7af7345e3aaefd36eebd58b9db18b480f61dc50ce15ecdaad9f9895fa266e1a2

Analysis

max time kernel
178s
max time network
133s
platform
android_x64
resource
android-x64-arm64-20240611.1-en
resource tags

androidarch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20240611.1-enlocale:en-usos:android-11-x64system
submitted
15-06-2024 14:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Standoff123.apk
Size

857KB
MD5

48b9c6baac4cd5348b1d4c4baf90c90b
SHA1

dc153759069d38b25770221c9022a79838067d7c
SHA256

7af7345e3aaefd36eebd58b9db18b480f61dc50ce15ecdaad9f9895fa266e1a2
SHA512

2040de4a3508b2e91e5d30b7da7f55f5152e72c48d273131bc6c80d04862c7ed26b9680d045d79cdef3c9c41f8c8b031eab7a4c3fe3b75184d1cc3499cc8f6f0
SSDEEP

12288:SaR92J6sgRMLz7dpM+fAfT+Kc90ky5WmpYshXZPbGwidNpgQ:biJ6s9Lz7dplYfT+Ks0r5WmD9idNpj

Score

8^/10

banker discovery evasion impact persistence privilege_escalation stealth trojan

Malware Config

Signatures

Removes its main activity from the application launcher 1 TTPs 1 IoCs
stealth trojan evasion

T1628.001

Processes:

cmf0.c3b5bm90zq.patch

pid process

4531 cmf0.c3b5bm90zq.patch
Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
banker discovery

T1418.001
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
evasion persistence

T1541

Processes:

cmf0.c3b5bm90zq.patch

description ioc process

Framework service call android.app.IActivityManager.setServiceForeground cmf0.c3b5bm90zq.patch
Requests enabling of the accessibility settings. 1 IoCs

Processes:

cmf0.c3b5bm90zq.patch

description ioc process

Intent action android.settings.ACCESSIBILITY_SETTINGS cmf0.c3b5bm90zq.patch
Tries to add a device administrator. 2 TTPs 1 IoCs
privilege_escalation impact

T1626.001

T1640

Processes:

cmf0.c3b5bm90zq.patch

description ioc process

Intent action android.app.action.ADD_DEVICE_ADMIN cmf0.c3b5bm90zq.patch

pid	process
4531	cmf0.c3b5bm90zq.patch

description	ioc	process
Framework service call	android.app.IActivityManager.setServiceForeground	cmf0.c3b5bm90zq.patch

description	ioc	process
Intent action	android.settings.ACCESSIBILITY_SETTINGS	cmf0.c3b5bm90zq.patch

description	ioc	process
Intent action	android.app.action.ADD_DEVICE_ADMIN	cmf0.c3b5bm90zq.patch

cmf0.c3b5bm90zq.patch
1⤵
- Removes its main activity from the application launcher
- Makes use of the framework's foreground persistence service
- Requests enabling of the accessibility settings.
- Tries to add a device administrator.
PID:4531

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

/storage/emulated/0/AxelBolt.net/config15-06-2024.log
Filesize
39B

MD5
cdd76e9adbcb74a0afe6ed861e62fd03

SHA1
ca4aaebb5aee89c9b59a396525a124868e6d8033

SHA256
625da35bc2b519dbfbdc1197e30bfb1e7125630f01b1bf7e5705be27ca38e43a

SHA512
412b2c737a5fff70cf5f693d4be9704db9e30c047b15fb68798c8400ba5472d2093bcdb15558b70be510d93132231fba7ff9a2da1454f29986620d04f459b429

Download Submit
/storage/emulated/0/AxelBolt.net/config15-06-2024.log
Filesize
54B

MD5
ea21e61c64e6543d63b56f3687e4b339

SHA1
d90e69f6eb412b60ff1c6326ad48c48bd313362b

SHA256
f84a54fe1ccc13df603ff66b0c7db274c737e3c1ae672fb698454023fd9b9526

SHA512
73bf01dc38930887084adfd2dfd0cad509321f203ac4f7f2cd225e3e488b37d30b3ce1c787c21e9e8e472b1d64f4145760f81710f180f4cfbd8f3dfafd5b0d53

Download Submit
/storage/emulated/0/AxelBolt.net/config15-06-2024.log
Filesize
85B

MD5
7374d01b39aec39a461d7826cbed78f8

SHA1
78a11331ece950118b99f571dac8273b83af8312

SHA256
a8cc8d977b6def22e0828a6d0b9a6058c7d9336ed64ba6093c21ab3fbfc13d55

SHA512
4d019b7f903433f7546fd0803a772f97f70a7794fbfc980cf475e7250e33c312aabe53a59586f368e4ecef67a908d478bec88bc51435ddf4bfd34c03c046f85e

Download Submit
/storage/emulated/0/AxelBolt.net/config15-06-2024.log
Filesize
83B

MD5
850aca27be844b4d8696b87348ac9c3a

SHA1
953cc43f80b25192e3bf440842c6e65c6c61af57

SHA256
3e219742ae0669b211b9ab7884318d336e86a1497fd70ff28ee7fa6440e96110

SHA512
5857a9b2838ffae229a9db373bbcf0670260716615965d199929a5ed56579fa66d214bd4bfe6eee8d0530f2eda5831d92f9127f3dae60af5a2a9b69796789140

Download Submit
/storage/emulated/0/AxelBolt.net/config15-06-2024.log
Filesize
76B

MD5
0aec55745d100df984222ae2526f7e9c

SHA1
3d49caf7be0a691914cf6f9070ecb9b7ca41a3a2

SHA256
4cd8426dc05976251291d9ca742f4fdd40617823c2e3808715d5c5ac95e6c63d

SHA512
c542d93e3f2c6822dc3f0cc54b5557f0ea226de8d52e4d522ec1b0c9efc798b11f4e5bdf217b918b2313a38d025ca14a76c289f0d71800a8324ab482912cfa6e

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads