1138cdd5b3f8b317726aca14fc30a8b1f7f59bd454132ed08c653e5372796b43

Analysis

max time kernel
149s
max time network
131s
platform
android_x86
resource
android-x86-arm-20240611.1-en
resource tags

androidarch:armarch:x86image:android-x86-arm-20240611.1-enlocale:en-usos:android-9-x86system
submitted
12/06/2024, 19:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
1138cdd5b3f8b317726aca14fc30a8b1f7f59bd454132ed08c653e5372796b43.apk
Size 1.7MB
Sample240612-ybehdsxcpg
SHA256 1138cdd5b3f8b317726aca14fc30a8b1f7f59bd454132ed08c653e5372796b43
MD5 bc1df7ba458425f3a317c62c665e0b97
SHA1 894f09361b8f115853c28b9ad2b53ec6d99de179
SHA512 30a3ef123d9960b1df133c3bff380628b657a7e049eab7de391e279e74693796c8ea895ca64109d1377fea2f3a06fd586aa94883f85bbd848f5abe359d43f9d9
SSDEEP 49152:oY1rDeLgZmkTt0PS6czGGIt3Hvc/rGup6j+:RAgZfaHIGJvIGTa
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

collection credential_access evasion

Malware Config

Signatures

Makes use of the framework's Accessibility service 4 TTPs 2 IoCs

Retrieves information displayed on the phone screen using AccessibilityService.

collection evasion credential_access

Input Injection

T1516

Screen Capture

T1513

Keylogging

T1417.001

GUI Input Capture

T1417.002

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	org.zzzz.aaa
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByText	org.zzzz.aaa

org.zzzz.aaa
1⤵
- Makes use of the framework's Accessibility service
PID:4266

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Input Injection

T1516

Credential Access

Input Capture

T1417

GUI Input Capture

T1417.002

Keylogging

T1417.001

Discovery

Lateral Movement

Collection

Input Capture

T1417

GUI Input Capture

T1417.002

Keylogging

T1417.001

Screen Capture

T1513

Command and Control

Exfiltration

Impact

Input Injection

T1516

Replay Monitor

Loading Replay Monitor...

Downloads

profileInstalled

Path /data/data/org.zzzz.aaa/files/profileInstalled
Size 24B
SHA256 bc0c4f0a2bc88871029368d1fe743ebb7887015887a9535c06cb416a9d86fbc7
MD5 c863d64ab6c2f528e109534391ab08cd
SHA1 ad60d184bc069b309066d29d173c6cad096993af
SHA512 8ce7bcac01c22c3179803d9052ecc6294cb6e64685d4a287e9abae65c1a3b14bdeab1a07cf1e069c38b29192183e01f1fd4b670b984bc7fa79503da959342ee7
MD5 SHA1 SHA512

Submit Download

profileinstaller_profileWrittenFor_lastUpdateTime.dat

Path /data/data/org.zzzz.aaa/files/profileinstaller_profileWrittenFor_lastUpdateTime.dat
Size 8B
SHA256 ff12fae5d91be958f6f360ad6aab217929fc67804dea2a878513e82457a9be43
MD5 4f79ab7bace8f3c2485b5fb742376e8f
SHA1 916c57245f3c755f56bd8387068f776db0210835
SHA512 e62211981218cc6e7dc523022e1b62e25797ebb35e60701158d2b9e143b24d8ce757eec1d30a2f260ca277f10393fff250c5a63073cf898198a527d0bf2dd931
MD5 SHA1 SHA512

Submit Download

primary.prof

Path /data/misc/profiles/cur/0/org.zzzz.aaa/primary.prof
Size 1KB
SHA256 0102b5ac0adfbaa2b77cc6b0cb8f7fe8fcb5588d4e4a990c56f85e4f9afbd698
MD5 6951f329d521baa8f9e5b65f166f1ee8
SHA1 9917af1f527f9caac157cdd1f27e68265598ead0
SHA512 48bfd38097c3cdd4f2ea2b445cc5283fc62deed67e19df001334d552cb579bbead8b1cacf86b3b335d37a6d15e6301cc8a74d69904acdca55bdabe73b900bda1
MD5 SHA1 SHA512

Submit Download

primary.prof

Path /data/misc/profiles/cur/0/org.zzzz.aaa/primary.prof
Size 2KB
SHA256 098669333ad6f307b7624265522deb99ad18278538dd28b745a513bba3d94476
MD5 d927cca3e732608937a92790781f0954
SHA1 197d01d34a3d98419af18c865d8f3ddc439f8e3c
SHA512 e27c42009027b9f2f382bcb38a52806536124bdca9be5ad6a036ea68b639a2c2fec399b0aca5972266ab93c047fe56dcfaffc08e9af8abc9091f663d0ab72e49
MD5 SHA1 SHA512

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads