19ae503b906394e3aef852bf93d97c10fb0a26b35955ba002b724993371dc5cd

Analysis

max time kernel
121s
max time network
132s
platform
android_x64
resource
android-x64-arm64-20240611.1-en
resource tags

androidarch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20240611.1-enlocale:en-usos:android-11-x64system
submitted
12/06/2024, 23:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
19ae503b906394e3aef852bf93d97c10fb0a26b35955ba002b724993371dc5cd.apk
Size 1.7MB
Sample240612-3fagfsvema
SHA256 19ae503b906394e3aef852bf93d97c10fb0a26b35955ba002b724993371dc5cd
MD5 8fb435aefb5f8154f65692431d3ba912
SHA1 02cfc5da14d41187370a1101e08736a44ebb11fa
SHA512 a899bee157f4d846ad494befa94f633505666bf662ec46d5e704bf736af7f10d9b60c4a695923cb0e6502473aee8ab28b0ba4c16ace334dcc7c4654ef4761718
SSDEEP 24576:CY1572ouxWVl69B5k7Vybh/XZhCjw5CsP/9fHDXeSWmZV2/wWDRj/0f5sPpg8CBD:CY1wZxglMgVEJphQwf/4SXk1452xi
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

collection credential_access evasion

Malware Config

Signatures

Makes use of the framework's Accessibility service 4 TTPs 2 IoCs

Retrieves information displayed on the phone screen using AccessibilityService.

collection evasion credential_access

Input Injection

T1516

Screen Capture

T1513

Keylogging

T1417.001

GUI Input Capture

T1417.002

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	org.zzzz.aaa
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByText	org.zzzz.aaa

org.zzzz.aaa
1⤵
- Makes use of the framework's Accessibility service
PID:4668

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Input Injection

T1516

Credential Access

Input Capture

T1417

GUI Input Capture

T1417.002

Keylogging

T1417.001

Discovery

Lateral Movement

Collection

Input Capture

T1417

GUI Input Capture

T1417.002

Keylogging

T1417.001

Screen Capture

T1513

Command and Control

Exfiltration

Impact

Input Injection

T1516

Replay Monitor

Loading Replay Monitor...

Downloads

profileinstaller_profileWrittenFor_lastUpdateTime.dat

Path /data/data/org.zzzz.aaa/files/profileinstaller_profileWrittenFor_lastUpdateTime.dat
Size 8B
SHA256 b78f86088c4f03182e3353edd3751389a8c5b24f91d742bda75413cac44cbeb8
MD5 2506fbc0362d667cc8e51ad54d2b42b8
SHA1 3f368ccc2f3c71fc76d9189fcdd4e17d4db90c09
SHA512 2414b71e6cc57af35441a9ed90c5957791c05d0c4c37ee2125b25808642283202b9236aa63cd90f4dcfc478a3fc3151b4d4ca3e27dfd7406ffadf2a57e75135b
MD5 SHA1 SHA512

Submit Download

primary.prof

Path /data/misc/profiles/cur/0/org.zzzz.aaa/primary.prof
Size 1KB
SHA256 b674946e9b2a5689924021441443a6cfdadbc5b8daebab68baf3b93c96ee03f4
MD5 18a1b0c0a9800d54d904f4a5d095a60c
SHA1 ab973da506bdd05437ecf834248aa610e8907690
SHA512 057de3cb674160d9f76f4522c2dfc66fd96947ad412bf9372b29f92d912e983044c3bdc1a7911ac54861f7202d2934a13b515b63cf1d3136849819ed9fef4161
MD5 SHA1 SHA512

Submit Download

primary.prof

Path /data/misc/profiles/cur/0/org.zzzz.aaa/primary.prof
Size 2KB
SHA256 2a735f4e207ba6840412dcef0f23b41d259a1e1cbf5f63b233a6946754104f67
MD5 6e06a8c89a6ff5d3da61c0a6a131af96
SHA1 c948c3119a6578146581d8ee8e2e2fc26ce6de3b
SHA512 7dd4cb062f0a98dd09b3fd12aa987f0b56876db56214dde0866d0d6d9975fb299e98a50921dfa1be2d29a1867eb24c38321e5a76b6c02b9a3e1cbd2869430f57
MD5 SHA1 SHA512

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads