes use of the framework's Accessibility service
PID:4328

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Input Injection

T1516

Credential Access

Input Capture

T1417

GUI Input Capture

T1417.002

Keylogging

T1417.001

Discovery

Lateral Movement

Collection

Input Capture

T1417

GUI Input Capture

T1417.002

Keylogging

T1417.001

Screen Capture

T1513

Command and Control

Exfiltration

Impact

Input Injection

T1516

Replay Monitor

Loading Replay Monitor...

Downloads

profileInstalled

Path /data/data/org.zzzz.aaa/files/profileInstalled
Size 24B
SHA256 761d521ab11cee9c60644e63953e073ccba71c140af5e1b3d6a8aea371751628
MD5 0f4d63dbfb4dd2a22f015c900fe8b9c8
SHA1 cad324c657943dba194b9e613eea620279f57d80
SHA512 b6ffdc31aade7e5c5ff76a54e16c3e135069f1116e781c22212cba43b42360646e5c36a3c7c007ad49860ac8b40c5d00bb8975c08a578329a8338362b8095d10
MD5 SHA1 SHA512

Submit Download

profileinstaller_profileWrittenFor_lastUpdateTime.dat

Path /data/data/org.zzzz.aaa/files/profileinstaller_profileWrittenFor_lastUpdateTime.dat
Size 8B
SHA256 afc74eef426cbe6e923455af675e9646a404d6be0ffdd80bc31dfce03877810d
MD5 3a468105b8a16172a13d61832c7aa463
SHA1 4107595cd07cf7f5b0982955d0b83e9f25a4073b
SHA512 5cae420ec83f6a3800e5078abdd4be7231dba22b84df85d6c5ff4f9e070c3dbe77402f4103f3358902465ec58991c0caeaaece362b84b8eb2fd709182f232ab0
MD5 SHA1 SHA512

Submit Download

primary.prof

Path /data/misc/profiles/cur/0/org.zzzz.aaa/primary.prof
Size 1KB
SHA256 9551d2fc2d320febd04a0ead0c99676fe644d7a58c53402bdf3dbf070274726b
MD5 0f71a70720691d09aed807667584c609
SHA1 24cd74107326d25e1e42e8aa3366800d64803710
SHA512 0f6ed79947b18d7fba26d28b43effe75acc22adcd4c457a867f28b573160d30adf7d94fb0b8db542e681dd9329f80427e30a497eb5d7dd759c251e7d1f349d7b
MD5 SHA1 SHA512

Submit Download

primary.prof

Path /data/misc/profiles/cur/0/org.zzzz.aaa/primary.prof
Size 2KB
SHA256 1c714bc078d70407ec21155c4ad42df380f6f9242550a71109a96cc9cbe2e5e3
MD5 222f72cac76b431dbc5e94fc5fa689a9
SHA1 a9fbd2253acf18a7c179e4216c8ab973aba8d908
SHA512 219affeb59e0187bb7bd953fdb9976d95f23c8732dcbc3e372bedb07661789374ce98b5b6046915f6c1f02c75eb14ba1fc4f12407d2ceea39b9b6b13c5778e2a
MD5 SHA1 SHA512

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads