255c61326c9d4fc198bc562049f4f5ba82a89a1ab71487876ee8f1bff125aee7

Analysis

max time kernel
179s
max time network
188s
platform
android_x64
resource
android-33-x64-arm64-20240611.1-en
resource tags

androidarch:arm64arch:x64image:android-33-x64-arm64-20240611.1-enlocale:en-usos:android-13-x64system
submitted
17/06/2024, 10:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

postbank.apk
Size

9.3MB
MD5

b2124d1ba4377ed283fc261fe14a3d49
SHA1

dc9a821f1e061098188503dbf7518bf263334fcd
SHA256

255c61326c9d4fc198bc562049f4f5ba82a89a1ab71487876ee8f1bff125aee7
SHA512

4c99640368889efee165bd86d8d4da6d3c21d25c523ca5d1d84b5b982095f030196e93760fe03de6a917d5be2ec2ef8a291c7d2ba1de2592c738403b84422c20
SSDEEP

98304:gw0VXhBXaFoFCinaVsrgr6mzjzBzTG0tsVkLr:gw+/KFoJdrgr1zhN9

Score

7^/10

collection credential_access evasion execution persistence

Malware Config

Signatures

Makes use of the framework's Accessibility service 4 TTPs 1 IoCs

Retrieves information displayed on the phone screen using AccessibilityService.

collection evasion credential_access

Input Injection

T1516

Screen Capture

T1513

Keylogging

T1417.001

GUI Input Capture

T1417.002

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	sun.timely.eu

Acquires the wake lock 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	sun.timely.eu

Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

Application may abuse the framework's foreground service to continue running in the foreground.

evasion persistence

Foreground Persistence

T1541

description	ioc	Process
Framework service call	android.app.IActivityManager.setServiceForeground	sun.timely.eu

Requests enabling of the accessibility settings. 1 IoCs

description	ioc	Process
Intent action	android.settings.ACCESSIBILITY_SETTINGS	sun.timely.eu

Schedules tasks to execute at a specified time 1 TTPs 1 IoCs

Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.

execution persistence

Scheduled Task/Job

T1603

description	ioc	Process
Framework service call	android.app.job.IJobScheduler.schedule	sun.timely.eu

sun.timely.eu
1⤵
- Makes use of the framework's Accessibility service
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Requests enabling of the accessibility settings.
- Schedules tasks to execute at a specified time
PID:4348

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Scheduled Task/Job

T1603

Persistence

Foreground Persistence

T1541

Scheduled Task/Job

T1603

Privilege Escalation

Defense Evasion

Foreground Persistence

T1541

Input Injection

T1516

Credential Access

Input Capture

T1417

GUI Input Capture

T1417.002

Keylogging

T1417.001

Discovery

Lateral Movement

Collection

Input Capture

T1417

GUI Input Capture

T1417.002

Keylogging

T1417.001

Screen Capture

T1513

Command and Control

Exfiltration

Impact

Input Injection

T1516

Replay Monitor

Loading Replay Monitor...

Downloads

/storage/emulated/0/Config/sys/apps/log/log-2024-06-17.txt

Filesize
13B

MD5
de2c41a51ee9246eb1708f65b511add0

SHA1
2f442d634c8a18760a232c8829d4b5d74a52f074

SHA256
ad2d914ca347cd1930e32f21c6d5448c34104bea181b93abc85ec518985653ab

SHA512
7cdfbd001594503644e9ed80ae852f90ef9e841a8382e2eec6979e149a2c400a3b83055d205b4d1d66e1600e5127482932d5127eb5800d35a4ee5673fe34d84a

Download Submit
/storage/emulated/0/Config/sys/apps/log/log-2024-06-17.txt

Filesize
25B

MD5
d4e0f829c6ff111c8b2f5ea0542747b4

SHA1
ef8092e66f3e8f16aa76709cdd443a8456adb3f8

SHA256
1e2c035117e983c0aef35c1112e2f3c1b1e41cb4113efe5211ff693991b84152

SHA512
b746054fda7986b570b4328e1aafc24b4a86e96c7d27154aa49269d0204fd49c1cd1ad33bec1b2a647dca500d135b94a01d8f71afd204a54b992f814e5189b77

Download Submit
/storage/emulated/0/Config/sys/apps/log/log-2024-06-17.txt

Filesize
25B

MD5
7990a22bfb939092b434b79b4d6edf5b

SHA1
21b14fcb0538e4eaa60c114d50e8c6282252d402

SHA256
060abc105e5dafb820f786f61a155c10cad2f7f8e26d72392439e7226318eef8

SHA512
194d1edbb49992fdeac9b29824bb30f6cf4e8e12941ce9c0c772b232ac557ec3fea9a1ee5b33c97b1c7da257e31cc0bd92e83c61b2bc97f293941602213680d4

Download Submit
/storage/emulated/0/Config/sys/apps/log/log-2024-06-17.txt

Filesize
41B

MD5
47bf4896695dd37839081267ce5bdc7f

SHA1
5a22524c99760b6bedb78a471103b776441d0184

SHA256
6695a9937b4d80e5da880643272faa5aab78d45be90b092fff8a9235a9e65c67

SHA512
d58d5bbc32e115e8a46efdba89dd9df622c439fd9356fb13974279d09fc5eb4b5391be5a376ce91648a0dfb5fae6250b3a799107e4e05a755f496383ba1de146

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads