e699a8e7c8a84bb7eaaa13f349f8ebfc1b946c4e8ebfb7b4555afe8a3cee7003

Analysis

max time kernel
129s
max time network
132s
platform
android_x64
resource
android-x64-arm64-20240514-en
resource tags

androidarch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20240514-enlocale:en-usos:android-11-x64system
submitted
29/05/2024, 22:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
e699a8e7c8a84bb7eaaa13f349f8ebfc1b946c4e8ebfb7b4555afe8a3cee7003.apk
Size 1.8MB
Sample240529-2jk7padc99
SHA256 e699a8e7c8a84bb7eaaa13f349f8ebfc1b946c4e8ebfb7b4555afe8a3cee7003
MD5 5c5837dd79acd8b89296efb1f8aba61d
SHA1 8ba19fee58edb4fba97675b94ff336460a941c0b
SHA512 8aee014456ca42a2363b6dc481b32802e341b9d44d16954a22b56516365eda8a897cb1ecc562fd2bd3098b704e6e34e583d5ca5cdc416d1911176358016c83cf
SSDEEP 24576:QkY1EDOeWoq6bwpEBoy+BUeweFmn04EfevW9jYT5BGTEeIJEz+Hm3mp6SmUYy:DY16Woq68pES92elY69o+lgP
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

collection credential_access evasion

Malware Config

Signatures

Makes use of the framework's Accessibility service 4 TTPs 2 IoCs

Retrieves information displayed on the phone screen using AccessibilityService.

collection evasion credential_access

Input Injection

T1516

Screen Capture

T1513

Keylogging

T1417.001

GUI Input Capture

T1417.002

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	org.zzzz.aaa
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByText	org.zzzz.aaa

org.zzzz.aaa
1⤵
- Makes use of the framework's Accessibility service
PID:4624

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Input Injection

T1516

Credential Access

Input Capture

T1417

GUI Input Capture

T1417.002

Keylogging

T1417.001

Discovery

Lateral Movement

Collection

Input Capture

T1417

GUI Input Capture

T1417.002

Keylogging

T1417.001

Screen Capture

T1513

Command and Control

Exfiltration

Impact

Input Injection

T1516

Replay Monitor

Loading Replay Monitor...

Downloads

profileinstaller_profileWrittenFor_lastUpdateTime.dat

Path /data/data/org.zzzz.aaa/files/profileinstaller_profileWrittenFor_lastUpdateTime.dat
Size 8B
SHA256 fd8025b5e283a40b413ebb8fa59d8b4ab3aa1590ae0d66272f82f7a92fb6e4d0
MD5 17336e7d541c48b01cbc7125787c0679
SHA1 7b3b7c637ec3702e3059fa4799b1d71c588c6f03
SHA512 e74f37e24e117541260499ecec5329f9f17412032c044583c2cbde04e5fb631a9b5b12c409d4fdf836fb3d13a7bc2eee96eaed2f3495f7680a4e4871537b1e82
MD5 SHA1 SHA512

Submit Download

primary.prof

Path /data/misc/profiles/cur/0/org.zzzz.aaa/primary.prof
Size 1KB
SHA256 438964d0413cb75595ae13477c7b90c4ad223997b424e79657f55be0377e48b3
MD5 a748743a4a1865119fb0ca62a264ec1a
SHA1 aefc6634bf43e2d6be5eb19cd8c84b684fd1d26a
SHA512 0a9501bd5e22d147e15402816f96a8d81e814fd5cd1df4fee4215a39478929055f79f655bf09aed9588f3e7b5f4b529115fae12e7391ab19bdf63af0ed809a35
MD5 SHA1 SHA512

Submit Download

primary.prof

Path /data/misc/profiles/cur/0/org.zzzz.aaa/primary.prof
Size 2KB
SHA256 325bac65791206312f3190c687732bc3dd0df862e94cda9bf676bf541b896531
MD5 aaeaf51e90b256ac4c11f05385ff0929
SHA1 7a2c5370503841445031d24fb0766d11b85f8591
SHA512 38b323976684280c2454454e841cee654ef36a009e4e6e541553791c60523965948b454deabaab4b49aa03737382b3ee562a5ddbe08f7d9dd40a0248e421b666
MD5 SHA1 SHA512

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads