e1722182223d1e3166749156a3bc721c2edb43f07ced8fdf176adacc214847f3

Analysis

max time kernel
177s
max time network
185s
platform
android_x64
resource
android-33-x64-arm64-20240603-en
resource tags

androidarch:arm64arch:x64image:android-33-x64-arm64-20240603-enlocale:en-usos:android-13-x64system
submitted
06-06-2024 13:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

bot.apk
Size

2.1MB
MD5

2d39b7b436124aec4d0c3928b685089e
SHA1

9f85faf1528fc669468f6ea9b695267a60a09274
SHA256

e1722182223d1e3166749156a3bc721c2edb43f07ced8fdf176adacc214847f3
SHA512

88d21133f897ca833e8772234c27cad0dd71f025cac1130a3d00358b726547d1844a82e33aefad91b95a0ed348a0cf2c7429e3d005111e57b191a6fc2f962148
SSDEEP

49152:owu4fE13/KMdVJ5uUzI+YNM8seioAgU5B3T6l2af72zVWFJh7nZt:tfEV/pfYU0+ivaBr0CzUFJh7nZt

Score

7^/10

banker collection credential_access discovery evasion impact persistence

Malware Config

Signatures

Makes use of the framework's Accessibility service 4 TTPs 1 IoCs

Retrieves information displayed on the phone screen using AccessibilityService.

collection evasion credential_access

Input Injection

T1516

Screen Capture

T1513

Keylogging

T1417.001

GUI Input Capture

T1417.002

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	b4a.example

Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs

Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.

collection credential_access impact

Clipboard Data

T1414

Transmitted Data Manipulation

T1641.001

description	ioc	Process
Framework service call	android.content.IClipboard.addPrimaryClipChangedListener	b4a.example

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
banker discovery

Security Software Discovery
T1418.001
Queries the phone number (MSISDN for GSM devices) 1 TTPs
discovery

System Network Configuration Discovery
T1422

Acquires the wake lock 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	b4a.example

Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

Application may abuse the framework's foreground service to continue running in the foreground.

evasion persistence

Foreground Persistence

T1541

description	ioc	Process
Framework service call	android.app.IActivityManager.setServiceForeground	b4a.example

Performs UI accessibility actions on behalf of the user 1 TTPs 6 IoCs

Application may abuse the accessibility service to prevent their removal.

evasion

Prevent Application Removal

T1629.001

ioc	Process
android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction	b4a.example
android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction	b4a.example
android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction	b4a.example
android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction	b4a.example
android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction	b4a.example
android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction	b4a.example

Checks CPU information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	b4a.example

Checks memory information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	b4a.example

b4a.example
1⤵
- Makes use of the framework's Accessibility service
- Obtains sensitive information copied to the device clipboard
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Performs UI accessibility actions on behalf of the user
- Checks CPU information
- Checks memory information
PID:4213