6f9cc42849093e8127087b1695c7547937fb6c75542a2ce375833604aac68b56

Analysis

max time kernel
160s
max time network
131s
platform
android_x64
resource
android-x64-20240514-en
resource tags

androidarch:x64arch:x86image:android-x64-20240514-enlocale:en-usos:android-10-x64system
submitted
01/06/2024, 00:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
6f9cc42849093e8127087b1695c7547937fb6c75542a2ce375833604aac68b56.apk
Size 1.7MB
Sample240601-aszynaba9x
SHA256 6f9cc42849093e8127087b1695c7547937fb6c75542a2ce375833604aac68b56
MD5 a54c1aca706145ba96925edd521aa71b
SHA1 6bdc2d220f5030b78f91fced29c7a3d77ce43e05
SHA512 3e445ce89c35b8b026028947a5bb7539ff6db6af8e6147272386c6f8e02748488441741c8a7e44c93bc93501ac73aa07ef20b56b08cf8f543960537db675001f
SSDEEP 24576:yTY1DPi34eDetkJ1LVySGwrDXVIdn0qEYE8VOnjzF771G0uzX5t5qZv8wBOuB:yTY1W5skJ144/qEYEwCfuDJwZ
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

collection credential_access evasion

Malware Config

Signatures

Makes use of the framework's Accessibility service 4 TTPs 2 IoCs

Retrieves information displayed on the phone screen using AccessibilityService.

collection evasion credential_access

Input Injection

T1516

Screen Capture

T1513

Keylogging

T1417.001

GUI Input Capture

T1417.002

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByText	org.zzzz.aaa
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	org.zzzz.aaa

org.zzzz.aaa
1⤵
- Makes use of the framework's Accessibility service
PID:5196

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Input Injection

T1516

Credential Access

Input Capture

T1417

GUI Input Capture

T1417.002

Keylogging

T1417.001

Discovery

Lateral Movement

Collection

Input Capture

T1417

GUI Input Capture

T1417.002

Keylogging

T1417.001

Screen Capture

T1513

Command and Control

Exfiltration

Impact

Input Injection

T1516

Replay Monitor

Loading Replay Monitor...

Downloads

profileInstalled

Path /data/data/org.zzzz.aaa/files/profileInstalled
Size 24B
SHA256 a887479d4cdcd4323bd269759c708fd3c639c48a919e1faee8d72412e03f3368
MD5 333229cd45f82969a621c36466dceac6
SHA1 3f8ca02d880ea161ba1cc3350831c11fb44735b6
SHA512 c5ec2f99fcd452b8ed3a3fcfe519c55c986eccdefd55393c373ca500e406e40692c125cd8952ce89175d347d23ea3c9e94921ff5e27c5dd2342986a922c9ca0f
MD5 SHA1 SHA512

Submit Download

profileinstaller_profileWrittenFor_lastUpdateTime.dat

Path /data/data/org.zzzz.aaa/files/profileinstaller_profileWrittenFor_lastUpdateTime.dat
Size 8B
SHA256 d438184aef442467a2dc4427b5a99395b31c3d9fae05d929bd57a236e6370c37
MD5 a03cc6f223484a727b94caa48d7f6ed3
SHA1 f1b6eadd917e19076bc5ed92d20192c4ffcc1434
SHA512 2fdc5206cfbb5d4e4d50fade1516ad04cf3678e660ac42b1bc4586293ac99dd7bcaac2b14521c5300a3871cb12d544e85c4ba875df29e6e70005d63fecb0b55d
MD5 SHA1 SHA512

Submit Download

primary.prof

Path /data/misc/profiles/cur/0/org.zzzz.aaa/primary.prof
Size 1KB
SHA256 c0b92b907c16a8cefe4c1e3ede1077177336151f04c7d7397459a4ab7873afb3
MD5 5094b01be596982704b2a6e0caca8e14
SHA1 04340638fabdd1bccbcbbbc79d63425fbd9d24fb
SHA512 0726d59e672cdba2aeff3b77110125acc2a6f79b4b1f7dc3eb8be849be7baa7757b62d1b3899305ae0ec3460aac63427a5e080f134e6ff4136cb7e55deb2618d
MD5 SHA1 SHA512

Submit Download

primary.prof

Path /data/misc/profiles/cur/0/org.zzzz.aaa/primary.prof
Size 2KB
SHA256 fcdaf8c4a7bca8b6d960ad165d1535c9894fed21cf607d8b083baf9f8776e6bb
MD5 0da048f5d5e112ab6c2f7a46e306afdf
SHA1 8f2aa1f8dbdba92b6ad4d7412df610386e70bddb
SHA512 d637b9583ba712b90b796cdb12afd3c1ad850ac549abea7f70d9df50b55fe224fc28f1d545ddeba4c8b8a570e762eb693c7a79d406a2100c74be9e3740171017
MD5 SHA1 SHA512

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads