e769ef0d011cbf3322c9e85d4cdf70af413f021d033aed884c1431f2b7861d0d

Analysis

max time kernel
90s
max time network
97s
platform
android_x64
resource
android-x64-20240624-en
resource tags

androidarch:x64arch:x86image:android-x64-20240624-enlocale:en-usos:android-10-x64system
submitted
17-07-2024 13:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e769ef0d011cbf3322c9e85d4cdf70af413f021d033aed884c1431f2b7861d0d.apk
Size

5.6MB
MD5

220ec1e3effb6f4a4a3acb6b3b3d2e90
SHA1

c429857766ae7fca8e65e15ad9b1fa691e0b8de7
SHA256

e769ef0d011cbf3322c9e85d4cdf70af413f021d033aed884c1431f2b7861d0d
SHA512

72ae059063abf45284402dc5f55fa281fb64d5a156d166ba155b91007169843bf2da49269c32f5435c8872dee472cc577063b7175e8858bf7205958cc68cfc93
SSDEEP

98304:K3qblT3h/tjtU6GAoNX2OnR03JhSv8TAA4DaoHuZzpIwUfS5J93QMqT5+:BblT3ltBBAlnMc441uFn5X3bqT8

Score

7^/10

banker collection credential_access discovery evasion persistence

Malware Config

Signatures

Makes use of the framework's Accessibility service 4 TTPs 2 IoCs

Retrieves information displayed on the phone screen using AccessibilityService.

collection evasion credential_access

Input Injection

T1516

Screen Capture

T1513

Keylogging

T1417.001

GUI Input Capture

T1417.002

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	com.necapp.lpp4201
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId	com.necapp.lpp4201

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
banker discovery

Security Software Discovery
T1418.001

Acquires the wake lock 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.necapp.lpp4201

Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

Application may abuse the framework's foreground service to continue running in the foreground.

evasion persistence

Foreground Persistence

T1541

description	ioc	Process
Framework service call	android.app.IActivityManager.setServiceForeground	com.necapp.lpp4201

com.necapp.lpp4201
1⤵
- Makes use of the framework's Accessibility service
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
PID:4930

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Foreground Persistence

T1541

Privilege Escalation

Defense Evasion

Foreground Persistence

T1541

Input Injection

T1516

Credential Access

Input Capture

T1417

GUI Input Capture

T1417.002

Keylogging

T1417.001

Discovery

Software Discovery

T1418

Security Software Discovery

T1418.001

Lateral Movement

Collection

Input Capture

T1417

GUI Input Capture

T1417.002

Keylogging

T1417.001

Screen Capture

T1513

Command and Control

Exfiltration

Impact

Input Injection

T1516

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.necapp.lpp4201/cache/~test.test

Filesize
4B

MD5
098f6bcd4621d373cade4e832627b4f6

SHA1
a94a8fe5ccb19ba61c4c0873d391e987982fbbd3

SHA256
9f86d081884c7d659a2feaa0c55ad015a3bf4f1b2b0b822cd15d6c15b0f00a08

SHA512
ee26b0dd4af7e749aa1a8ee3c10ae9923f618980772e473f8819a5d4940e0db27ac185f8a0e1d5f84f88bc887fd67b143732c304cc5fa9ad8e6f57f50028a8ff

Download Submit
/data/data/com.necapp.lpp4201/files/localdb.db

Filesize
8KB

MD5
eb739e481d1ea199b5f3cf8b3854abc4

SHA1
1c970a9906cb0053c70f7f41f1ad44a32949e09c

SHA256
2e5b2a9db61691cdcb5bd9ebb816e1f3132f2c7b092edf0056dd97eb8daedfd5

SHA512
52b7419cdb5c8f2efe684aac58a9d826e630c00de2033a688f9191ba55e0520e6afec9567478f42fbb53c88f4e08fdf1c59f20f60a51b30cd9fdcb662a3536e6

Download Submit
/data/data/com.necapp.lpp4201/files/localdb.db

Filesize
12KB

MD5
e7179ba1abb576a1eb3486db34de4037

SHA1
4dc87664c9be3d7a94d4886b7f56f4a8d7b983dd

SHA256
409f05ab16c6f1f0897959456d72f94a870b03581569f7c4970b22e541db827f

SHA512
50ee847527ad249dcb43d3d95dca9d8bb5bfdc459f6e5d639db4a31895e4f2ad75355451846cb732e380a576f41f1c3af19387cdc9ee7c5e46464c61613e458a

Download Submit
/data/data/com.necapp.lpp4201/files/localdb.db

Filesize
8KB

MD5
443ddec5ccf7bc467aeecd4a3ac64735

SHA1
614051b1b376fe33ac7098513a6416381c84b30c

SHA256
5cbab2493af9f61591b1e282d660cfedb2ad4fffc26bda04ddfc911f19201968

SHA512
d2d3c0951be14137260498e3546c7432b4d3952a0a8197db4078232a9caea2bccec5e05b87fb8b0d64cce96f833bf95488a2ba5d0ebdbe04f8f9e4f9432717bc

Download Submit
/data/data/com.necapp.lpp4201/files/localdb.db-journal

Filesize
8KB

MD5
d61c3f1cbd3ae13d5198618dd6d61774

SHA1
3626a8ec2c8f667c22b76bc0c547cee2df8dd8a7

SHA256
d610e8b540fbdddda5c18cdf9e7e919b14fcdc114df413bcbcad2b07a4288e11

SHA512
a32a30f6a8e64aaf35ccf7e5b8a3f0397c7f97adcdca569a067de8c98b17162427a961fb360a45aa2c4ffd9dbd90655e2da341d4ead1d9e2b4f0fe05a64b8aaa

Download Submit
/data/data/com.necapp.lpp4201/files/localdb.db-journal

Filesize
8KB

MD5
845bf8610f32eaaab6b987c81a47f384

SHA1
ec1d9274e2d2f5b3683d0e92a47289db1139cde0

SHA256
91135a7f5a6bfb992f3cb81855c4828f354a81d5071634fc856cc698806a096a

SHA512
82bd1034b0c742d255a1e08716ec7dd044ea8c0ef7702857b66280bdc5b8cae24e5d2586886f714a9136e00e00cdc57ed6b7619108af31c1b125f02a552e69f4

Download Submit
/data/data/com.necapp.lpp4201/files/localdb.db-journal

Filesize
8KB

MD5
22af6a3130c5311cd180f7e531e93826

SHA1
7e1c7b58d3938d225bbd0b8f294d700fd8e22716

SHA256
426a97e34f8458de130f4897203377c7deb80249fe59de54207786f6b76407b5

SHA512
7bc842fd1dbd7b637534c7a7b8f94a4bd4c0d58b5de4546d3798ab807c46bbc8ea016720556efd1982f63eb2475511a2c1b17ec9005d8319c3f05f169aa61ccf

Download Submit
/data/data/com.necapp.lpp4201/files/localdb.db-journal

Filesize
8KB

MD5
60cb39ecb4d96adc3bae29604a26e460

SHA1
f8ecd1efc62906014cb8c73120c1a63027bfad70

SHA256
9320c59d6147da0ea33c163949d630b37536e011289f1a929ae2cb78c888570c

SHA512
89581b66c11f7937bb8f51a7d1b15f49a692598ad8272bff9085da36b0fe9f677c3deddc555d4693c80f486021f3f5e4cc6160cffbf0a489a2f674db658c17ad

Download Submit
/data/data/com.necapp.lpp4201/files/localdb.db-journal

Filesize
8KB

MD5
c1526f361577dafe385d6951c15ec0a9

SHA1
67b1d2fda299caca4d3e6d0bfd555e4546a14320

SHA256
35dceb0384f128b27b6956b44a09295d480fc8db2ce3739b4340f19579fb755e

SHA512
358ae9c20e385b2cf25cb18a21d4ee4deacb49f7f727e07309234229ebf3c7a22d3a2585e31fdb37313a5ad128728b5ef35d07f12d8109e3ee8c1416774ad8a6

Download Submit
/data/data/com.necapp.lpp4201/files/localdb.db-journal

Filesize
8KB

MD5
6cdfedb6b80a7ab6fa625d797ba2841e

SHA1
33f09b2feb93fa328d3e148d900b3f33eee1f594

SHA256
59ab946e5e073cc490fa8112df4ee073d27df02e159f4240c5651de11aa91fcc

SHA512
0aed038f650c794c8d4c8e46a1fff5764939e5958fb2bfe8b094627b0ae959fa595db5b5fa86d55cc4ceab49ea52f3983cf89de62bbcf839784b4af288d5f791

Download Submit
/data/data/com.necapp.lpp4201/files/messdb.db

Filesize
8KB

MD5
57a39108426ea4fb8e5bc74accc22a88

SHA1
73f83c87418acba44a084cb7055fc5c34f6cf25e

SHA256
9d36142e37864417222d54360d821b9a75f31ad31d1f9a45c947edb63ec6b2d2

SHA512
f122d601019b7ee6077574897b51d60cf8223780db64e0649a772183c8025ac413d3ce0683c8bf05373e293cb67ebb62d9dfea15d5d16c495bc0628279709b8a

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads