934ff87f7bd751327e4ba8b9048987761dede4f1d794cf8d4d007a5de71bf0d0

Analysis

max time kernel
131s
max time network
153s
platform
android_x64
resource
android-x64-20240514-en
resource tags

androidarch:x64arch:x86image:android-x64-20240514-enlocale:en-usos:android-10-x64system
submitted
29/05/2024, 22:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
934ff87f7bd751327e4ba8b9048987761dede4f1d794cf8d4d007a5de71bf0d0.apk
Size 1.7MB
Sample240529-2hezaadc57
SHA256 934ff87f7bd751327e4ba8b9048987761dede4f1d794cf8d4d007a5de71bf0d0
MD5 ce31dacf70c43d28ac8fedc38242ec11
SHA1 0b38c1dfc911a914d276b450b52f3e4422295b08
SHA512 10b55443fc4b19a4fb52100e7e5d7110d7b021e49814bd594a352cce41f54b8e2e93f0aa8d04a727eb7710f6ddba9694e1653634d2f8e7369890a73ac75b6074
SSDEEP 24576:SjY1i/qEIJCRK/Izd2GPMp3aHBWF2KGhSNzasjnCsJq+gmA9d/bnv/hvgr:SjY1RCRK/I/waHBMrXrMgI/m
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

collection credential_access evasion

Malware Config

Signatures

Makes use of the framework's Accessibility service 4 TTPs 2 IoCs

Retrieves information displayed on the phone screen using AccessibilityService.

collection evasion credential_access

Input Injection

T1516

Screen Capture

T1513

Keylogging

T1417.001

GUI Input Capture

T1417.002

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	org.zzzz.aaa
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByText	org.zzzz.aaa

org.zzzz.aaa
1⤵
- Makes use of the framework's Accessibility service
PID:5087

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Input Injection

T1516

Credential Access

Input Capture

T1417

GUI Input Capture

T1417.002

Keylogging

T1417.001

Discovery

Lateral Movement

Collection

Input Capture

T1417

GUI Input Capture

T1417.002

Keylogging

T1417.001

Screen Capture

T1513

Command and Control

Exfiltration

Impact

Input Injection

T1516

Replay Monitor

Loading Replay Monitor...

Downloads

profileInstalled

Path /data/data/org.zzzz.aaa/files/profileInstalled
Size 24B
SHA256 6dcd7c557b4cbf0e0685a76d3b2d4338d6561b95117b28661e360ff122cce3d5
MD5 c3cc97e7b08648690e196bf50c164ca4
SHA1 9db2f54999099e846396af3d092176c86730f597
SHA512 5f8f5d5f1e617267579cf120682989ef381b2f57328a65e5e5feb21645da232153541754ebb5c3856b04aac17a65e38eda392ff88177bc54dba1a32641882d60
MD5 SHA1 SHA512

Submit Download

profileinstaller_profileWrittenFor_lastUpdateTime.dat

Path /data/data/org.zzzz.aaa/files/profileinstaller_profileWrittenFor_lastUpdateTime.dat
Size 8B
SHA256 9f8e164ddb2e7071f3b3c01d2e39d7fe0f5d1cbb2d23b1a8fa10d23ccd73b49f
MD5 eb284d017bbfc4dcb0d80b86d1f2c70f
SHA1 1628378cc800839289e1cbbbbfea451da1a26a52
SHA512 648a431b388c12e79758340acfcea407295b5a5d8d6c9acef30aae8ea892a6e84552a1aa9cc5125bf6af3b82e6a2ac9654e8dfa441a389cb2df2ce9bc9301e18
MD5 SHA1 SHA512

Submit Download

primary.prof

Path /data/misc/profiles/cur/0/org.zzzz.aaa/primary.prof
Size 1KB
SHA256 f29219c7364ea2e484b5a16e52477edb71eee06b5053dabc6fc43cb00566b734
MD5 0d340d1e34598082d0c10c62e4def629
SHA1 7fcb71fc24ccabbd0e710c62ad048afc6273dd22
SHA512 fcc54f3e9cdfd91885aef013e8a08f021cd8497a30aaa61b40adaa3d55b4285128fcc533c4d0e73b0a37a6b34a9654b5d937a5dc296b27a8ccbb98ca0d56ea8a
MD5 SHA1 SHA512

Submit Download

primary.prof

Path /data/misc/profiles/cur/0/org.zzzz.aaa/primary.prof
Size 2KB
SHA256 3ccfc6a92ca57f7468be0c6ce4b549bd5448b137ae813653d5aa73dd6c9febbc
MD5 1d9b91d2f3856be74f2bf10202737ec4
SHA1 f8dd378655e80f23727d1aaca4b8ff6589f4e22a
SHA512 6fe72617dc505a6f2c82010fa83a2dfd81bdc824dc38afad631bafa1b3b168dd342dc53f76e9cb17831b7020d359f2ce8396f2956439df4507f7f43ef863b60f
MD5 SHA1 SHA512

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads