7af7345e3aaefd36eebd58b9db18b480f61dc50ce15ecdaad9f9895fa266e1a2

Analysis

max time kernel
179s
max time network
132s
platform
android_x64
resource
android-x64-arm64-20240611.1-en
resource tags

androidarch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20240611.1-enlocale:en-usos:android-11-x64system
submitted
15-06-2024 14:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Standoff123.apk
Size

857KB
MD5

48b9c6baac4cd5348b1d4c4baf90c90b
SHA1

dc153759069d38b25770221c9022a79838067d7c
SHA256

7af7345e3aaefd36eebd58b9db18b480f61dc50ce15ecdaad9f9895fa266e1a2
SHA512

2040de4a3508b2e91e5d30b7da7f55f5152e72c48d273131bc6c80d04862c7ed26b9680d045d79cdef3c9c41f8c8b031eab7a4c3fe3b75184d1cc3499cc8f6f0
SSDEEP

12288:SaR92J6sgRMLz7dpM+fAfT+Kc90ky5WmpYshXZPbGwidNpgQ:biJ6s9Lz7dplYfT+Ks0r5WmD9idNpj

Score

8^/10

banker discovery evasion impact persistence privilege_escalation stealth trojan

Malware Config

Signatures

Removes its main activity from the application launcher 1 TTPs 1 IoCs
stealth trojan evasion

T1628.001

Processes:

cmf0.c3b5bm90zq.patch

pid process

4411 cmf0.c3b5bm90zq.patch
Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
banker discovery

T1418.001
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
evasion persistence

T1541

Processes:

cmf0.c3b5bm90zq.patch

description ioc process

Framework service call android.app.IActivityManager.setServiceForeground cmf0.c3b5bm90zq.patch
Requests enabling of the accessibility settings. 1 IoCs

Processes:

cmf0.c3b5bm90zq.patch

description ioc process

Intent action android.settings.ACCESSIBILITY_SETTINGS cmf0.c3b5bm90zq.patch
Tries to add a device administrator. 2 TTPs 1 IoCs
privilege_escalation impact

T1626.001

T1640

Processes:

cmf0.c3b5bm90zq.patch

description ioc process

Intent action android.app.action.ADD_DEVICE_ADMIN cmf0.c3b5bm90zq.patch

pid	process
4411	cmf0.c3b5bm90zq.patch

description	ioc	process
Framework service call	android.app.IActivityManager.setServiceForeground	cmf0.c3b5bm90zq.patch

description	ioc	process
Intent action	android.settings.ACCESSIBILITY_SETTINGS	cmf0.c3b5bm90zq.patch

description	ioc	process
Intent action	android.app.action.ADD_DEVICE_ADMIN	cmf0.c3b5bm90zq.patch

cmf0.c3b5bm90zq.patch
1⤵
- Removes its main activity from the application launcher
- Makes use of the framework's foreground persistence service
- Requests enabling of the accessibility settings.
- Tries to add a device administrator.
PID:4411

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

/storage/emulated/0/AxelBolt.net/config15-06-2024.log
Filesize
39B

MD5
b10526c010ae2567fc24576699660359

SHA1
a886284b17f5f0a69499aa8514399d663633846c

SHA256
19af508c72da4439c23d37531ae5204229cd8f69d0e099b6d3dc548af4e0cd4f

SHA512
e7ecdf394b9800ff00284dc1e15633f509d5e1fb81104ba6ef1894d2b469563b03099f39d7871a974f8ccb758f38760fac31253a026bab9c2febd3a4562abc96

Download Submit
/storage/emulated/0/AxelBolt.net/config15-06-2024.log
Filesize
54B

MD5
a2a5df98716e4000670c1d6d759a0259

SHA1
c0de0ebc333126c469bb52a2fa48eaf1098c34e6

SHA256
64cce02b72c483586ff17197082a35e529103217395c8f13bea75469b43b8d98

SHA512
f33ae88697aa5e3e0c305e8ea75850afb257d58bd862830bb590be959068ae7aa4afb12d317146f410fac96d509a9c06bb420ba86d28e26c6920818dccdb55eb

Download Submit
/storage/emulated/0/AxelBolt.net/config15-06-2024.log
Filesize
85B

MD5
e18552e5905187b44bb7e5d961add1e4

SHA1
4e09d6ef0779cdff7134518b97eb9424ff1e1a85

SHA256
5d43c19734390596133d64e3f59a4d7ae11348b2372c66052a136bd662d40fae

SHA512
1e55077255d41a2006c95e3764e5c5b7fb8d0354602d9a6b8f047a58c9207256633eaa3fdb1491449bbe3fda5147586a2ef4966228f71d27ac2bf6b9eb30be0c

Download Submit
/storage/emulated/0/AxelBolt.net/config15-06-2024.log
Filesize
61B

MD5
2276fb65b740b90147717e4036c11c7a

SHA1
447358e0fcd9c1d201e400a6bb02e0b0be924af8

SHA256
753658f8c917c5e53f101c5a34be556be184c00789e1dfa91d1ad8508461d74e

SHA512
2c9942cd8a1a6c78eee3b43a3ff8d1d21b0355efcaddd47185c993f22a6ef7aa44bf0d528af7e71d176cca9301f76979ce3fcfaf575fc87d1ecbae97fc577748

Download Submit
/storage/emulated/0/AxelBolt.net/config15-06-2024.log
Filesize
85B

MD5
0bd44878b893849cfe0ed7c9737da076

SHA1
760b3fcc6dbb7a729334ed86123cbd905cbeefb0

SHA256
ab1e0dd7e38169f2afa9136384521b40b119519998f4656e3a662f6fc5c507b1

SHA512
632807a9759bc74461ac672ebd848958daa102b0c4cf7a5ebdfa75e7e0375e8acaab368b06f7de77f471b6c46572f407eb6eba59ff5011d2825837ce29da012a

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads