d2b88c8a3338fbce930eebf2efaaa0df4672143ee6bb2fbc55bf17105f5a3756

Analysis

max time kernel
170s
max time network
130s
platform
android_x86
resource
android-x86-arm-20240624-en
resource tags

androidarch:armarch:x86image:android-x86-arm-20240624-enlocale:en-usos:android-9-x86system
submitted
25/06/2024, 22:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
WhatsApp.apk
Size 3.8MB
Sample240625-1yllbswdqe
SHA256 1941f273125921dcb46c2646e8b6ef58588712d733966def792228dd6d9ce5bb
MD5 bb8459442d76afba871622a4bd4b4e41
SHA1 b64e61a7e61ad28c1f36bdef62176c608d8da2dd
SHA512 800d27b65d20c1acdf2b5e2becf6c1b55360397fef1fedf7bb057d362484e2cf3a4ef18e71cd092d784cf54b35583251a3908932f224367bb69f5341eac9937d
SSDEEP 98304:1js3W3PDrXViF1xmw69KrsZQzCw/cPbIfo5fF:C3Ges9KraQPcjIfo/
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

collection credential_access evasion

Malware Config

Signatures

Loads dropped Dex/Jar 1 TTPs 2 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/com.xtuamuxlmp.cknsqskvtdi/code_cache/secondary-dexes/base.apk.classes1.zip	4282	/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.xtuamuxlmp.cknsqskvtdi/code_cache/secondary-dexes/base.apk.classes1.zip --output-vdex-fd=44 --oat-fd=45 --oat-location=/data/user/0/com.xtuamuxlmp.cknsqskvtdi/code_cache/secondary-dexes/oat/x86/base.apk.classes1.odex --compiler-filter=quicken --class-loader-context=&
/data/user/0/com.xtuamuxlmp.cknsqskvtdi/code_cache/secondary-dexes/base.apk.classes1.zip	4253	com.xtuamuxlmp.cknsqskvtdi

Makes use of the framework's Accessibility service 4 TTPs 3 IoCs

Retrieves information displayed on the phone screen using AccessibilityService.

collection evasion credential_access

Input Injection

T1516

Screen Capture

T1513

Keylogging

T1417.001

GUI Input Capture

T1417.002

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId	com.xtuamuxlmp.cknsqskvtdi
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	com.xtuamuxlmp.cknsqskvtdi
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByText	com.xtuamuxlmp.cknsqskvtdi

com.xtuamuxlmp.cknsqskvtdi
1⤵
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
PID:4253
- /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.xtuamuxlmp.cknsqskvtdi/code_cache/secondary-dexes/base.apk.classes1.zip --output-vdex-fd=44 --oat-fd=45 --oat-location=/data/user/0/com.xtuamuxlmp.cknsqskvtdi/code_cache/secondary-dexes/oat/x86/base.apk.classes1.odex --compiler-filter=quicken --class-loader-context=&
  2⤵
  - Loads dropped Dex/Jar
  PID:4282
- getprop ro.miui.ui.version.name
  2⤵
  PID:4337

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Input Injection

T1516

Credential Access

Input Capture

T1417

GUI Input Capture

T1417.002

Keylogging

T1417.001

Discovery

Lateral Movement

Collection

Input Capture

T1417

GUI Input Capture

T1417.002

Keylogging

T1417.001

Screen Capture

T1513

Command and Control

Exfiltration

Impact

Input Injection

T1516

Replay Monitor

Loading Replay Monitor...

Downloads

tmp-base.apk.classes2656189198536298412.zip

Path /data/data/com.xtuamuxlmp.cknsqskvtdi/code_cache/secondary-dexes/tmp-base.apk.classes2656189198536298412.zip
Size 828KB
SHA256 afa6e24202cf373b17a251ba065a5f0f503c44d49e3161eb4c5ce182000a27a9
MD5 12c797a36a99cc2e395c86d0cf02cf4a
SHA1 4170db5dd85ca3e359b591618ecbc705deea3b13
SHA512 b3b816100b8de197f48edcea5d97027180700b4f3bec375ed5b78864896628db201121262269b7f9b4bb0160d641d55ea32cd7449690b6ee2b10f4ee07f11255
SSDEEP 24576:r9JIY/AI+FYKwg2g99ZN+/XvRhGeBsYp3onmow:JDAdFYpeuv5hPsk3omow
MD5 SHA1 SHA512 SSDEEP

Submit Download

base.apk.classes1.zip

Path /data/user/0/com.xtuamuxlmp.cknsqskvtdi/code_cache/secondary-dexes/base.apk.classes1.zip
Size 1.9MB
SHA256 ac392c2c335e933b3a7e6e79ab3ca90b6a2dadac0c3931af7c38ded2989d07e6
MD5 08f46c3f6f32e58a538798b27449415d
SHA1 a9ae38b9b4b6fbf1f67f9f9183974d60d87de237
SHA512 c1a7ca4a8aa39868f34940fa81287ac0c10b26291b5355d96569297e23938ce28d04dd79be12faa192b5af04cbdae4d12de89a2fa6516c095d2d9e1dc6f4911e
SSDEEP 24576:DSJR6TQqjgb5umd/9UbtRMad7K72PxeOR2UUH0NG1izHSui4oy54X:Dxf2ePR2UUU0ks4k
MD5 SHA1 SHA512 SSDEEP

Download

base.apk.classes1.zip

Path /data/user/0/com.xtuamuxlmp.cknsqskvtdi/code_cache/secondary-dexes/base.apk.classes1.zip
Size 1.9MB
SHA256 c4555a26c32f795af2bccb57b4afcdce650d699bd76bdcd0cb7840b7f758d436
MD5 55e8d9bee56d416da445cc0fe2a82e28
SHA1 fa0bc6739c357e4c7b4c425625d97a6cbcd8617a
SHA512 db59c8cca4ba4913540ea0f0b2b763babe0f390c6f6ca9b1b9d36e1db4f584a4ec5db9422a3646dd2e9900f1738fb0528c29dbe7b81acab51c2b6f5907b76fd4
SSDEEP 24576:DSJR6TQqjgb5umd/9UbtRMad7VVeems/RMOjswSSUWHlXU91123NCu2mUw0RiWIb:Dxfn9RXjswSSv41123NCu2mDWM
MD5 SHA1 SHA512 SSDEEP

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads