e769ef0d011cbf3322c9e85d4cdf70af413f021d033aed884c1431f2b7861d0d

General

Target

e769ef0d011cbf3322c9e85d4cdf70af413f021d033aed884c1431f2b7861d0d.apk
Size

5.6MB
MD5

220ec1e3effb6f4a4a3acb6b3b3d2e90
SHA1

c429857766ae7fca8e65e15ad9b1fa691e0b8de7
SHA256

e769ef0d011cbf3322c9e85d4cdf70af413f021d033aed884c1431f2b7861d0d
SHA512

72ae059063abf45284402dc5f55fa281fb64d5a156d166ba155b91007169843bf2da49269c32f5435c8872dee472cc577063b7175e8858bf7205958cc68cfc93
SSDEEP

98304:K3qblT3h/tjtU6GAoNX2OnR03JhSv8TAA4DaoHuZzpIwUfS5J93QMqT5+:BblT3ltBBAlnMc441uFn5X3bqT8

Score

7^/10

banker collection credential_access discovery evasion persistence

Malware Config

Signatures

Makes use of the framework's Accessibility service 4 TTPs 2 IoCs

Retrieves information displayed on the phone screen using AccessibilityService.

collection evasion credential_access

Input Injection

T1516

Screen Capture

T1513

Keylogging

T1417.001

GUI Input Capture

T1417.002

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	com.necapp.lpp4201
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId	com.necapp.lpp4201

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
banker discovery

Security Software Discovery
T1418.001

Acquires the wake lock 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.necapp.lpp4201

Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

Application may abuse the framework's foreground service to continue running in the foreground.

evasion persistence

Foreground Persistence

T1541

description	ioc	Process
Framework service call	android.app.IActivityManager.setServiceForeground	com.necapp.lpp4201

Requests enabling of the accessibility settings. 1 IoCs

description	ioc	Process
Intent action	android.settings.ACCESSIBILITY_SETTINGS	com.necapp.lpp4201

Requests modifying system settings. 1 IoCs

evasion

description	ioc	Process
Intent action	android.settings.action.MANAGE_WRITE_SETTINGS	com.necapp.lpp4201

com.necapp.lpp4201
1⤵
- Makes use of the framework's Accessibility service
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Requests enabling of the accessibility settings.
- Requests modifying system settings.
PID:4337

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Foreground Persistence

1

T1541

Privilege Escalation

Defense Evasion

Foreground Persistence

Input Injection

Credential Access

Input Capture

2

T1417

GUI Input Capture

1

T1417.002

Keylogging

1

T1417.001

Discovery

Software Discovery

1

T1418

Security Software Discovery

1

T1418.001

Lateral Movement

Collection

Input Capture

2

T1417

GUI Input Capture

1

T1417.002

Keylogging

Screen Capture

Command and Control

Exfiltration

Impact

Input Injection

1

T1516

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.necapp.lpp4201/cache/~test.test

Filesize
4B

MD5
098f6bcd4621d373cade4e832627b4f6

SHA1
a94a8fe5ccb19ba61c4c0873d391e987982fbbd3

SHA256
9f86d081884c7d659a2feaa0c55ad015a3bf4f1b2b0b822cd15d6c15b0f00a08

SHA512
ee26b0dd4af7e749aa1a8ee3c10ae9923f618980772e473f8819a5d4940e0db27ac185f8a0e1d5f84f88bc887fd67b143732c304cc5fa9ad8e6f57f50028a8ff

Download Submit
/data/data/com.necapp.lpp4201/files/localdb.db

Filesize
12KB

MD5
e7179ba1abb576a1eb3486db34de4037

SHA1
4dc87664c9be3d7a94d4886b7f56f4a8d7b983dd

SHA256
409f05ab16c6f1f0897959456d72f94a870b03581569f7c4970b22e541db827f

SHA512
50ee847527ad249dcb43d3d95dca9d8bb5bfdc459f6e5d639db4a31895e4f2ad75355451846cb732e380a576f41f1c3af19387cdc9ee7c5e46464c61613e458a

Download Submit
/data/data/com.necapp.lpp4201/files/localdb.db

Filesize
4KB

MD5
7e11f5e484b8033c30a14d7ac98cab88

SHA1
4baf6012a5f88fa9cd7a2b3baf403c1f44c1a6a1

SHA256
84c1c2e80fe7a0a5ce0c6493bd1100d1f5c032b18571ef8344b836f5b1fa580c

SHA512
70c98036e5072c22dbb4ba2efd093acd2500b0c2a418f77782bb6d983ecce7d826cb14c76f333c3e6796f48b2ad4107995bbad315143b3ecb2813194b38e6684

Download Submit
/data/data/com.necapp.lpp4201/files/localdb.db-journal

Filesize
4KB

MD5
8033d1171e38cdf8c4562ff4c7670a41

SHA1
8437a47557381548b9423bc489e73971f9ccb1f7

SHA256
16d44e0fcce0075a410d6689c9fa8f741d1671db640f4577eadb537446267727

SHA512
78533b713b5fa35a3a77772c0ed4128d5f513a033ea52422ecb6e4b0b075aa8f5fdf311d5e2a0d16dcc824450ac5c69c7595fa9aab375c2ad47793eaa523b3c0

Download Submit
/data/data/com.necapp.lpp4201/files/localdb.db-shm

Filesize
32KB

MD5
bb7df04e1b0a2570657527a7e108ae23

SHA1
5188431849b4613152fd7bdba6a3ff0a4fd6424b

SHA256
c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479

SHA512
768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

Download Submit
/data/data/com.necapp.lpp4201/files/localdb.db-wal

Filesize
12KB

MD5
bbd9d6324255b226dc473b4d2fa5a53f

SHA1
cb3c2dfcfc9496c1eb25c6e63db17bc2fddc688a

SHA256
6e4d4122af5c3572764d32f66ad61ba914ed99d0fa1e43c0e51ee04edaf4bee8

SHA512
afac52f32b7c98f1e5bd1304331cc857b2e5b5c29f9a182f83dd327c61069640dc2640ee80297ec96434b85dc23ff6231f701bb48c9b361400006f55965bbb6c

Download Submit
/data/data/com.necapp.lpp4201/files/messdb.db

Filesize
8KB

MD5
57a39108426ea4fb8e5bc74accc22a88

SHA1
73f83c87418acba44a084cb7055fc5c34f6cf25e

SHA256
9d36142e37864417222d54360d821b9a75f31ad31d1f9a45c947edb63ec6b2d2

SHA512
f122d601019b7ee6077574897b51d60cf8223780db64e0649a772183c8025ac413d3ce0683c8bf05373e293cb67ebb62d9dfea15d5d16c495bc0628279709b8a

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads