6f9cc42849093e8127087b1695c7547937fb6c75542a2ce375833604aac68b56

Analysis

max time kernel
159s
max time network
131s
platform
android_x86
resource
android-x86-arm-20240514-en
resource tags

androidarch:armarch:x86image:android-x86-arm-20240514-enlocale:en-usos:android-9-x86system
submitted
01/06/2024, 00:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
6f9cc42849093e8127087b1695c7547937fb6c75542a2ce375833604aac68b56.apk
Size 1.7MB
Sample240601-aszynaba9x
SHA256 6f9cc42849093e8127087b1695c7547937fb6c75542a2ce375833604aac68b56
MD5 a54c1aca706145ba96925edd521aa71b
SHA1 6bdc2d220f5030b78f91fced29c7a3d77ce43e05
SHA512 3e445ce89c35b8b026028947a5bb7539ff6db6af8e6147272386c6f8e02748488441741c8a7e44c93bc93501ac73aa07ef20b56b08cf8f543960537db675001f
SSDEEP 24576:yTY1DPi34eDetkJ1LVySGwrDXVIdn0qEYE8VOnjzF771G0uzX5t5qZv8wBOuB:yTY1W5skJ144/qEYEwCfuDJwZ
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

collection credential_access evasion

Malware Config

Signatures

Makes use of the framework's Accessibility service 4 TTPs 2 IoCs

Retrieves information displayed on the phone screen using AccessibilityService.

collection evasion credential_access

Input Injection

T1516

Screen Capture

T1513

Keylogging

T1417.001

GUI Input Capture

T1417.002

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	org.zzzz.aaa
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByText	org.zzzz.aaa

org.zzzz.aaa
1⤵
- Makes use of the framework's Accessibility service
PID:4278

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Input Injection

T1516

Credential Access

Input Capture

T1417

GUI Input Capture

T1417.002

Keylogging

T1417.001

Discovery

Lateral Movement

Collection

Input Capture

T1417

GUI Input Capture

T1417.002

Keylogging

T1417.001

Screen Capture

T1513

Command and Control

Exfiltration

Impact

Input Injection

T1516

Replay Monitor

Loading Replay Monitor...

Downloads

profileInstalled

Path /data/data/org.zzzz.aaa/files/profileInstalled
Size 24B
SHA256 e6ae3248b8af60dafa3e82cba0d698c241fc1ae8cd1b4c1da8b92cd328845957
MD5 6046a11d2875042164c4d2d1d40187eb
SHA1 8ed6785087d075d6b00feed702c7052bb1d90810
SHA512 6fd81fafce5175fa0511cb07633331ce111dee9c72d6c5a9a419bdecf11f5b8ab99c780cbbd9eb30b4966a68ddc81459fe3bc5389fb5cf79854c1c8377df5d24
MD5 SHA1 SHA512

Submit Download

profileinstaller_profileWrittenFor_lastUpdateTime.dat

Path /data/data/org.zzzz.aaa/files/profileinstaller_profileWrittenFor_lastUpdateTime.dat
Size 8B
SHA256 49fba269454f07acbeb1cebdddf253ca68a3ea71a93a3849b8e0180a40e6b5d1
MD5 ad718087197759024a6bf10b141edffa
SHA1 5db03e42636e2062c933e23d20129d5660c95143
SHA512 738027a62ce4ff84c1a4df47e4824a91cebfea56b0ed9d0f9a34da34808c417c8b9db5080e8eab90129aa53daacdf84dca9d660ea3d77c4f311d0491c6b9d1c6
MD5 SHA1 SHA512

Submit Download

primary.prof

Path /data/misc/profiles/cur/0/org.zzzz.aaa/primary.prof
Size 1KB
SHA256 c0b92b907c16a8cefe4c1e3ede1077177336151f04c7d7397459a4ab7873afb3
MD5 5094b01be596982704b2a6e0caca8e14
SHA1 04340638fabdd1bccbcbbbc79d63425fbd9d24fb
SHA512 0726d59e672cdba2aeff3b77110125acc2a6f79b4b1f7dc3eb8be849be7baa7757b62d1b3899305ae0ec3460aac63427a5e080f134e6ff4136cb7e55deb2618d
MD5 SHA1 SHA512

Submit Download

primary.prof

Path /data/misc/profiles/cur/0/org.zzzz.aaa/primary.prof
Size 2KB
SHA256 c76c5fed67ea1b9a00db574dd9eac75ad074d0934e88fb2f5c2f7b26b84458cd
MD5 2ef09d8284ccbf739d8741fd844018fb
SHA1 ae72a42b9f8dac07007f7d3632dad927fa42322e
SHA512 09e0cce95f341dcf888be6fab6ee598651d6c473a6edb78ba1b77985347c5668d0764d5ac6747d2e51c7bc178bdf55a28c837105c9fa3ad8d16afb302e6c8da5
MD5 SHA1 SHA512

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads