1b71541ec78717479d02a0763d21d7f78ee87453c6c6c7fa99c713cbab0b9b2a

Analysis

max time kernel
127s
max time network
130s
platform
android_x64
resource
android-x64-20240514-en
resource tags

androidarch:x64arch:x86image:android-x64-20240514-enlocale:en-usos:android-10-x64system
submitted
29/05/2024, 22:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
1b71541ec78717479d02a0763d21d7f78ee87453c6c6c7fa99c713cbab0b9b2a.apk
Size 1.8MB
Sample240529-11fsvscd75
SHA256 1b71541ec78717479d02a0763d21d7f78ee87453c6c6c7fa99c713cbab0b9b2a
MD5 76b4479e7fd9467d1e7ec7b311f70902
SHA1 9a8d8b249b105abf7aab06b01bafdd3f5020eab4
SHA512 24a0da460e90da3c1396bf448a1498ef879ffc2dfb97772bc4da7b8c41d2170e696446fd57d856c62ebdf4a2ffe697f41f80d8c5f274e578dd745baccc59fcbb
SSDEEP 24576:5bY1RZLEhhSTvjH11kJub+9RLpR9caZQ9bp1xWdkuDE5Uwh+Pj2OeHiKncvRIMDf:RY1RPp1kJY0RLpR0bTE1EPh+Pz5RbH
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

collection credential_access evasion

Malware Config

Signatures

Makes use of the framework's Accessibility service 4 TTPs 2 IoCs

Retrieves information displayed on the phone screen using AccessibilityService.

collection evasion credential_access

Input Injection

T1516

Screen Capture

T1513

Keylogging

T1417.001

GUI Input Capture

T1417.002

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	org.zzzz.aaa
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByText	org.zzzz.aaa

org.zzzz.aaa
1⤵
- Makes use of the framework's Accessibility service
PID:5148

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Input Injection

T1516

Credential Access

Input Capture

T1417

GUI Input Capture

T1417.002

Keylogging

T1417.001

Discovery

Lateral Movement

Collection

Input Capture

T1417

GUI Input Capture

T1417.002

Keylogging

T1417.001

Screen Capture

T1513

Command and Control

Exfiltration

Impact

Input Injection

T1516

Replay Monitor

Loading Replay Monitor...

Downloads

profileInstalled

Path /data/data/org.zzzz.aaa/files/profileInstalled
Size 24B
SHA256 98573922d5d96256d8e472feb2205b0c483a1c1d767e959ca0734b7af47618ca
MD5 5a709d783fa29d38fe205800c64f9574
SHA1 6736d5206f802052216e840125aebc1b3ae60633
SHA512 d69a91481ffc3a3f19c9f0b74be23d4fc43f768b11ae2d725b07dcacfa5828169bf32b15accba1366903094c4fe23b41377843d8fcfb44745c9ff5fc3dfbaf45
MD5 SHA1 SHA512

Submit Download

profileinstaller_profileWrittenFor_lastUpdateTime.dat

Path /data/data/org.zzzz.aaa/files/profileinstaller_profileWrittenFor_lastUpdateTime.dat
Size 8B
SHA256 6e72f009ade357bbe7f2858b76e503c6bc31f927aff981d3f4ae8dedc34df8bb
MD5 7a98e293a965c6b9c608e3363d9fd763
SHA1 a4bc916a3235f87e9a6af1c8ce663671754093ca
SHA512 e716202892b3b8c695d5dc7bf0f0f0afdc2aaf49a77c6ce966ed77a13c9795315c25df918e8ec3cd4bd1f02f5e32be6ef6af778805723993baa719c80d348842
MD5 SHA1 SHA512

Submit Download

primary.prof

Path /data/misc/profiles/cur/0/org.zzzz.aaa/primary.prof
Size 1KB
SHA256 47ddab04b5b8fc724300c51e0a64e67da82a095ae0508efe71f420668b8f8779
MD5 60a82bbb9a59b92fbac90d2931dc966e
SHA1 b144521a14b998367f992a8f1c9308c12801b02b
SHA512 70beac49b104532f9eb88e0553f299f096849c18733ae830766cd76d8d13d909bf7bbe5ac5519568ae4341743c5c8c5b3716fe5cac5f401eb1e04f2dff1846cc
MD5 SHA1 SHA512

Submit Download

primary.prof

Path /data/misc/profiles/cur/0/org.zzzz.aaa/primary.prof
Size 2KB
SHA256 e5bdd0346ed4de468765019ff53e81fe12c29898624ddd873ea5b78b0b461547
MD5 3efb7c3baefda4b3537c3e651dc2cd34
SHA1 b39eb19062c39c2f5d782033d1fb7f307c142364
SHA512 ca9d18d6ba3d5d13c0734a114a21320274ce117ad613eef68549b3512591ad777c3d2c928e4823f3de942cf9ce575f8cf54e20cd4495aa5b2ae84ba827d5120c
MD5 SHA1 SHA512

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads