87f02ef6e8c66fb16810d87a13e2feba2800482facb2d0fa7e81f61901c53f2c

Analysis

max time kernel
126s
max time network
132s
platform
android_x64
resource
android-x64-arm64-20240611.1-en
resource tags

androidarch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20240611.1-enlocale:en-usos:android-11-x64system
submitted
20/06/2024, 23:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
87f02ef6e8c66fb16810d87a13e2feba2800482facb2d0fa7e81f61901c53f2c.apk
Size 1.7MB
Sample240620-2zckgswarn
SHA256 87f02ef6e8c66fb16810d87a13e2feba2800482facb2d0fa7e81f61901c53f2c
MD5 518e2d45b6288c3bbf4c7d0077f9eeb0
SHA1 cf1230877869804afeb8e65b1ea244ec6741b9a4
SHA512 8695e680aa09bdae85401b4c5f2a81d4e75f5e8653170c1fd20d8ae1017dddafe4f722cc7807937cacef523d8969d6c7be9ff16894806a8949c685bf80cd404c
SSDEEP 24576:mY13lv3f/efyydpQaMoLcFw6S54z9PttjQIvB8qE++mvAsBoePlhKD:mY13VPxabLcFw/mBH5K6DBfS
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

collection credential_access evasion

Malware Config

Signatures

Makes use of the framework's Accessibility service 4 TTPs 2 IoCs

Retrieves information displayed on the phone screen using AccessibilityService.

collection evasion credential_access

Input Injection

T1516

Screen Capture

T1513

Keylogging

T1417.001

GUI Input Capture

T1417.002

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByText	org.zzzz.aaa
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	org.zzzz.aaa

org.zzzz.aaa
1⤵
- Makes use of the framework's Accessibility service
PID:4433

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Input Injection

T1516

Credential Access

Input Capture

T1417

GUI Input Capture

T1417.002

Keylogging

T1417.001

Discovery

Lateral Movement

Collection

Input Capture

T1417

GUI Input Capture

T1417.002

Keylogging

T1417.001

Screen Capture

T1513

Command and Control

Exfiltration

Impact

Input Injection

T1516

Replay Monitor

Loading Replay Monitor...

Downloads

profileinstaller_profileWrittenFor_lastUpdateTime.dat

Path /data/data/org.zzzz.aaa/files/profileinstaller_profileWrittenFor_lastUpdateTime.dat
Size 8B
SHA256 ac781f3be39c48d980bbb02464b81b74206e325e72951eb05b5d86c43fd69d18
MD5 73dab213e00f7c0354b7d95f1c0dd990
SHA1 357bac31d757df735b50410ab8711353b3ad1064
SHA512 6e8d8d00d9992a24f636442497bcf49a4adc5364b373c82c1960eb2b83011c148ce54623db02c969c047d1a200aa726f4a9a6b04c3555e7633e4e0e955749997
MD5 SHA1 SHA512

Submit Download

primary.prof

Path /data/misc/profiles/cur/0/org.zzzz.aaa/primary.prof
Size 1KB
SHA256 3420976c9951be4fe3b2cba6ce38340977c2dce369d648d4e220d72ceee35a6a
MD5 a377ea8022d72dbeefe49ae2fbf32598
SHA1 a1df669a124cd147a3c96b16d8caf6933813b24e
SHA512 637b9e7493691601d273105d0c51019b74597efaa4b51fbe52ec3afe8943e3812202b0f6cb7412e3365ef8188880cb97432e8a46639f1e2719deb4228f6bb086
MD5 SHA1 SHA512

Submit Download

primary.prof

Path /data/misc/profiles/cur/0/org.zzzz.aaa/primary.prof
Size 2KB
SHA256 cfa074f2a6869d8fa96e6e82ff9d0faa8c147e1458dafef498b37120f4519456
MD5 4512c105e7613d898be7754d151b8710
SHA1 5c06dabeaef3a9214f5863a8acbe5f44a0fc391f
SHA512 e90924d0bdb9de4aced02c85f5f6b767102e0beda342257a31f0009988d3d929403ce208e71c47f2e51def9ae0002ab31cbc69fdbf1e933a599b9675c275b9f2
MD5 SHA1 SHA512

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads