ecf87036b4b884e1e83b5b4fbac589795a9a1639ac6db56bd01b422cf1254cc6

Analysis

max time kernel
127s
max time network
132s
platform
android_x64
resource
android-x64-arm64-20240514-en
resource tags

androidarch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20240514-enlocale:en-usos:android-11-x64system
submitted
28/05/2024, 22:01

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ecf87036b4b884e1e83b5b4fbac589795a9a1639ac6db56bd01b422cf1254cc6.apk
Size 1.8MB
Sample240528-1xpllafc84
SHA256 ecf87036b4b884e1e83b5b4fbac589795a9a1639ac6db56bd01b422cf1254cc6
MD5 11c1e417187a7f1ba50091a9d7b4cc50
SHA1 7607c3c6a75b8127a498bb81a263dd9bc0aff659
SHA512 9244c7d5db3179a28ec41cde8b309d8d5a161b9b82a61278a8a4f23987c0bb413483d85cd2507a1a52e9c98a821caec1305b9c2bb1fc8f345c58518e14c6c039
SSDEEP 24576:vY1QPlesFZgdJUvpFXEmrsKxVI/HuQmEXqeaCWHbdmU7jfwGMvJuXK7TyWo2mKnf:vY1QNrfvp/xVhQmiqeaHJx7MRjP
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

collection credential_access evasion

Malware Config

Signatures

Makes use of the framework's Accessibility service 4 TTPs 2 IoCs

Retrieves information displayed on the phone screen using AccessibilityService.

collection evasion credential_access

Input Injection

T1516

Screen Capture

T1513

Keylogging

T1417.001

GUI Input Capture

T1417.002

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	org.zzzz.aaa
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByText	org.zzzz.aaa

org.zzzz.aaa
1⤵
- Makes use of the framework's Accessibility service
PID:4539

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Input Injection

T1516

Credential Access

Input Capture

T1417

GUI Input Capture

T1417.002

Keylogging

T1417.001

Discovery

Lateral Movement

Collection

Input Capture

T1417

GUI Input Capture

T1417.002

Keylogging

T1417.001

Screen Capture

T1513

Command and Control

Exfiltration

Impact

Input Injection

T1516

Replay Monitor

Loading Replay Monitor...

Downloads

profileinstaller_profileWrittenFor_lastUpdateTime.dat

Path /data/data/org.zzzz.aaa/files/profileinstaller_profileWrittenFor_lastUpdateTime.dat
Size 8B
SHA256 380656f745133240f12fb21287a7fccf4956f5a5f968f6eda76894ae24981788
MD5 89dea8df3c65d26fc43b8ee43eb62531
SHA1 169af23be4c3e73ce9bdea0dfe9b3bf848480cc9
SHA512 d8b29d77852b05d198c77d40b0c07510d00879dc2e3ca1e258e91a5498723728e7df0a0b19cc477ecbbfd1becbb3afad164bfea0520bb7378091aaffe6b4ad31
MD5 SHA1 SHA512

Submit Download

primary.prof

Path /data/misc/profiles/cur/0/org.zzzz.aaa/primary.prof
Size 1KB
SHA256 8b630caf2dc78da4f5a324d9005909e354ce5e039ea02b05e09e66268870f2bf
MD5 61834b128784e3865f69d0f41efcfe44
SHA1 88c867b09122b4e93a00cc033030a02110deb42a
SHA512 f2874cbb7f11a6fa39c5603af1a0ee71fd29136336eb0ff9cc621356112db26015bb79a524fd9bc9c9f2dc6cf22822272ce65a09928d23efa019b6db0a611917
MD5 SHA1 SHA512

Submit Download

primary.prof

Path /data/misc/profiles/cur/0/org.zzzz.aaa/primary.prof
Size 2KB
SHA256 f53dd43f1a3c5f8a0ed4f56456215a443b937087c9501adda957c91f1385d7ba
MD5 cffca57ff371441a8bb928c719f73639
SHA1 f75288f72d0f40728854258234706d53bde39c5e
SHA512 6c9ee5648756f1b3dc3e4feae229082517364f5266ae0538f7e636df0e6d6e0ece8f0bc84863f82fe7eef85691b2d94092850434928145b34902d491743a33a5
MD5 SHA1 SHA512

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads