Analysis
-
max time kernel
179s -
max time network
189s -
platform
android_x64 -
resource
android-x64-arm64-20240624-en -
resource tags
-
submitted
17-07-2024 22:01
General
-
Target
8b05684a73f44ed82c0faf424b2d41a0c7b00c2fef4d7dc232c5433739a59f6c.apk
-
Size
4.5MB
-
MD5
7e7edf3b1f5f0f4bdc77af7a3a5e34c5
-
SHA1
222c048d7c746a4d1d56e9fab8e30d6a87492eac
-
SHA256
8b05684a73f44ed82c0faf424b2d41a0c7b00c2fef4d7dc232c5433739a59f6c
-
SHA512
f7c92063e65c635e37fc21d6418a230ea3023e20a663c75345a99d76428f3e9c84f728010a52d25376484ae28f1525741e316f8be609996c26510961054f988e
-
SSDEEP
98304:X2tqnPP3c6no//hAKQfD0eSD0yD0PD0EQD0nAcD00D0fD0uAl:iMVno/OdfDMDTDqDiDCxD9DGDLAl
Malware Config
Signatures
-
Makes use of the framework's Accessibility service 4 TTPs 2 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs
Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
-
Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
-
Acquires the wake lock 1 IoCs
-
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
-
Performs UI accessibility actions on behalf of the user 1 TTPs 64 IoCs
Application may abuse the accessibility service to prevent their removal.
-
Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.
-
Requests accessing notifications (often used to intercept notifications before users become aware). 1 TTPs 1 IoCs
-
Checks CPU information 2 TTPs 1 IoCs
-
Checks memory information 2 TTPs 1 IoCs
Processes
-
com.nexipaytoken.app1⤵
- Makes use of the framework's Accessibility service
- Obtains sensitive information copied to the device clipboard
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Performs UI accessibility actions on behalf of the user
- Queries information about the current Wi-Fi connection
- Requests accessing notifications (often used to intercept notifications before users become aware).
- Checks CPU information
- Checks memory information
Network
MITRE ATT&CK Mobile v15
Defense Evasion
Foreground Persistence
1Impair Defenses
1Prevent Application Removal
1Input Injection
1Virtualization/Sandbox Evasion
2System Checks
2Credential Access
Access Notifications
1Clipboard Data
1Input Capture
2GUI Input Capture
1Keylogging
1Discovery
Software Discovery
1Security Software Discovery
1System Information Discovery
2System Network Connections Discovery
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
427B
MD5daadafd4adf7c2da3351beb9c3bfb9dd
SHA16673c20620fdc3dd31a1ec9d78392c3d46cb2f50
SHA256f1251b8332a1b29c67682c9e1f9975ab0f611395e24534cc6168b68e778192f1
SHA512faafe0145ee0fe888e0829123266dc65348270fdf51a494378d3195b6c86fee5c52a4ca2cfd3e162e0eee25c570d947b8270ff08636bc25339757cfc2f9ccdb7
-
Filesize
4B
MD5098f6bcd4621d373cade4e832627b4f6
SHA1a94a8fe5ccb19ba61c4c0873d391e987982fbbd3
SHA2569f86d081884c7d659a2feaa0c55ad015a3bf4f1b2b0b822cd15d6c15b0f00a08
SHA512ee26b0dd4af7e749aa1a8ee3c10ae9923f618980772e473f8819a5d4940e0db27ac185f8a0e1d5f84f88bc887fd67b143732c304cc5fa9ad8e6f57f50028a8ff
-
Filesize
44KB
MD5d5d190e1180c5e6858c40a93f7526f12
SHA10d054f2e34776c8d5bcfd54d743831b9919618fe
SHA256274fe3e82fc2630d99809afd6a1c64768a77ed69c04b33e0df6a292a5a042203
SHA5120d58df37359d6e35f02ef95e4edcfb05fac6c3bc57d1c3e56e49fa7b6c66aef3f99b383cb14dc5a01b52bc6a0d4685f275fb30279aa26e8339a5e0b8416ba85e
-
Filesize
41KB
MD534bb1610eea1e6643d8d811d7bfbd72c
SHA113231a124318b6ea3527398bc3928d12385a6f81
SHA256a5531b75e566fa6a114888530c9e27fd906d87eb81ee472400edc5c3dccea34e
SHA512d78aaf696db600cb7737487d35bd1d4fc26ca2d6879dfd0938e257230e04eb8b8f65d76e7ce2d0fe0c8f7669464ab86e2400b199091467d1a6ced653c6d75f57
-
Filesize
11B
MD51b65c10c6215685f9d621d797f911373
SHA1cc50aaed5cd521a62ec8cf9fe0413153ec90f265
SHA2562230c2b2787663a054c47450ecd1718f0296853ad768b8e5d306ecb912685e89
SHA5125a9139f295dbe384b1584eff5c11f3f86759232f7b661b75f27fe92b996b4cdc0552e315f79b26f5f2c1f91756d9ae04cf0c3675b6172e91a3d373b9b314496f
