General

  • Target

    042d8d71edc75ee7d63d9884e4b5e012069e75e3ff651f5317f62b293328a019.bin

  • Size

    3.6MB

  • Sample

    240802-1zrtqssdlm

  • MD5

    278f39a14a7cabf6adcfe1efe2a43cc4

  • SHA1

    8567661f9bb090d8ee9a326f34df095c651040a4

  • SHA256

    042d8d71edc75ee7d63d9884e4b5e012069e75e3ff651f5317f62b293328a019

  • SHA512

    8150d1424a6e2233757601d8d93beb6caa93be444d17e43e1a86fdd908b60ffe35b7d06a3d95c2455cd34c1600d1aec6f6114816b331fb6bca8fd19856ad45a7

  • SSDEEP

    98304:2pdlp7qgNdCXFcPLazjGgsqPrjCJXJ45EPPR:WdldqM4F8LazfRSJ5+KR

Malware Config

Targets

    • Target

      042d8d71edc75ee7d63d9884e4b5e012069e75e3ff651f5317f62b293328a019.bin

    • Size

      3.6MB

    • MD5

      278f39a14a7cabf6adcfe1efe2a43cc4

    • SHA1

      8567661f9bb090d8ee9a326f34df095c651040a4

    • SHA256

      042d8d71edc75ee7d63d9884e4b5e012069e75e3ff651f5317f62b293328a019

    • SHA512

      8150d1424a6e2233757601d8d93beb6caa93be444d17e43e1a86fdd908b60ffe35b7d06a3d95c2455cd34c1600d1aec6f6114816b331fb6bca8fd19856ad45a7

    • SSDEEP

      98304:2pdlp7qgNdCXFcPLazjGgsqPrjCJXJ45EPPR:WdldqM4F8LazfRSJ5+KR

    • BlackRock

      BlackRock is an android banker based on Xerxes banking Trojan.

    • BlackRock payload

    • Removes its main activity from the application launcher

    • Loads dropped Dex/Jar

      Runs executable file dropped to the device during analysis.

    • Makes use of the framework's Accessibility service

      Retrieves information displayed on the phone screen using AccessibilityService.

    • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)

    • Acquires the wake lock

    • Performs UI accessibility actions on behalf of the user

      Application may abuse the accessibility service to prevent their removal.

    • Requests enabling of the accessibility settings.

MITRE ATT&CK Mobile v15

Tasks