ecf87036b4b884e1e83b5b4fbac589795a9a1639ac6db56bd01b422cf1254cc6

Analysis

max time kernel
144s
max time network
131s
platform
android_x64
resource
android-x64-20240514-en
resource tags

androidarch:x64arch:x86image:android-x64-20240514-enlocale:en-usos:android-10-x64system
submitted
28/05/2024, 22:01

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ecf87036b4b884e1e83b5b4fbac589795a9a1639ac6db56bd01b422cf1254cc6.apk
Size 1.8MB
Sample240528-1xpllafc84
SHA256 ecf87036b4b884e1e83b5b4fbac589795a9a1639ac6db56bd01b422cf1254cc6
MD5 11c1e417187a7f1ba50091a9d7b4cc50
SHA1 7607c3c6a75b8127a498bb81a263dd9bc0aff659
SHA512 9244c7d5db3179a28ec41cde8b309d8d5a161b9b82a61278a8a4f23987c0bb413483d85cd2507a1a52e9c98a821caec1305b9c2bb1fc8f345c58518e14c6c039
SSDEEP 24576:vY1QPlesFZgdJUvpFXEmrsKxVI/HuQmEXqeaCWHbdmU7jfwGMvJuXK7TyWo2mKnf:vY1QNrfvp/xVhQmiqeaHJx7MRjP
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

collection credential_access evasion

Malware Config

Signatures

Makes use of the framework's Accessibility service 4 TTPs 2 IoCs

Retrieves information displayed on the phone screen using AccessibilityService.

collection evasion credential_access

Input Injection

T1516

Screen Capture

T1513

Keylogging

T1417.001

GUI Input Capture

T1417.002

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	org.zzzz.aaa
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByText	org.zzzz.aaa

org.zzzz.aaa
1⤵
- Makes use of the framework's Accessibility service
PID:5130

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Input Injection

T1516

Credential Access

Input Capture

T1417

GUI Input Capture

T1417.002

Keylogging

T1417.001

Discovery

Lateral Movement

Collection

Input Capture

T1417

GUI Input Capture

T1417.002

Keylogging

T1417.001

Screen Capture

T1513

Command and Control

Exfiltration

Impact

Input Injection

T1516

Replay Monitor

Loading Replay Monitor...

Downloads

profileInstalled

Path /data/data/org.zzzz.aaa/files/profileInstalled
Size 24B
SHA256 7d8d0c69802292684ffda27c4471ed13356091e2c45277a9e20374f9d1ee4d31
MD5 ca56e54f78e9609d87e8ec408ea7c8cc
SHA1 d0101c188667f7aca6a224c67278eadf9f87251a
SHA512 91d8b940f6bd5ee3da50fabbe60c3113931d5d592a66f4b2ff9f33bd2e8cb4cabd041e0511eedce3f6c2cdc7be36f85f289a5efec723eafaf320a42d868eb949
MD5 SHA1 SHA512

Submit Download

profileinstaller_profileWrittenFor_lastUpdateTime.dat

Path /data/data/org.zzzz.aaa/files/profileinstaller_profileWrittenFor_lastUpdateTime.dat
Size 8B
SHA256 b2d8420b0132e04a82e8ca6f8ecf643c53dff03514c4b8d5681070c16937a23e
MD5 7d1c919c208133419cc168b34e8865e8
SHA1 b6f9dc8d710fd6a2d332fb8369ec4e5bd02b2991
SHA512 ae7516c3b9409059bd5fcc9b3de86f212df097c6def9454c7b28a7b737ce821a5d33b007ad8e417e5a31237bc09f945806039f4f92167a59c3ae249ffcc50351
MD5 SHA1 SHA512

Submit Download

primary.prof

Path /data/misc/profiles/cur/0/org.zzzz.aaa/primary.prof
Size 1KB
SHA256 8b630caf2dc78da4f5a324d9005909e354ce5e039ea02b05e09e66268870f2bf
MD5 61834b128784e3865f69d0f41efcfe44
SHA1 88c867b09122b4e93a00cc033030a02110deb42a
SHA512 f2874cbb7f11a6fa39c5603af1a0ee71fd29136336eb0ff9cc621356112db26015bb79a524fd9bc9c9f2dc6cf22822272ce65a09928d23efa019b6db0a611917
MD5 SHA1 SHA512

Submit Download

primary.prof

Path /data/misc/profiles/cur/0/org.zzzz.aaa/primary.prof
Size 2KB
SHA256 839f9df39ba84c771138cb14ea220ccc83ef250d7c3e7ac518035ad0dc75181e
MD5 de212f927530e48da66daaf622705374
SHA1 2ca3348bd4833a44018ab07fc4c33a92fb60e119
SHA512 c937d31ca46ffc768596745d8bb1aa07a88acefbf8e18130855ab58e947da9f72ccb124b908934d83ec141608937049d29f1c8bcf19239c584cc24558dd6845e
MD5 SHA1 SHA512

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads