6c5c4af3695571f19dc981cc5d0e75bbd66f9d8042845edcde44403c2b53b966

Analysis

max time kernel
123s
max time network
132s
platform
android_x64
resource
android-x64-arm64-20240514-en
resource tags

androidarch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20240514-enlocale:en-usos:android-11-x64system
submitted
26/05/2024, 15:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ef971d030c21decaa376a1c9130465d3.apk
Size 1.7MB
Sample240526-sfdtrsbc55
SHA256 6c5c4af3695571f19dc981cc5d0e75bbd66f9d8042845edcde44403c2b53b966
MD5 ef971d030c21decaa376a1c9130465d3
SHA1 96acc7982447c80f0a4ba3383641caccfd6d29f6
SHA512 425d42783559e15d3eba7f3819f795b3a1379b53d87cf6c128ee6995d53d3ec74f956eee70d20f2eccce59ddd94c225c53f00c083791046f91470640b227c734
SSDEEP 24576:7Y1Y0Aa+XVfe3fQMTVUh/fWcPtJpiA0sNyL0qgKldLeQx721jx1lCUGLWLDj8XpG:7Y1jQe3fQLecPtaA0sN7sdLu1FhG/4/
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

collection credential_access evasion

Malware Config

Signatures

Makes use of the framework's Accessibility service 4 TTPs 2 IoCs

Retrieves information displayed on the phone screen using AccessibilityService.

collection evasion credential_access

Input Injection

T1516

Screen Capture

T1513

Keylogging

T1417.001

GUI Input Capture

T1417.002

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	org.zzzz.aaa
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByText	org.zzzz.aaa

org.zzzz.aaa
1⤵
- Makes use of the framework's Accessibility service
PID:4626

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Input Injection

T1516

Credential Access

Input Capture

T1417

GUI Input Capture

T1417.002

Keylogging

T1417.001

Discovery

Lateral Movement

Collection

Input Capture

T1417

GUI Input Capture

T1417.002

Keylogging

T1417.001

Screen Capture

T1513

Command and Control

Exfiltration

Impact

Input Injection

T1516

Replay Monitor

Loading Replay Monitor...

Downloads

profileinstaller_profileWrittenFor_lastUpdateTime.dat

Path /data/data/org.zzzz.aaa/files/profileinstaller_profileWrittenFor_lastUpdateTime.dat
Size 8B
SHA256 42f73ea4105c32e8ece84a866d46a520bcda42d6e9e5c778794ee9d36d5cf0ed
MD5 611da0dd59a8397342f28acf4a3ed618
SHA1 7441ab89d3fa51c38763e4729ad82bb77158b3c3
SHA512 7167c63c69020e7a0afa2aa5fc3ee9e344fb46e1c1f643746d44b1d809ddc859d2acc2788e74b56b2d2405a4711756dd69472a2ca2d803e5b4f715b9908d58b0
MD5 SHA1 SHA512

Submit Download

primary.prof

Path /data/misc/profiles/cur/0/org.zzzz.aaa/primary.prof
Size 1KB
SHA256 9551d2fc2d320febd04a0ead0c99676fe644d7a58c53402bdf3dbf070274726b
MD5 0f71a70720691d09aed807667584c609
SHA1 24cd74107326d25e1e42e8aa3366800d64803710
SHA512 0f6ed79947b18d7fba26d28b43effe75acc22adcd4c457a867f28b573160d30adf7d94fb0b8db542e681dd9329f80427e30a497eb5d7dd759c251e7d1f349d7b
MD5 SHA1 SHA512

Submit Download

primary.prof

Path /data/misc/profiles/cur/0/org.zzzz.aaa/primary.prof
Size 2KB
SHA256 8ff2b7c28b735a72fd6d9cd1bd8fa14a85912695138ca0cbb47a2cdf3755896f
MD5 ecb9d6ffbf632daea74b68ffeb3c258a
SHA1 b525b8b205392f4333246317229e28818e2332c7
SHA512 5be9b6691c2828dc4d2c8ee6012413a670321cd8fed515582cea7b051f70a510ed2ffa07629a64a7a003f63b313a3cfb38b69fb40d7bbf6273082cddcced6b1f
MD5 SHA1 SHA512

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads