d7d7472ae765c96d33ec8e6251cddd59d3f93bd8d9be96f7311726e842337e61

Analysis

max time kernel
178s
max time network
165s
platform
android_x64
resource
android-x64-arm64-20240611.1-en
resource tags

androidarch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20240611.1-enlocale:en-usos:android-11-x64system
submitted
17-06-2024 12:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Kavach.apk
Size

788KB
MD5

b415fb908e7c73f5ed47a585f92e79d1
SHA1

023b6c3fff93be4dcb3d04497bc2659a51cfa60d
SHA256

d7d7472ae765c96d33ec8e6251cddd59d3f93bd8d9be96f7311726e842337e61
SHA512

626be6ce6332cfd143c77e2cfd57d035d1bc074f288d808641cffe6d0a1ee6ecf44295156f2b9ec46c2ed1be03ce6f63323fbd3e32c65031d3e03a0e3e485264
SSDEEP

12288:M8a1a8LredeM60GN1jJWmyX5WmpYshXZPbGwidNpgR:ra1a2edeM60q1jImyX5WmD9idNpO

Score

7^/10

banker discovery evasion impact persistence privilege_escalation

Malware Config

Signatures

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
banker discovery

T1418.001
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
evasion persistence

T1541

Processes:

cmf0.c3b5bm90zq.patch

description ioc process

Framework service call android.app.IActivityManager.setServiceForeground cmf0.c3b5bm90zq.patch
Requests enabling of the accessibility settings. 1 IoCs

Processes:

cmf0.c3b5bm90zq.patch

description ioc process

Intent action android.settings.ACCESSIBILITY_SETTINGS cmf0.c3b5bm90zq.patch
Tries to add a device administrator. 2 TTPs 1 IoCs
privilege_escalation impact

T1626.001

T1640

Processes:

cmf0.c3b5bm90zq.patch

description ioc process

Intent action android.app.action.ADD_DEVICE_ADMIN cmf0.c3b5bm90zq.patch

description	ioc	process
Framework service call	android.app.IActivityManager.setServiceForeground	cmf0.c3b5bm90zq.patch

description	ioc	process
Intent action	android.settings.ACCESSIBILITY_SETTINGS	cmf0.c3b5bm90zq.patch

description	ioc	process
Intent action	android.app.action.ADD_DEVICE_ADMIN	cmf0.c3b5bm90zq.patch

cmf0.c3b5bm90zq.patch
1⤵
- Makes use of the framework's foreground persistence service
- Requests enabling of the accessibility settings.
- Tries to add a device administrator.
PID:4440

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

/storage/emulated/0/service player/config17-06-2024.log
Filesize
39B

MD5
755924e0382dd43dd860d5a028275218

SHA1
d127395497111a774a950a846c385e82847ffd63

SHA256
3df8878cf5f5ca270911febb30902c3e2617e71900369e678ec116f0c3bc43cd

SHA512
8e7b445a3b4032eb03f11533303b09fd4d68aae2b1ce92bbf88936b19445966b1828e01c8daff6c02fccd98ecbfee7b8772ff9b1115a49ce85988bad2702c2a3

Download Submit
/storage/emulated/0/service player/config17-06-2024.log
Filesize
71B

MD5
d1f9565ea890030820602c81afef66ce

SHA1
70d4b464f5dab0fcba175067bacb56f2a8cda9f3

SHA256
f222bf873711503865a2d0f24f67d500df0a3f44527bc5689c66d40e8378ca02

SHA512
745f4ed0e5ac4d82eac2994dd50f2f45b120bccc219fc8bba841889eaa7bed4d149d6eba339dfd12607a482f2ac3d16d5d755f413e74768a7aa77e4fa68264f9

Download Submit
/storage/emulated/0/service player/config17-06-2024.log
Filesize
67B

MD5
0f9df8597c480ead68dd15615e85c702

SHA1
d9a5356fd26aaddd481739ee2c9e2d2a462133d6

SHA256
4cdd090c6e88789eb0bb9e173073e3e198237576178dda8277e251cb8029c075

SHA512
ac9e4e54b0a684e67a9f2705d5bce9a3166f5ac6b5d531996435c3017991aa38b41e35148ccd22d9a53fb0fe0f3ed21a9382eb063a74fba1c172678130812cca

Download Submit
/storage/emulated/0/service player/config17-06-2024.log
Filesize
99B

MD5
d9c163734a25348fd7ee944a0c0f37aa

SHA1
f3fe3798aea7591d3e3b98fa2fe09a6791529a1f

SHA256
1b18ab28a9a35971e7d09af25fe5ad010bc3ad95c2a45af9184b3cb6c889bea7

SHA512
ff3826ecbbadeb34f67170b4da9960b96b88df338fe8554cf7902faef84f4e5cb890e74f015127060d39798ba958166629c9cea9697879c5efc58994025f80c8

Download Submit
/storage/emulated/0/service player/config17-06-2024.log
Filesize
135B

MD5
3b7affd49b5f6bcd1f0621ce27e00ea0

SHA1
c5ef74d01ef22acd260f3c603bbbadc70475ae70

SHA256
980f1b5f45ca32ac5595761ad7307ca9747db8fa96f58ecb4f1a4bed88fc7144

SHA512
3ddd2b38e08bfbc80fd591f8a93cfe9d474ee444b8c146834c3967b35b9c0db9867f287b2a654c09770ad5fa4f67a6ad26ffb2418943daecaf2a5ef805129470

Download Submit
/storage/emulated/0/service player/config17-06-2024.log
Filesize
85B

MD5
973199445e24854edfea03d483d564fa

SHA1
05f205467f05e77c2562470d5e196a74939f5e81

SHA256
6608a72170deae61e935fbacfb8631cd28a057771d44f95b75e719772eea2d62

SHA512
438ac260f603611c18740e6c93f19a30b5cc26784bd65d0478d9c7be0f8ca43498c15a7bc58cc20a078997351b6d979285ea536901f9e86cf0ed611fe5081b75

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads