6c5c4af3695571f19dc981cc5d0e75bbd66f9d8042845edcde44403c2b53b966

Analysis

max time kernel
128s
max time network
169s
platform
android_x64
resource
android-x64-20240514-en
resource tags

androidarch:x64arch:x86image:android-x64-20240514-enlocale:en-usos:android-10-x64system
submitted
26/05/2024, 15:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ef971d030c21decaa376a1c9130465d3.apk
Size 1.7MB
Sample240526-sfdtrsbc55
SHA256 6c5c4af3695571f19dc981cc5d0e75bbd66f9d8042845edcde44403c2b53b966
MD5 ef971d030c21decaa376a1c9130465d3
SHA1 96acc7982447c80f0a4ba3383641caccfd6d29f6
SHA512 425d42783559e15d3eba7f3819f795b3a1379b53d87cf6c128ee6995d53d3ec74f956eee70d20f2eccce59ddd94c225c53f00c083791046f91470640b227c734
SSDEEP 24576:7Y1Y0Aa+XVfe3fQMTVUh/fWcPtJpiA0sNyL0qgKldLeQx721jx1lCUGLWLDj8XpG:7Y1jQe3fQLecPtaA0sN7sdLu1FhG/4/
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

collection credential_access evasion

Malware Config

Signatures

Makes use of the framework's Accessibility service 4 TTPs 2 IoCs

Retrieves information displayed on the phone screen using AccessibilityService.

collection evasion credential_access

Input Injection

T1516

Screen Capture

T1513

Keylogging

T1417.001

GUI Input Capture

T1417.002

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	org.zzzz.aaa
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByText	org.zzzz.aaa

org.zzzz.aaa
1⤵
- Makes use of the framework's Accessibility service
PID:5167

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Input Injection

T1516

Credential Access

Input Capture

T1417

GUI Input Capture

T1417.002

Keylogging

T1417.001

Discovery

Lateral Movement

Collection

Input Capture

T1417

GUI Input Capture

T1417.002

Keylogging

T1417.001

Screen Capture

T1513

Command and Control

Exfiltration

Impact

Input Injection

T1516

Replay Monitor

Loading Replay Monitor...

Downloads

profileInstalled

Path /data/data/org.zzzz.aaa/files/profileInstalled
Size 24B
SHA256 507435ebe7d28d4a99558f871c5e9bdd95098cdf371c9557f7391f9e1f8b0bac
MD5 80b339d3b7d6d72fa7c6590960ce01aa
SHA1 805a7c6e067d5063d96773f280c63e30c1e9a0cc
SHA512 d02be9c904bf8cfdc0160f1c62e20ab77de2cf0bbb7114ff5cfa31ce875ca80ba78a873ed117eb7b00fbcbf1bc78d33b36d8adeb0e91991a52fc64961451612f
MD5 SHA1 SHA512

Submit Download

profileinstaller_profileWrittenFor_lastUpdateTime.dat

Path /data/data/org.zzzz.aaa/files/profileinstaller_profileWrittenFor_lastUpdateTime.dat
Size 8B
SHA256 75d9b95ec4f6add1eaf3c8fa886fefd27d377a21d540d1aa21524a20170045c1
MD5 7bbd935c86f3a81798613fa3f1b4a1c7
SHA1 880d122de9b089a94179a047ae19c0f6c58f6497
SHA512 959e47870ce60325ecedff9b7c163fc72c855e30c85f03e362e6a8810f478869daf1f2a592cc7bd704559271fd13c2265fd5e9124db8e10ea1feada1cd180a2a
MD5 SHA1 SHA512

Submit Download

primary.prof

Path /data/misc/profiles/cur/0/org.zzzz.aaa/primary.prof
Size 1KB
SHA256 9551d2fc2d320febd04a0ead0c99676fe644d7a58c53402bdf3dbf070274726b
MD5 0f71a70720691d09aed807667584c609
SHA1 24cd74107326d25e1e42e8aa3366800d64803710
SHA512 0f6ed79947b18d7fba26d28b43effe75acc22adcd4c457a867f28b573160d30adf7d94fb0b8db542e681dd9329f80427e30a497eb5d7dd759c251e7d1f349d7b
MD5 SHA1 SHA512

Submit Download

primary.prof

Path /data/misc/profiles/cur/0/org.zzzz.aaa/primary.prof
Size 2KB
SHA256 87445a53f7f52cbd92d6389563316c2cb7811be553393623c7c023d2048d1129
MD5 cdfe7ab9aefbebdc61824ee554edbf77
SHA1 f26fd3b3d468777a1c1263011e21cae57c2e275b
SHA512 21848c80c800a7d1bfdb14dd57d79209ee60e4e515cd8f9867854f846e219c49d3dd0f6e8f306053840b8dccbeb6b51ae593ae8456ced19ddad358044be1bf19
MD5 SHA1 SHA512

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads