gigabud | c6213e451e4a23b7725143edd1c725aa748fd9eb32e33304b4f87d63c19e0504 | Triage

Resubmissions

29/08/2024, 22:52

240829-2tw2yavhnb 10

29/08/2024, 06:19

240829-g3gcmaxeke 10

Sharing

General

Target

appα╕¢α╕Ñα╕¡α╕íα╕üα╕úα╕íα╕ùα╕╡α╣êα╕öα╕┤α╕Ö_DOL.apk
Size

11.9MB
Sample

240829-2tw2yavhnb
MD5

2e6530985058179a8adf2bb1e729d516
SHA1

1ac24292df9fb97a07472281378ca460d3a419a0
SHA256

c6213e451e4a23b7725143edd1c725aa748fd9eb32e33304b4f87d63c19e0504
SHA512

99c9b1be06f063227d8c6e84056ada5d44284bcceafa22ff15895d1281f042b4d2452d0fcdc1ab4a5ac285c86d53c75182c95db83794685e1678dc3a64dfb3bb
SSDEEP

196608:laQ8jJjB6zkZHOmwZuXJi5J8qUN5+C8uBbXxm1B10wDQCr8wGj6yIkjF:la/NsSa38qUN5Dhg10w0wGj0A

Score

10^/10

gigabud android banker collection credential_access discovery evasion impact persistence

Malware Config

Targets

- Target
  
  appα╕¢α╕Ñα╕¡α╕íα╕üα╕úα╕íα╕ùα╕╡α╣êα╕öα╕┤α╕Ö_DOL.apk
- Size
  
  11.9MB
- MD5
  
  2e6530985058179a8adf2bb1e729d516
- SHA1
  
  1ac24292df9fb97a07472281378ca460d3a419a0
- SHA256
  
  c6213e451e4a23b7725143edd1c725aa748fd9eb32e33304b4f87d63c19e0504
- SHA512
  
  99c9b1be06f063227d8c6e84056ada5d44284bcceafa22ff15895d1281f042b4d2452d0fcdc1ab4a5ac285c86d53c75182c95db83794685e1678dc3a64dfb3bb
- SSDEEP
  
  196608:laQ8jJjB6zkZHOmwZuXJi5J8qUN5+C8uBbXxm1B10wDQCr8wGj6yIkjF:la/NsSa38qUN5Dhg10w0wGj0A
Score

7^/10

banker discovery evasion impact persistence collection credential_access
- Makes use of the framework's Accessibility service
  Retrieves information displayed on the phone screen using AccessibilityService.
  collection evasion credential_access
- Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)
  banker discovery
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
  Application may abuse the framework's foreground service to continue running in the foreground.
  evasion persistence
- Queries information about active data network
  discovery
- Reads information about phone network operator.
  discovery
behavioral1 behavioral2 behavioral3 behavioral4

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Event Triggered Execution

Broadcast Receivers

Foreground Persistence

Privilege Escalation

Defense Evasion

Foreground Persistence

Input Injection

Credential Access

Input Capture

GUI Input Capture

Keylogging

Discovery

Software Discovery

Security Software Discovery

System Network Configuration Discovery

System Network Connections Discovery

Lateral Movement

Collection

Input Capture

GUI Input Capture

Keylogging

Screen Capture

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

Input Injection

Tasks

static1

behavioral1

behavioral2

bankerdiscoveryevasionimpactpersistence

behavioral3

bankercollectioncredential_accessdiscoveryevasionimpactpersistence

behavioral4

impactpersistence