e699a8e7c8a84bb7eaaa13f349f8ebfc1b946c4e8ebfb7b4555afe8a3cee7003

Analysis

max time kernel
135s
max time network
131s
platform
android_x64
resource
android-x64-20240514-en
resource tags

androidarch:x64arch:x86image:android-x64-20240514-enlocale:en-usos:android-10-x64system
submitted
29/05/2024, 22:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
e699a8e7c8a84bb7eaaa13f349f8ebfc1b946c4e8ebfb7b4555afe8a3cee7003.apk
Size 1.8MB
Sample240529-2jk7padc99
SHA256 e699a8e7c8a84bb7eaaa13f349f8ebfc1b946c4e8ebfb7b4555afe8a3cee7003
MD5 5c5837dd79acd8b89296efb1f8aba61d
SHA1 8ba19fee58edb4fba97675b94ff336460a941c0b
SHA512 8aee014456ca42a2363b6dc481b32802e341b9d44d16954a22b56516365eda8a897cb1ecc562fd2bd3098b704e6e34e583d5ca5cdc416d1911176358016c83cf
SSDEEP 24576:QkY1EDOeWoq6bwpEBoy+BUeweFmn04EfevW9jYT5BGTEeIJEz+Hm3mp6SmUYy:DY16Woq68pES92elY69o+lgP
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

collection credential_access evasion

Malware Config

Signatures

Makes use of the framework's Accessibility service 4 TTPs 2 IoCs

Retrieves information displayed on the phone screen using AccessibilityService.

collection evasion credential_access

Input Injection

T1516

Screen Capture

T1513

Keylogging

T1417.001

GUI Input Capture

T1417.002

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	org.zzzz.aaa
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByText	org.zzzz.aaa

org.zzzz.aaa
1⤵
- Makes use of the framework's Accessibility service
PID:5113

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Input Injection

T1516

Credential Access

Input Capture

T1417

GUI Input Capture

T1417.002

Keylogging

T1417.001

Discovery

Lateral Movement

Collection

Input Capture

T1417

GUI Input Capture

T1417.002

Keylogging

T1417.001

Screen Capture

T1513

Command and Control

Exfiltration

Impact

Input Injection

T1516

Replay Monitor

Loading Replay Monitor...

Downloads

profileInstalled

Path /data/data/org.zzzz.aaa/files/profileInstalled
Size 24B
SHA256 a81637d338b0eef798e53eb111a51b4651b9246fd096e8a67673ac15c42feba3
MD5 6fb19e3ea4fe63347ad2be3e7102b0c5
SHA1 adaefdf3e688664d3a507772b34b53e047612642
SHA512 39b6a14d385ec39e5aa4910901049770da719c9318e748cdcaeef29881fd62032dbaea599ffdc8288c5ea123c12eb6ad0e678e7414c88369e7f240ebe8c4b8d2
MD5 SHA1 SHA512

Submit Download

profileinstaller_profileWrittenFor_lastUpdateTime.dat

Path /data/data/org.zzzz.aaa/files/profileinstaller_profileWrittenFor_lastUpdateTime.dat
Size 8B
SHA256 b8ce7e91ef86f0960651c5f3b9eefcbdd240474a4d88062a5aa43ed2f4c4734a
MD5 9dfb3c25d3ae7cc340757bab2e5ccf05
SHA1 354dda6f42d857da144bb1329d51331bb30adf44
SHA512 7b4fe5185ae4bd7d6726eca0fc836fe4e873f19eb5302d9d08663b355c7ce0afd9eb7c45f8bb56be6b34705acc7d84b68fc1674c2514e874d73b04b52fd5f133
MD5 SHA1 SHA512

Submit Download

primary.prof

Path /data/misc/profiles/cur/0/org.zzzz.aaa/primary.prof
Size 1KB
SHA256 438964d0413cb75595ae13477c7b90c4ad223997b424e79657f55be0377e48b3
MD5 a748743a4a1865119fb0ca62a264ec1a
SHA1 aefc6634bf43e2d6be5eb19cd8c84b684fd1d26a
SHA512 0a9501bd5e22d147e15402816f96a8d81e814fd5cd1df4fee4215a39478929055f79f655bf09aed9588f3e7b5f4b529115fae12e7391ab19bdf63af0ed809a35
MD5 SHA1 SHA512

Submit Download

primary.prof

Path /data/misc/profiles/cur/0/org.zzzz.aaa/primary.prof
Size 2KB
SHA256 ad949adc0813930e71846d4aa26d402c9693d0429489b787377f188a38d79e0f
MD5 74b2f7bddeded5ab777a7b9d3c802769
SHA1 5755cad09615887999ddeaf7d42722236347c8da
SHA512 7b30f74b9141041af2d3d4317bbd149b32181826abe1dc281832db93a4a514a6fc4dae7c2704d9e0b5be604ae461a2bcf278c66d22c6cfc12388daf89906f5e6
MD5 SHA1 SHA512

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads