b6f6e233d6a649243d511d14e445c9a7719951e2a90df5e2498e23b19bea4931

Analysis

max time kernel
136s
max time network
134s
platform
android_x64
resource
android-x64-20240514-en
resource tags

androidarch:x64arch:x86image:android-x64-20240514-enlocale:en-usos:android-10-x64system
submitted
01/06/2024, 00:43

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
b6f6e233d6a649243d511d14e445c9a7719951e2a90df5e2498e23b19bea4931.apk
Size 2.0MB
Sample240601-a28bdscc75
SHA256 b6f6e233d6a649243d511d14e445c9a7719951e2a90df5e2498e23b19bea4931
MD5 13eb2cbf45abf4727a1a2370f5bbe58a
SHA1 ecedb7cc5622f1868fe05157250428e25c79f60c
SHA512 9e2bd2cf3dc2ec4493fc710b2ee6a7396149350e1782086cd945c3dcb617d68bd5b0ada5e6130afefa788a6900b88d3d9e80cd3e127b3cc34125a641dbb117f7
SSDEEP 49152:rY109ZGSkJkBXBzBnDjpCEKPl+1JSNkIiWU:Z8R+hNBDFANkI2
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

collection credential_access evasion

Malware Config

Signatures

Makes use of the framework's Accessibility service 4 TTPs 2 IoCs

Retrieves information displayed on the phone screen using AccessibilityService.

collection evasion credential_access

Input Injection

T1516

Screen Capture

T1513

Keylogging

T1417.001

GUI Input Capture

T1417.002

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	org.zzzz.aaa
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByText	org.zzzz.aaa

org.zzzz.aaa
1⤵
- Makes use of the framework's Accessibility service
PID:5110

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Input Injection

T1516

Credential Access

Input Capture

T1417

GUI Input Capture

T1417.002

Keylogging

T1417.001

Discovery

Lateral Movement

Collection

Input Capture

T1417

GUI Input Capture

T1417.002

Keylogging

T1417.001

Screen Capture

T1513

Command and Control

Exfiltration

Impact

Input Injection

T1516

Replay Monitor

Loading Replay Monitor...

Downloads

profileInstalled

Path /data/data/org.zzzz.aaa/files/profileInstalled
Size 24B
SHA256 48cc6abe744694e96929b1df1047ee1d63a1184f8a06a6005a7740eb424fc612
MD5 41d56e7e190fdb32c64845f040c8b2a9
SHA1 e010f0448116fb0e58d966fe34563fc42a80ecde
SHA512 dd1523693295929d5b58860f474950d60fd62a3dc6d42b4c4c581877f15f694d7b6acd2cd04a8f7afbbadf765938d1c4b7b49f373a10500032e5c524bec403b7
MD5 SHA1 SHA512

Submit Download

profileinstaller_profileWrittenFor_lastUpdateTime.dat

Path /data/data/org.zzzz.aaa/files/profileinstaller_profileWrittenFor_lastUpdateTime.dat
Size 8B
SHA256 9c0e90c74f1c2986fdd010b5200a68db9e0454a7e553ace736840ac601e94f55
MD5 afe5ac60ef83ed0be8951bfee20d1fb1
SHA1 003f6b92610f67557d72a7ec8f0a0bc573e4daee
SHA512 1f6c6f915e2889aa21ce0d83543d8112327d0fc4413376ef4588aea08f0a703e1d3d3b671c77d29377f2c82333877ee3c70c10d9379a1848d89dff9e7b7d4dd6
MD5 SHA1 SHA512

Submit Download

primary.prof

Path /data/misc/profiles/cur/0/org.zzzz.aaa/primary.prof
Size 1KB
SHA256 789abb5147985951163bc9904401d6bc19259c39aa0a40acf63f7c60d5c7faad
MD5 02404711f306cc8b6f87ef8fd9bb359e
SHA1 9c32a98d6281bbd7fdb587325e8525660813cf4a
SHA512 1ab9380be8b99c933c18cf418d01de230b37aee600563a6dc96b9f7725877ce7bf2daee099ba273276b96bb730149823ec9273e80ffb0ca3bdc3db45e9b0186c
MD5 SHA1 SHA512

Submit Download

primary.prof

Path /data/misc/profiles/cur/0/org.zzzz.aaa/primary.prof
Size 2KB
SHA256 dac259f9b5edf4d7b092217790340fa681683bd1fd1b963d7351cab8da57a496
MD5 f435c8eadc785b8960865d1f828d663c
SHA1 2b2a8646c9e9f5457d7010c84a17982e69e487cb
SHA512 d147634b93da88463dea25a6e362313f44fce39d7d9a2fa759bb878d1a415c2d3f4fef6bc56c5ff5b90e69357fbf994cadd4bd52a88ec494cddbfcb056d8638d
MD5 SHA1 SHA512

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads