b6f6e233d6a649243d511d14e445c9a7719951e2a90df5e2498e23b19bea4931

Analysis

max time kernel
134s
max time network
132s
platform
android_x64
resource
android-x64-arm64-20240514-en
resource tags

androidarch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20240514-enlocale:en-usos:android-11-x64system
submitted
01/06/2024, 00:43

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
b6f6e233d6a649243d511d14e445c9a7719951e2a90df5e2498e23b19bea4931.apk
Size 2.0MB
Sample240601-a28bdscc75
SHA256 b6f6e233d6a649243d511d14e445c9a7719951e2a90df5e2498e23b19bea4931
MD5 13eb2cbf45abf4727a1a2370f5bbe58a
SHA1 ecedb7cc5622f1868fe05157250428e25c79f60c
SHA512 9e2bd2cf3dc2ec4493fc710b2ee6a7396149350e1782086cd945c3dcb617d68bd5b0ada5e6130afefa788a6900b88d3d9e80cd3e127b3cc34125a641dbb117f7
SSDEEP 49152:rY109ZGSkJkBXBzBnDjpCEKPl+1JSNkIiWU:Z8R+hNBDFANkI2
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

collection credential_access evasion

Malware Config

Signatures

Makes use of the framework's Accessibility service 4 TTPs 2 IoCs

Retrieves information displayed on the phone screen using AccessibilityService.

collection evasion credential_access

Input Injection

T1516

Screen Capture

T1513

Keylogging

T1417.001

GUI Input Capture

T1417.002

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	org.zzzz.aaa
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByText	org.zzzz.aaa

org.zzzz.aaa
1⤵
- Makes use of the framework's Accessibility service
PID:4513

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Input Injection

T1516

Credential Access

Input Capture

T1417

GUI Input Capture

T1417.002

Keylogging

T1417.001

Discovery

Lateral Movement

Collection

Input Capture

T1417

GUI Input Capture

T1417.002

Keylogging

T1417.001

Screen Capture

T1513

Command and Control

Exfiltration

Impact

Input Injection

T1516

Replay Monitor

Loading Replay Monitor...

Downloads

profileinstaller_profileWrittenFor_lastUpdateTime.dat

Path /data/data/org.zzzz.aaa/files/profileinstaller_profileWrittenFor_lastUpdateTime.dat
Size 8B
SHA256 a1f62a528a609fba5dd4927dca8b6c6df33aed7b22316336758ea529c57a1efb
MD5 d7424461f43533af71bd922ea34320cc
SHA1 37473412288597349fd9092527f5aa56a94d7640
SHA512 bdcd9144245079b3c96ddf591e761ea9406018d0eea0b7f03bc9777b3c3a78f46dfd3071a0b8d3ce290a8cf6a50066621c6b1f8180525065c597bf206c0e168b
MD5 SHA1 SHA512

Submit Download

primary.prof

Path /data/misc/profiles/cur/0/org.zzzz.aaa/primary.prof
Size 1KB
SHA256 789abb5147985951163bc9904401d6bc19259c39aa0a40acf63f7c60d5c7faad
MD5 02404711f306cc8b6f87ef8fd9bb359e
SHA1 9c32a98d6281bbd7fdb587325e8525660813cf4a
SHA512 1ab9380be8b99c933c18cf418d01de230b37aee600563a6dc96b9f7725877ce7bf2daee099ba273276b96bb730149823ec9273e80ffb0ca3bdc3db45e9b0186c
MD5 SHA1 SHA512

Submit Download

primary.prof

Path /data/misc/profiles/cur/0/org.zzzz.aaa/primary.prof
Size 2KB
SHA256 54ae44237b67035ae4de8208e56fd32700a1a9574f08d5718fb9b0587363fe58
MD5 91ad9a9fc0186db17040adb59f0db661
SHA1 0441b80457b63b63e54d632b01d124f7c6a6cfa3
SHA512 4b1835f6c34555ab16a0a584529c3ce2dbfa36de7fa22a7f310c92502bed1e2ed26dabebc521637e41314a25e08ba37d40c0ac4cfa3e2900b269cf6588131385
MD5 SHA1 SHA512

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads