a9827c18d738273b34d5271c4cedea19b3cc326827a61317471aa1593515e626

Analysis

max time kernel
151s
max time network
131s
platform
android_x64
resource
android-x64-20240514-en
resource tags

androidarch:x64arch:x86image:android-x64-20240514-enlocale:en-usos:android-10-x64system
submitted
29/05/2024, 22:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
a9827c18d738273b34d5271c4cedea19b3cc326827a61317471aa1593515e626.apk
Size 1.8MB
Sample240529-2c8z6scc2s
SHA256 a9827c18d738273b34d5271c4cedea19b3cc326827a61317471aa1593515e626
MD5 641ed114e6ac968c313a31cdc5832ba2
SHA1 9700843207ae0403cce9cd2379935d9161e1e09a
SHA512 07d118d50bb7ee2dc9a40f8e4628bf6cf810c6de25409200f977e9c4f747917dfce11954e41a58bd098ea6f680042638e80a0662de687459325796e447aa3800
SSDEEP 24576:4ZY1gWmvr5S2A0A+XJpmvie7LJzfBfw7NW5u/V0XDtYf98zjkRcv9oxizNpM9ozV:CY13EyZ1Ssu/VkmiN3nDR
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

collection credential_access evasion

Malware Config

Signatures

Makes use of the framework's Accessibility service 4 TTPs 2 IoCs

Retrieves information displayed on the phone screen using AccessibilityService.

collection evasion credential_access

Input Injection

T1516

Screen Capture

T1513

Keylogging

T1417.001

GUI Input Capture

T1417.002

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	org.zzzz.aaa
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByText	org.zzzz.aaa

org.zzzz.aaa
1⤵
- Makes use of the framework's Accessibility service
PID:5103

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Input Injection

T1516

Credential Access

Input Capture

T1417

GUI Input Capture

T1417.002

Keylogging

T1417.001

Discovery

Lateral Movement

Collection

Input Capture

T1417

GUI Input Capture

T1417.002

Keylogging

T1417.001

Screen Capture

T1513

Command and Control

Exfiltration

Impact

Input Injection

T1516

Replay Monitor

Loading Replay Monitor...

Downloads

profileInstalled

Path /data/data/org.zzzz.aaa/files/profileInstalled
Size 24B
SHA256 65d39e899361effc3d5b83e1eeb8945c8687ac2f7491ab9d75ec3b67dd16f9c5
MD5 74c1283cc27d325f0d863bcce4cdfd5d
SHA1 9b55be39100a4fd3c07ddcd6f5cdaa84d0c7181b
SHA512 22cbb405a9a861ed90a4e3906fcfbd23978e8e04bd3d7cf6b40696871dd4fe43435fe5166b16e6defb24e3a2195d1bb57382ade1248d50e07926842753a6e228
MD5 SHA1 SHA512

Submit Download

profileinstaller_profileWrittenFor_lastUpdateTime.dat

Path /data/data/org.zzzz.aaa/files/profileinstaller_profileWrittenFor_lastUpdateTime.dat
Size 8B
SHA256 15c7169afe7d19e86fc1dada2f36b1aa35a9c8b7e920934c57ce6e383d738445
MD5 beca6c39b46b2e18c9d234a683825b6c
SHA1 b731347fa2ace453976a72fa34e6e12ceb0dfbaa
SHA512 efb8ef53b7a4e5884fe726b5fe71361532e48025dec537089eb5d5049529c4a267e7a273ed4c1fbb65e3a57aa40445798e864a17c8aeb9fdd1ab16cb24787c7e
MD5 SHA1 SHA512

Submit Download

primary.prof

Path /data/misc/profiles/cur/0/org.zzzz.aaa/primary.prof
Size 1KB
SHA256 86f9a61489d45d9d7ddf6efadfff3ae7b186c36e10ef54498dfe69207c122ea6
MD5 a6fb3b32c632bf32850744b6dfc946d0
SHA1 af4337740d106d0e098eb2520e50629c0b7e66d7
SHA512 e6958e91e8ee334d9431885b696081b6ee37778d183d6f47cd3184226bfe6042ca43c7f4393d7a5950d7ad565ecf910b9ecb1b368b8e3dd5c5485bae9d6b1199
MD5 SHA1 SHA512

Submit Download

primary.prof

Path /data/misc/profiles/cur/0/org.zzzz.aaa/primary.prof
Size 2KB
SHA256 e7b57a757c5e42449058a13758e9019e698478317c4eee3d0f9ffc51544ed43d
MD5 ed86d78cf1edb9ebcd26016687cdc151
SHA1 80b7c395c82850e23d9b74d67571bce378adfbc8
SHA512 5ce150e84573b8913edd27ef82228d2f58ad92457e612d806a40a393c3a9cb24e3bb2b16317d3a9cf47a7c38a3c22524cf02a050671f37a7e63d16d8b328fe8a
MD5 SHA1 SHA512

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads