e769ef0d011cbf3322c9e85d4cdf70af413f021d033aed884c1431f2b7861d0d

Resubmissions

20-08-2024 14:07

240820-re1rgazcjl 10

29-07-2024 14:34

240729-rxelyssfpk 10

Analysis

max time kernel
17s
max time network
87s
platform
android_x86
resource
android-x86-arm-20240624-en
resource tags

androidarch:armarch:x86image:android-x86-arm-20240624-enlocale:en-usos:android-9-x86system
submitted
20-08-2024 14:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e769ef0d011cbf3322c9e85d4cdf70af413f021d033aed884c1431f2b7861d0d.apk
Size

5.6MB
MD5

220ec1e3effb6f4a4a3acb6b3b3d2e90
SHA1

c429857766ae7fca8e65e15ad9b1fa691e0b8de7
SHA256

e769ef0d011cbf3322c9e85d4cdf70af413f021d033aed884c1431f2b7861d0d
SHA512

72ae059063abf45284402dc5f55fa281fb64d5a156d166ba155b91007169843bf2da49269c32f5435c8872dee472cc577063b7175e8858bf7205958cc68cfc93
SSDEEP

98304:K3qblT3h/tjtU6GAoNX2OnR03JhSv8TAA4DaoHuZzpIwUfS5J93QMqT5+:BblT3ltBBAlnMc441uFn5X3bqT8

Score

7^/10

collection credential_access evasion persistence

Malware Config

Signatures

Makes use of the framework's Accessibility service 4 TTPs 2 IoCs

Retrieves information displayed on the phone screen using AccessibilityService.

collection evasion credential_access

Input Injection

T1516

Screen Capture

T1513

Keylogging

T1417.001

GUI Input Capture

T1417.002

Processes:

com.necapp.lpp4201

description	ioc	process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	com.necapp.lpp4201
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId	com.necapp.lpp4201

Acquires the wake lock 1 IoCs

Processes:

com.necapp.lpp4201

description ioc process

Framework service call android.os.IPowerManager.acquireWakeLock com.necapp.lpp4201
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
evasion persistence

Foreground Persistence
T1541

Processes:

com.necapp.lpp4201

description ioc process

Framework service call android.app.IActivityManager.setServiceForeground com.necapp.lpp4201
Performs UI accessibility actions on behalf of the user 1 TTPs 1 IoCs
Application may abuse the accessibility service to prevent their removal.
evasion

Prevent Application Removal
T1629.001

Processes:

com.necapp.lpp4201

ioc process

android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction com.necapp.lpp4201
Requests enabling of the accessibility settings. 1 IoCs

Processes:

com.necapp.lpp4201

description ioc process

Intent action android.settings.ACCESSIBILITY_SETTINGS com.necapp.lpp4201
Requests modifying system settings. 1 IoCs
evasion

Processes:

com.necapp.lpp4201

description ioc process

Intent action android.settings.action.MANAGE_WRITE_SETTINGS com.necapp.lpp4201

description	ioc	process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.necapp.lpp4201

description	ioc	process
Framework service call	android.app.IActivityManager.setServiceForeground	com.necapp.lpp4201

ioc	process
android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction	com.necapp.lpp4201

description	ioc	process
Intent action	android.settings.ACCESSIBILITY_SETTINGS	com.necapp.lpp4201

description	ioc	process
Intent action	android.settings.action.MANAGE_WRITE_SETTINGS	com.necapp.lpp4201

com.necapp.lpp4201
1⤵
- Makes use of the framework's Accessibility service
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Performs UI accessibility actions on behalf of the user
- Requests enabling of the accessibility settings.
- Requests modifying system settings.
PID:4308

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Foreground Persistence

T1541

Privilege Escalation

Defense Evasion

Foreground Persistence

T1541

Impair Defenses

T1629

Prevent Application Removal

T1629.001

Input Injection

T1516

Credential Access

Input Capture

T1417

GUI Input Capture

T1417.002

Keylogging

T1417.001

Discovery

Lateral Movement

Collection

Input Capture

T1417

GUI Input Capture

T1417.002

Keylogging

T1417.001

Screen Capture

T1513

Command and Control

Exfiltration

Impact

Input Injection

T1516

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.necapp.lpp4201/files/localdb.db
Filesize
12KB

MD5
e7179ba1abb576a1eb3486db34de4037

SHA1
4dc87664c9be3d7a94d4886b7f56f4a8d7b983dd

SHA256
409f05ab16c6f1f0897959456d72f94a870b03581569f7c4970b22e541db827f

SHA512
50ee847527ad249dcb43d3d95dca9d8bb5bfdc459f6e5d639db4a31895e4f2ad75355451846cb732e380a576f41f1c3af19387cdc9ee7c5e46464c61613e458a

Download Submit
/data/data/com.necapp.lpp4201/files/localdb.db
Filesize
4KB

MD5
7e11f5e484b8033c30a14d7ac98cab88

SHA1
4baf6012a5f88fa9cd7a2b3baf403c1f44c1a6a1

SHA256
84c1c2e80fe7a0a5ce0c6493bd1100d1f5c032b18571ef8344b836f5b1fa580c

SHA512
70c98036e5072c22dbb4ba2efd093acd2500b0c2a418f77782bb6d983ecce7d826cb14c76f333c3e6796f48b2ad4107995bbad315143b3ecb2813194b38e6684

Download Submit
/data/data/com.necapp.lpp4201/files/localdb.db-journal
Filesize
4KB

MD5
7c73f688ae59dfed9c799fa6a05b8f63

SHA1
eff84b28c27a7143b562ef5a236b621579cf284b

SHA256
a263f5ea09236b5d8cbd51298e97b44627d6d41dc20a8aa82ba4b817cd1a27fb

SHA512
5fac1e0117eeb0f252d68067591673a0eebd52e231ad95f07d41f863a2caedfdc9660fc9057ab5f4d47d7ebce3ed9eefd664c7200bb1d7d1ae834dcdcb4d3e30

Download Submit
/data/data/com.necapp.lpp4201/files/localdb.db-shm
Filesize
32KB

MD5
bb7df04e1b0a2570657527a7e108ae23

SHA1
5188431849b4613152fd7bdba6a3ff0a4fd6424b

SHA256
c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479

SHA512
768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

Download Submit
/data/data/com.necapp.lpp4201/files/localdb.db-wal
Filesize
4KB

MD5
8749fe2cf9224e5db84a4d11d40fdbd5

SHA1
8405c3bc53121d8396d6f3e2a58bf8a7b136bdb3

SHA256
7843c46c8fe234bd2a183e3c3b5d6aa34a065bfe1e971d78435fb41f0a287faf

SHA512
a39182b52d185ac897ba4845028970bf7a90fdcb2552e758cd575b9a518aa3aa8799f11778d0192c43a371829aeb2145a1b3f0d85a0dfeff0694b18f54513f68

Download Submit
/data/data/com.necapp.lpp4201/files/messdb.db
Filesize
8KB

MD5
57a39108426ea4fb8e5bc74accc22a88

SHA1
73f83c87418acba44a084cb7055fc5c34f6cf25e

SHA256
9d36142e37864417222d54360d821b9a75f31ad31d1f9a45c947edb63ec6b2d2

SHA512
f122d601019b7ee6077574897b51d60cf8223780db64e0649a772183c8025ac413d3ce0683c8bf05373e293cb67ebb62d9dfea15d5d16c495bc0628279709b8a

Download Submit