18db090d98b4ee6d95cdd49eecfce7825a27df6a5dde6071f69635277a0fdc57

Analysis

max time kernel
154s
max time network
145s
platform
android_x64
resource
android-x64-arm64-20240624-en
resource tags

androidarch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20240624-enlocale:en-usos:android-11-x64system
submitted
03/07/2024, 22:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

18db090d98b4ee6d95cdd49eecfce7825a27df6a5dde6071f69635277a0fdc57.apk
Size

1.8MB
MD5

d57981eb8486459fdefc0cd250e6ec19
SHA1

53142e4ca1093d39d618569495e1e225d86ee91c
SHA256

18db090d98b4ee6d95cdd49eecfce7825a27df6a5dde6071f69635277a0fdc57
SHA512

1d1b260564770496bc0cddfa19e705dcdfc84ea79db94b8dde6386fbdefe8c3fbed40fd6cf8e8fedcc7ff644ef35b223f0296a56212ab3969e8067c959b1753d
SSDEEP

24576:bY1lJJrSINXEO3IouJp8P9KSDS6YOOXDtXUFLwKpG4Sj3gezmMY64XR4FjHwD3L:bY1lfx3IPa4m2OK/QSoMBlu

Score

7^/10

collection credential_access evasion

Malware Config

Signatures

Makes use of the framework's Accessibility service 4 TTPs 2 IoCs

Retrieves information displayed on the phone screen using AccessibilityService.

collection evasion credential_access

Input Injection

T1516

Screen Capture

T1513

Keylogging

T1417.001

GUI Input Capture

T1417.002

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	org.zzzz.aaa
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByText	org.zzzz.aaa

org.zzzz.aaa
1⤵
- Makes use of the framework's Accessibility service
PID:4484

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Input Injection

T1516

Credential Access

Input Capture

T1417

GUI Input Capture

T1417.002

Keylogging

T1417.001

Discovery

Lateral Movement

Collection

Input Capture

T1417

GUI Input Capture

T1417.002

Keylogging

T1417.001

Screen Capture

T1513

Command and Control

Exfiltration

Impact

Input Injection

T1516

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/org.zzzz.aaa/files/profileinstaller_profileWrittenFor_lastUpdateTime.dat

Filesize
8B

MD5
38ff9b31b36379b4fbc1d0301eea433a

SHA1
263ec1a7cee3d2c783ea75c26883788570b62eb5

SHA256
e5e2168165caeff7119dcae1cae4102cecb7126d95e37c79670a321756550159

SHA512
8b2865d59afe75c7452b5e1f11b8fd3e2a8dcc524e5eb9abff23da182c9e1f3e58dc7c02cb92d8ec6ee318e85fa3c246ce5446261b30a624db27136dece43106

Download Submit
/data/misc/profiles/cur/0/org.zzzz.aaa/primary.prof

Filesize
1KB

MD5
c808cf32b66c19d7d1c0ee8622567e71

SHA1
4487b4de0b5055d076885c91a158054b41d3a5a2

SHA256
3f68d32bde60ff4f3259b49507a4bd48d61804a2d19cf7706de98a323578b37c

SHA512
faa157d709c609f10ebd6067cc55af620a8d06bdccf80d83083c0fcce5c1596341ff26447c680b753abb2eecf95a4431416bac8fa715b3248dd9edaf2d04b0d6

Download Submit
/data/misc/profiles/cur/0/org.zzzz.aaa/primary.prof

Filesize
2KB

MD5
f6fcfa7725dcf842f2113a28a683ba7d

SHA1
eccc143cf1c4b63ddc0353bc9e435f86a054b86c

SHA256
d431bb9a9e7b69fe4a111560d97072d44b1f54a5e550830be0bf74275e3d79c2

SHA512
ce654b9e61f81589be5f20667e29863720042cf45241d95a372145354849fece64ff4b511910057dfe514001ee680d863ebfa007163567391ffd6b08c3ce2ceb

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads