936c7be87d75d6bfa436f2e9517169043e4be71822fb7f0f90216571fb4e7903

Analysis

max time kernel
150s
max time network
159s
platform
android_x86
resource
android-x86-arm-20240514-en
resource tags

androidarch:armarch:x86image:android-x86-arm-20240514-enlocale:en-usos:android-9-x86system
submitted
28/05/2024, 22:04

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

936c7be87d75d6bfa436f2e9517169043e4be71822fb7f0f90216571fb4e7903.apk
Size

1.8MB
MD5

766b4c49ba47d39f7ffaea3c11b61c3c
SHA1

92346b7060aa550cf788d42f49ea6205ea5bbc8a
SHA256

936c7be87d75d6bfa436f2e9517169043e4be71822fb7f0f90216571fb4e7903
SHA512

4f869b4398d596f6a60489e58d3bdc7ce50a52899dd952a2c0fe7ac3ee2900ee8198b333f4a723b3aecba5b85ea126cb60d1fccc71329efd5f2b3839801a19df
SSDEEP

49152:EY1fpzKmFgwOJrn9bDJae9AuzPlQNnVAczb:RpHOBn5JD9AuzPlAJ

Score

8^/10

collection credential_access evasion

Malware Config

Signatures

Makes use of the framework's Accessibility service 4 TTPs 2 IoCs

Retrieves information displayed on the phone screen using AccessibilityService.

collection evasion credential_access

Input Injection

T1516

Screen Capture

T1513

Keylogging

T1417.001

GUI Input Capture

T1417.002

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	org.zzzz.aaa
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByText	org.zzzz.aaa

org.zzzz.aaa
1⤵
- Makes use of the framework's Accessibility service
PID:4331

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Input Injection

T1516

Credential Access

Input Capture

T1417

GUI Input Capture

T1417.002

Keylogging

T1417.001

Discovery

Lateral Movement

Collection

Input Capture

T1417

GUI Input Capture

T1417.002

Keylogging

T1417.001

Screen Capture

T1513

Command and Control

Exfiltration

Impact

Input Injection

T1516

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/org.zzzz.aaa/files/profileInstalled

Filesize
24B

MD5
e8f93dcfe51d5c40bd0a7039be0903be

SHA1
307e35527a92a0ada08ca63f7565c6b52932abf5

SHA256
022ea75a2fce0b67d503dbbe708d40c18d94a97c073e03303da3f537a3802970

SHA512
1fc9726335befa8045309ecab73af34fb8b850237f7ee2011a33c2bfa12f1605658bacccfd4f708b1164ceda38082794ed281fa732802eb04635fdcac496a9b8

Download Submit
/data/data/org.zzzz.aaa/files/profileinstaller_profileWrittenFor_lastUpdateTime.dat

Filesize
8B

MD5
c10f14ac5c7223d6e5a151716ba019c4

SHA1
c2690c4f6b06f47c3dd1747a0e730b0fa5399585

SHA256
bc50c07b884901176a8c19ef503cef704a370e92573b9da790b03103ce38eb1c

SHA512
3381c26993269b6ad322a16d5f30256ddb88a8ebee232e068136176cc3b9756373052270073a4e6657868340267c3c59d08c196207430a6517053ae803e3d83e

Download Submit
/data/misc/profiles/cur/0/org.zzzz.aaa/primary.prof

Filesize
1KB

MD5
ef04bf3cda9bd61562f05a2666374f5c

SHA1
b7d570408ea9e09be8565824b1ea2f2faaac29b6

SHA256
bf3aca4d94d96af292ba8f7bef623eaf0753948de1984eed58a234dd96c12c7f

SHA512
8a5d21bf352fe65a088fc4179cf51a62c5ce27f506b1aa1da5c688d162bace9af5ccec3dd811c5483cc1ab4b1c9ba41862826ae2264eeb78fba954537d9a11fb

Download Submit
/data/misc/profiles/cur/0/org.zzzz.aaa/primary.prof

Filesize
2KB

MD5
f3170f770cb9564819554d70bc13f074

SHA1
22713b28547d389c66e86d26b8be600c02062bf3

SHA256
061ff91facf069dd787e6f50fea1a6b26df9bcbaaab2623558efb4c0914c7dd9

SHA512
68ee2f8c425a40ac1dfe812b722521507d04e1aef269edbd9a94635f22cf2f3a3f467910711b106f77f89ce6c0d0fa53d6776b7078f70c7cc79101c6ad7ca624

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads