6264df1978abf44fbda1de33b32af8d4b90809ffdfda88cbbab729786faff976

Analysis

max time kernel
163s
max time network
174s
platform
android_x86
resource
android-x86-arm-20240611.1-en
resource tags

androidarch:armarch:x86image:android-x86-arm-20240611.1-enlocale:en-usos:android-9-x86system
submitted
13/06/2024, 01:54

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
6264df1978abf44fbda1de33b32af8d4b90809ffdfda88cbbab729786faff976.apk
Size 1.7MB
Sample240613-cbk5aatepr
SHA256 6264df1978abf44fbda1de33b32af8d4b90809ffdfda88cbbab729786faff976
MD5 3bc038830f971950a2c829f5cc244b6b
SHA1 b6e219ae195f8152d44e33f32b3ede19550b1c8a
SHA512 ee564e670e069f61d8c0fa565d9358106ae2e9cc4eb1ac00e89cb0b6289adc280ed235c3b0d372d5e152d657cb7dff3e6930a3b670d18311170971a4f4d005e7
SSDEEP 24576:oY1/PDwT1kp0xVuU1W4rfUtb9L4jOapE9qEkMhgXnCUsNujCcKOB33mo4zGQ6wMA:oY1Y1++Vd1VcJcOKE9dKntswyKBQ
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

collection credential_access evasion

Malware Config

Signatures

Makes use of the framework's Accessibility service 4 TTPs 2 IoCs

Retrieves information displayed on the phone screen using AccessibilityService.

collection evasion credential_access

Input Injection

T1516

Screen Capture

T1513

Keylogging

T1417.001

GUI Input Capture

T1417.002

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	org.zzzz.aaa
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByText	org.zzzz.aaa

org.zzzz.aaa
1⤵
- Makes use of the framework's Accessibility service
PID:4269

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Input Injection

T1516

Credential Access

Input Capture

T1417

GUI Input Capture

T1417.002

Keylogging

T1417.001

Discovery

Lateral Movement

Collection

Input Capture

T1417

GUI Input Capture

T1417.002

Keylogging

T1417.001

Screen Capture

T1513

Command and Control

Exfiltration

Impact

Input Injection

T1516

Replay Monitor

Loading Replay Monitor...

Downloads

profileInstalled

Path /data/data/org.zzzz.aaa/files/profileInstalled
Size 24B
SHA256 f16fd0d7f6cabaf8da079ed4d49c16904976a6d3696cb842b78bf373ffed0807
MD5 4a0c04d778627b4e3fd2b1b224ad623b
SHA1 df666d09ee3459b42de75ede765452bd29226599
SHA512 ad6249454b5ae5a37fc9240e71344a75676c148314ea2b991609d599f24e62452c087b733b01ac03066b4316f5383efd5a086920d0b390e2f2e84ad32f0dfa67
MD5 SHA1 SHA512

Submit Download

profileinstaller_profileWrittenFor_lastUpdateTime.dat

Path /data/data/org.zzzz.aaa/files/profileinstaller_profileWrittenFor_lastUpdateTime.dat
Size 8B
SHA256 bc2977d30c0de0dd896a3b0bfc0498c4d870a0378233312f623b00ae51f93be1
MD5 09743a00017c906764e2cefb8f863d33
SHA1 f6f0a914c6a476c7de67c0911e203b9713c538e3
SHA512 b401985fa356bee48c399d57557c614e99d37c58118a3f6feeef9c41b633265efa10ffe1fea48cd4ebc5ff32f22915684ba5e7f51447d8957c0eb7d18df969e2
MD5 SHA1 SHA512

Submit Download

primary.prof

Path /data/misc/profiles/cur/0/org.zzzz.aaa/primary.prof
Size 1KB
SHA256 4dcaba7f453e3d4dd6bf614985f3f4e73705c188eced3acb48eb1bdb4373bd34
MD5 47f70173ba250bd4a1c89bbf7874a5ca
SHA1 3cd2db098946d3408940eaa103e6088bf7000c12
SHA512 20dc30c144ee3189e1f424b60f5aac900a0202a60f1d5c9323e4671390d9cbaf760badcde9e87cd7de7085ae89184e25efe9d7e001e242b58bdbbf276d012cd2
MD5 SHA1 SHA512

Submit Download

primary.prof

Path /data/misc/profiles/cur/0/org.zzzz.aaa/primary.prof
Size 2KB
SHA256 45b63af081a177be634aac2a9d061f92526ed9b10ef4c2c9c3c0a7344fa553dc
MD5 6590fa1f03c66f94c9fecfa2a7b2515c
SHA1 bde0490c56c690366e1d1b4a58c6cb23ffe394fe
SHA512 721d40ac3a7c05b4c4df7d2da28b8ce25ba0a91a090dbd04362c161ca8ee7fd137c6d5bf4bf005147a0aa41de4a2a99b80e5c5136ad3956d9f9a77d49fb1f4c1
MD5 SHA1 SHA512

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads