e769ef0d011cbf3322c9e85d4cdf70af413f021d033aed884c1431f2b7861d0d

Resubmissions

20-08-2024 14:07

240820-re1rgazcjl 10

29-07-2024 14:34

240729-rxelyssfpk 10

Analysis

max time kernel
14s
max time network
183s
platform
android_x86
resource
android-x86-arm-20240624-en
resource tags

androidarch:armarch:x86image:android-x86-arm-20240624-enlocale:en-usos:android-9-x86system
submitted
29-07-2024 14:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e769ef0d011cbf3322c9e85d4cdf70af413f021d033aed884c1431f2b7861d0d.apk
Size

5.6MB
MD5

220ec1e3effb6f4a4a3acb6b3b3d2e90
SHA1

c429857766ae7fca8e65e15ad9b1fa691e0b8de7
SHA256

e769ef0d011cbf3322c9e85d4cdf70af413f021d033aed884c1431f2b7861d0d
SHA512

72ae059063abf45284402dc5f55fa281fb64d5a156d166ba155b91007169843bf2da49269c32f5435c8872dee472cc577063b7175e8858bf7205958cc68cfc93
SSDEEP

98304:K3qblT3h/tjtU6GAoNX2OnR03JhSv8TAA4DaoHuZzpIwUfS5J93QMqT5+:BblT3ltBBAlnMc441uFn5X3bqT8

Score

7^/10

collection credential_access evasion persistence

Malware Config

Signatures

Makes use of the framework's Accessibility service 4 TTPs 1 IoCs

Retrieves information displayed on the phone screen using AccessibilityService.

collection evasion credential_access

Input Injection

T1516

Screen Capture

T1513

Keylogging

T1417.001

GUI Input Capture

T1417.002

Processes:

com.necapp.lpp4201

description	ioc	process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	com.necapp.lpp4201

Acquires the wake lock 1 IoCs

Processes:

com.necapp.lpp4201

description ioc process

Framework service call android.os.IPowerManager.acquireWakeLock com.necapp.lpp4201
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
evasion persistence

Foreground Persistence
T1541

Processes:

com.necapp.lpp4201

description ioc process

Framework service call android.app.IActivityManager.setServiceForeground com.necapp.lpp4201

description	ioc	process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.necapp.lpp4201

description	ioc	process
Framework service call	android.app.IActivityManager.setServiceForeground	com.necapp.lpp4201

com.necapp.lpp4201
1⤵
- Makes use of the framework's Accessibility service
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
PID:4244

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Foreground Persistence

T1541

Privilege Escalation

Defense Evasion

Foreground Persistence

T1541

Input Injection

T1516

Credential Access

Input Capture

T1417

GUI Input Capture

T1417.002

Keylogging

T1417.001

Discovery

Lateral Movement

Collection

Input Capture

T1417

GUI Input Capture

T1417.002

Keylogging

T1417.001

Screen Capture

T1513

Command and Control

Exfiltration

Impact

Input Injection

T1516

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.necapp.lpp4201/files/localdb.db

Filesize
12KB

MD5
e7179ba1abb576a1eb3486db34de4037

SHA1
4dc87664c9be3d7a94d4886b7f56f4a8d7b983dd

SHA256
409f05ab16c6f1f0897959456d72f94a870b03581569f7c4970b22e541db827f

SHA512
50ee847527ad249dcb43d3d95dca9d8bb5bfdc459f6e5d639db4a31895e4f2ad75355451846cb732e380a576f41f1c3af19387cdc9ee7c5e46464c61613e458a

Download Submit
/data/data/com.necapp.lpp4201/files/localdb.db

Filesize
4KB

MD5
7e11f5e484b8033c30a14d7ac98cab88

SHA1
4baf6012a5f88fa9cd7a2b3baf403c1f44c1a6a1

SHA256
84c1c2e80fe7a0a5ce0c6493bd1100d1f5c032b18571ef8344b836f5b1fa580c

SHA512
70c98036e5072c22dbb4ba2efd093acd2500b0c2a418f77782bb6d983ecce7d826cb14c76f333c3e6796f48b2ad4107995bbad315143b3ecb2813194b38e6684

Download Submit
/data/data/com.necapp.lpp4201/files/localdb.db-journal

Filesize
4KB

MD5
a19c324fc5ac6d5f86b112f15c5b1bf3

SHA1
0b9e937f9e4229b76fa6531e79d5cfb5c54603c4

SHA256
87f2465c65d6fe53bcc3ffcd5d6ef28b7fadbaf9df52a323d7355932d0db4b90

SHA512
f8566594e6cf769baf383f8f54c2926117ec27bd55e3ab04c7a1dac525601931654637cba38ce04b439382309d808b677445b3fb19c2dbd3cddf4b81cf02d50a

Download Submit
/data/data/com.necapp.lpp4201/files/localdb.db-shm

Filesize
28KB

MD5
cf845a781c107ec1346e849c9dd1b7e8

SHA1
b44ccc7f7d519352422e59ee8b0bdbac881768a7

SHA256
18619b678a5c207a971a0aa931604f48162e307c57ecdec450d5f095fe9f32c7

SHA512
4802861ea06dc7fb85229a3c8f04e707a084f1ba516510c6f269821b33c8ee4ebf495258fe5bee4850668a5aac1a45f0edf51580da13b7ee160a29d067c67612

Download Submit