b6f6e233d6a649243d511d14e445c9a7719951e2a90df5e2498e23b19bea4931

Analysis

max time kernel
135s
max time network
171s
platform
android_x86
resource
android-x86-arm-20240514-en
resource tags

androidarch:armarch:x86image:android-x86-arm-20240514-enlocale:en-usos:android-9-x86system
submitted
01/06/2024, 00:43

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
b6f6e233d6a649243d511d14e445c9a7719951e2a90df5e2498e23b19bea4931.apk
Size 2.0MB
Sample240601-a28bdscc75
SHA256 b6f6e233d6a649243d511d14e445c9a7719951e2a90df5e2498e23b19bea4931
MD5 13eb2cbf45abf4727a1a2370f5bbe58a
SHA1 ecedb7cc5622f1868fe05157250428e25c79f60c
SHA512 9e2bd2cf3dc2ec4493fc710b2ee6a7396149350e1782086cd945c3dcb617d68bd5b0ada5e6130afefa788a6900b88d3d9e80cd3e127b3cc34125a641dbb117f7
SSDEEP 49152:rY109ZGSkJkBXBzBnDjpCEKPl+1JSNkIiWU:Z8R+hNBDFANkI2
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

collection credential_access evasion

Malware Config

Signatures

Makes use of the framework's Accessibility service 4 TTPs 2 IoCs

Retrieves information displayed on the phone screen using AccessibilityService.

collection evasion credential_access

Input Injection

T1516

Screen Capture

T1513

Keylogging

T1417.001

GUI Input Capture

T1417.002

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByText	org.zzzz.aaa
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	org.zzzz.aaa

org.zzzz.aaa
1⤵
- Makes use of the framework's Accessibility service
PID:4254

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Input Injection

T1516

Credential Access

Input Capture

T1417

GUI Input Capture

T1417.002

Keylogging

T1417.001

Discovery

Lateral Movement

Collection

Input Capture

T1417

GUI Input Capture

T1417.002

Keylogging

T1417.001

Screen Capture

T1513

Command and Control

Exfiltration

Impact

Input Injection

T1516

Replay Monitor

Loading Replay Monitor...

Downloads

profileInstalled

Path /data/data/org.zzzz.aaa/files/profileInstalled
Size 24B
SHA256 103b3c4e4eb95de1b9caa46a3068c65504798265a71754e8cd87e74fb585e821
MD5 6d536ecced5bab42849ba911ada26207
SHA1 129adebe34e7de361f4d5bc7114a02dea0356aa2
SHA512 b7d0842139bc05b24ff7a1e45bed877f4135e752bc347896d096537d16ad2ac02edc9ad377aa713b5eaffc0a6c4e8f61b4b9e29d61b1752c8d51450cb8850363
MD5 SHA1 SHA512

Submit Download

profileinstaller_profileWrittenFor_lastUpdateTime.dat

Path /data/data/org.zzzz.aaa/files/profileinstaller_profileWrittenFor_lastUpdateTime.dat
Size 8B
SHA256 1e1be45a82007afd6bca8e593a8e2c966d87948b0e9402736151d589181ffd32
MD5 1bc31db91e9959a6e902d6af083f3426
SHA1 43470799afcfb2c40d1f423a9bd426f86ea946d8
SHA512 98974aef059bfaa4a5410160696240b8aa502cca50852aa7945f2ae7490a3b4d76dec1dea7621009b857d0cac191b3a75731c3f36321987a134da9239c171b01
MD5 SHA1 SHA512

Submit Download

primary.prof

Path /data/misc/profiles/cur/0/org.zzzz.aaa/primary.prof
Size 1KB
SHA256 789abb5147985951163bc9904401d6bc19259c39aa0a40acf63f7c60d5c7faad
MD5 02404711f306cc8b6f87ef8fd9bb359e
SHA1 9c32a98d6281bbd7fdb587325e8525660813cf4a
SHA512 1ab9380be8b99c933c18cf418d01de230b37aee600563a6dc96b9f7725877ce7bf2daee099ba273276b96bb730149823ec9273e80ffb0ca3bdc3db45e9b0186c
MD5 SHA1 SHA512

Submit Download

primary.prof

Path /data/misc/profiles/cur/0/org.zzzz.aaa/primary.prof
Size 2KB
SHA256 e2867c800b7789dd911f2289beac6672bd0d9e8e5f658ac0d1b191c61460f46c
MD5 f64a1a3df80bd16e1f7df44d5e68bd7d
SHA1 0df7e36382192a2b08ccba0fa7609fa1daadf052
SHA512 83834a16f112841a9a2d7b49b2ad90d3baaeda8a843118b8b42581810e0a56669ebf2cb27ed195fab7a257b47bb7515e99e6cf265795ee1eabca0c7fe8b3e1c5
MD5 SHA1 SHA512

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads