2e1e50d16334211e1929bde46ed56185bf1c75bc0e1525d845db46c6175e4dfd | Triage

Sharing

General

Target

2e1e50d16334211e1929bde46ed56185bf1c75bc0e1525d845db46c6175e4dfd.bin
Size

1.3MB
Sample

240805-1ygmdateja
MD5

129a40699a540410993bda6696a602c7
SHA1

0ef695d685c770ad5063540227090692cf19a50d
SHA256

2e1e50d16334211e1929bde46ed56185bf1c75bc0e1525d845db46c6175e4dfd
SHA512

0bc43aa523f9f843205507f7bf9d6c3fbe48e4e62d039919059f4909fe45acfa34793b4464c421eb68b3bf8a38eebb8644e5c3deff2dab2790cf1464fcb48910
SSDEEP

24576:L5YkQxt0EfI/CCh78J78MrkU8I6W+EPilQZhL7ZWKugV2KZjgqmO/x4ku74nr:L5YkQxt0EfI6y8J2U8I63QhZWVg0KZj3

Score

8^/10

android collection credential_access discovery evasion persistence stealth trojan

Malware Config

Targets

- Target
  
  2e1e50d16334211e1929bde46ed56185bf1c75bc0e1525d845db46c6175e4dfd.bin
- Size
  
  1.3MB
- MD5
  
  129a40699a540410993bda6696a602c7
- SHA1
  
  0ef695d685c770ad5063540227090692cf19a50d
- SHA256
  
  2e1e50d16334211e1929bde46ed56185bf1c75bc0e1525d845db46c6175e4dfd
- SHA512
  
  0bc43aa523f9f843205507f7bf9d6c3fbe48e4e62d039919059f4909fe45acfa34793b4464c421eb68b3bf8a38eebb8644e5c3deff2dab2790cf1464fcb48910
- SSDEEP
  
  24576:L5YkQxt0EfI/CCh78J78MrkU8I6W+EPilQZhL7ZWKugV2KZjgqmO/x4ku74nr:L5YkQxt0EfI6y8J2U8I63QhZWVg0KZj3
Score

8^/10

discovery evasion persistence stealth trojan collection credential_access
- Removes its main activity from the application launcher
  stealth trojan evasion
- Makes use of the framework's Accessibility service
  Retrieves information displayed on the phone screen using AccessibilityService.
  collection evasion credential_access
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Queries information about active data network
  discovery
- Queries the mobile country code (MCC)
  discovery
- Reads information about phone network operator.
  discovery
- Requests enabling of the accessibility settings.
behavioral1 behavioral2 behavioral3

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Event Triggered Execution

Broadcast Receivers

Privilege Escalation

Defense Evasion

Hide Artifacts

Suppress Application Icon

Input Injection

Credential Access

Input Capture

GUI Input Capture

Keylogging

Discovery

System Network Configuration Discovery

System Network Connections Discovery

Lateral Movement

Collection

Input Capture

GUI Input Capture

Keylogging

Screen Capture

Command and Control

Exfiltration

Impact

Input Injection

Tasks

static1

behavioral1

discoveryevasionpersistencestealthtrojan

behavioral2

collectioncredential_accessdiscoveryevasionpersistencestealthtrojan

behavioral3

collectioncredential_accessdiscoveryevasionstealthtrojan