adc3fa82526d9da71c3992edc7733556ee6d6bbf2445a361d5498e877f4ef112

Analysis

max time kernel
153s
max time network
132s
platform
android_x64
resource
android-x64-arm64-20240514-en
resource tags

androidarch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20240514-enlocale:en-usos:android-11-x64system
submitted
28/05/2024, 22:04

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
adc3fa82526d9da71c3992edc7733556ee6d6bbf2445a361d5498e877f4ef112.apk
Size 1.8MB
Sample240528-1y2mjsfd59
SHA256 adc3fa82526d9da71c3992edc7733556ee6d6bbf2445a361d5498e877f4ef112
MD5 d1d02e63e60706bc0c7bfde238d3544d
SHA1 c3e3a9bb066df415008dc06c60bd7d0ded109ae0
SHA512 509a9ff768b935c630e24ffe6cc4ea0d411d89356d92f5c8fd87e12c2a2fc053e02c491dc82f41ec538ba4c4ef8675e7cea549d4599b2b900cdec2fbf8807a7d
SSDEEP 24576:ZY12kJCdvY2JiysXcCv1NuXL8VetCLdk2Rqbmb0A1zPlQNnjqoenxqAXjktRpMOq:ZY1P2dsX3CXQZK2Mc1zPlQNn+ElqtYnU
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

collection credential_access evasion

Malware Config

Signatures

Makes use of the framework's Accessibility service 4 TTPs 2 IoCs

Retrieves information displayed on the phone screen using AccessibilityService.

collection evasion credential_access

Input Injection

T1516

Screen Capture

T1513

Keylogging

T1417.001

GUI Input Capture

T1417.002

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	org.zzzz.aaa
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByText	org.zzzz.aaa

org.zzzz.aaa
1⤵
- Makes use of the framework's Accessibility service
PID:4651

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Input Injection

T1516

Credential Access

Input Capture

T1417

GUI Input Capture

T1417.002

Keylogging

T1417.001

Discovery

Lateral Movement

Collection

Input Capture

T1417

GUI Input Capture

T1417.002

Keylogging

T1417.001

Screen Capture

T1513

Command and Control

Exfiltration

Impact

Input Injection

T1516

Replay Monitor

Loading Replay Monitor...

Downloads

profileinstaller_profileWrittenFor_lastUpdateTime.dat

Path /data/data/org.zzzz.aaa/files/profileinstaller_profileWrittenFor_lastUpdateTime.dat
Size 8B
SHA256 bfacde6e167312fcc5113b9aba50487cfa7597658c36b5af86b35f7a97ff0d80
MD5 1ccaefe04796a7afb7b2186fb596e146
SHA1 a784b17ec9a264d52d730081eea15e65396c0e59
SHA512 3c1fff690d6ce943e9ac16f9761f872c80ce23fa305e0bfea9c772b5202ef78156b844d3132ad6ae1e3da809b117fd6b359d799eb9191f45f2ef0e8be8fee2e6
MD5 SHA1 SHA512

Submit Download

primary.prof

Path /data/misc/profiles/cur/0/org.zzzz.aaa/primary.prof
Size 1KB
SHA256 fb39f614f14eb9d56c0a27cd7ab73d1cdea49b201ab416c105d7b1439e41e61a
MD5 d1cf5fe261434107aa92e0cee487cd2f
SHA1 784485b2ced2cf5549b2ffeb0fb457357b41abe0
SHA512 5e3d903fd892c9ab4635ea5348b6dcbee21977086fb58d82e1af4e0e9a47c80b49c479d41af46afbf7d8c1f8ade88ff55986e643e2f9fb76eedbce2e2fed5803
MD5 SHA1 SHA512

Submit Download

primary.prof

Path /data/misc/profiles/cur/0/org.zzzz.aaa/primary.prof
Size 2KB
SHA256 5aa8489462ea7fe981d1204400c98c680ccce2af06c94104caa26fb4f3aa9611
MD5 27a2612d5c339c5aa0d2202f94146b27
SHA1 ee0a3dae56230a7b7f0f2a3b3855d731e4c35527
SHA512 9d19dc102a55ecdd43b5451b0c9f7e8c580b0b0eeed7529b85ff6e27928cdcb0349f7907ecae4943d1957240f48e5c1ea5174fc3dbd0d2440fc11ab0a06b46bc
MD5 SHA1 SHA512

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads