649ba84bcec27cb3496b9c1bad59c0c6f30cdb22bbd8b2af2a13e086de13ed6f

Analysis

max time kernel
161s
max time network
131s
platform
android_x64
resource
android-x64-20240611.1-en
resource tags

androidarch:x64arch:x86image:android-x64-20240611.1-enlocale:en-usos:android-10-x64system
submitted
18/06/2024, 22:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
649ba84bcec27cb3496b9c1bad59c0c6f30cdb22bbd8b2af2a13e086de13ed6f.apk
Size 1.7MB
Sample240618-2b1bmsxhlc
SHA256 649ba84bcec27cb3496b9c1bad59c0c6f30cdb22bbd8b2af2a13e086de13ed6f
MD5 9475f3eafa783544e77e628018f7a4af
SHA1 2f29a85d62f4c99d1e330ea198292af7e388ac45
SHA512 ac8fca08804571dabe5ea6c5806a26a8b0377d0c0c30dc2186d5593cab69279120b07f7d409cffc284b517b8f5fb5c4fa4e05a138d21026b09d2a4807e2fb3d5
SSDEEP 24576:nY1FOgleaIqMgphYpe3gJzaZ6f9DXzbkvdyHBIUJ3WijVCq4+ch4YVMU+J346qxn:nY1h3I1gphakQRbmyH6i/v5sb
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

collection credential_access evasion

Malware Config

Signatures

Makes use of the framework's Accessibility service 4 TTPs 2 IoCs

Retrieves information displayed on the phone screen using AccessibilityService.

collection evasion credential_access

Input Injection

T1516

Screen Capture

T1513

Keylogging

T1417.001

GUI Input Capture

T1417.002

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	org.zzzz.aaa
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByText	org.zzzz.aaa

org.zzzz.aaa
1⤵
- Makes use of the framework's Accessibility service
PID:5056

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Input Injection

T1516

Credential Access

Input Capture

T1417

GUI Input Capture

T1417.002

Keylogging

T1417.001

Discovery

Lateral Movement

Collection

Input Capture

T1417

GUI Input Capture

T1417.002

Keylogging

T1417.001

Screen Capture

T1513

Command and Control

Exfiltration

Impact

Input Injection

T1516

Replay Monitor

Loading Replay Monitor...

Downloads

profileInstalled

Path /data/data/org.zzzz.aaa/files/profileInstalled
Size 24B
SHA256 c31128de338677bf9fc1a759ecfa105091d2007bff1fba8ce491c8c9be3700c9
MD5 c2a8762ce6f22be7d50b3ddcdd058a4d
SHA1 bd2c8558cdf11cfd54344e9eeed73c16a7b7d9cb
SHA512 9a69f5fee15029cd81c3ed2b58f7674f4a347d257d8c735388d3ba444adcd0da362f350d4fe74f980195a3746be7b2a62920c96aa69f6d42576f396f9d9034e3
MD5 SHA1 SHA512

Submit Download

profileinstaller_profileWrittenFor_lastUpdateTime.dat

Path /data/data/org.zzzz.aaa/files/profileinstaller_profileWrittenFor_lastUpdateTime.dat
Size 8B
SHA256 8aaa1390820536aada1e228874214ce6154a6724404fa319f0cb8964773b779f
MD5 3a359d355db565ea876dd3a1555dc5db
SHA1 d6a10a75bb11270fa134ac119f7b446720e6b61e
SHA512 e3ffe43a572cb5a1bfbbf137bfabff2353357a2dfa98aeab4f6cba64cdde1011645b133464b769fdea3fd500e51635e4919a9b84f8b4197d3fd9232f2e88a7a0
MD5 SHA1 SHA512

Submit Download

primary.prof

Path /data/misc/profiles/cur/0/org.zzzz.aaa/primary.prof
Size 1KB
SHA256 d465bcbe7f15f7c206c8664a687cad8cc4e5b255c1536bfb05268cddfd6720ec
MD5 4eefbae716fbc7626755bf2f53e3c07d
SHA1 39f55a965d481c1eef251425cc35d23afe6a8314
SHA512 ef79331609c7b2b5761d26f6dc0d17867d0a0a4c8ead47f7985d84ae04e0622511b15236f40291efe989e35926a7dc37617722d643121f6694b4086aa6db500f
MD5 SHA1 SHA512

Submit Download

primary.prof

Path /data/misc/profiles/cur/0/org.zzzz.aaa/primary.prof
Size 2KB
SHA256 d5b51eb19fdbaff6c03663e630ce660522d5944c40c6e375f1ea944b6ec7548d
MD5 bc4db718fe459f78479c6f712622fb6d
SHA1 2079bd5fe6a87c9fe3c25289e83d1c1ef2a2c806
SHA512 1ad69e51893a50fadbc8be218229ded9b1cce0ef7113e86eacfd3472d007321b349829cdd7e69dc59420b92d9afb55d40bc07c22e800d2fcb3ca2b3b496c0aff
MD5 SHA1 SHA512

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads