Overview

overview

10

Static

static

10

230f3d7400...d1.apk

android-9-x86

7

230f3d7400...d1.apk

android-10-x64

7

230f3d7400...d1.apk

android-11-x64

7

Sharing

Copy URL
Twitter E-mail

General

  • Target

    230f3d74004fee235055e786aba413abff2ed5cf4faa1987a070493be28c75d1.apk

  • Size

    4.5MB

  • Sample

    240916-bfg3ra1dqa

  • MD5

    d55ee912c682c9c6aecec279681c6443

  • SHA1

    0bdba6764e5384f8810a7006899cb667f7abed69

  • SHA256

    230f3d74004fee235055e786aba413abff2ed5cf4faa1987a070493be28c75d1

  • SHA512

    5660978c9af7a699f45462591bdca8e34b1f7e764b726cda02778317f476f18ed4c94a3ff5245b96336d3d8563be77e0d5fbc2db24b94ec2ea61c1f7a2fa898d

  • SSDEEP

    98304:oGZm/UcvLXo+yDW1AN9mfg2rpD0eDD0LD0+D0EFD0nAFD0BD02D01zD:oGZs/0XDWKXwDRDKDrDDDCoDgDvDQzD

Score
10/10
irataandroidcollectioncredential_accessdiscoveryevasionimpactpersistence

Malware Config

Targets

    • Target

      230f3d74004fee235055e786aba413abff2ed5cf4faa1987a070493be28c75d1.apk

    • Size

      4.5MB

    • MD5

      d55ee912c682c9c6aecec279681c6443

    • SHA1

      0bdba6764e5384f8810a7006899cb667f7abed69

    • SHA256

      230f3d74004fee235055e786aba413abff2ed5cf4faa1987a070493be28c75d1

    • SHA512

      5660978c9af7a699f45462591bdca8e34b1f7e764b726cda02778317f476f18ed4c94a3ff5245b96336d3d8563be77e0d5fbc2db24b94ec2ea61c1f7a2fa898d

    • SSDEEP

      98304:oGZm/UcvLXo+yDW1AN9mfg2rpD0eDD0LD0+D0EFD0nAFD0BD02D01zD:oGZs/0XDWKXwDRDKDrDDDCoDgDvDQzD

    Score
    7/10
    collectioncredential_accessdiscoveryevasionpersistenceimpact

    • Makes use of the framework's Accessibility service

      Retrieves information displayed on the phone screen using AccessibilityService.

      collectionevasioncredential_access

    • Obtains sensitive information copied to the device clipboard

      Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.

      collectioncredential_accessimpact

    • Acquires the wake lock

    • Performs UI accessibility actions on behalf of the user

      Application may abuse the accessibility service to prevent their removal.

      evasion

    • Queries the mobile country code (MCC)

      discovery

    • Requests accessing notifications (often used to intercept notifications before users become aware).

      collectioncredential_access
    behavioral1behavioral2behavioral3

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Event Triggered Execution

1
T1624

Broadcast Receivers

1
T1624.001

Privilege Escalation

Defense Evasion

Impair Defenses

1
T1629

Prevent Application Removal

1
T1629.001

Input Injection

1
T1516

Virtualization/Sandbox Evasion

2
T1633

System Checks

2
T1633.001

Credential Access

Access Notifications

1
T1517

Clipboard Data

1
T1414

Input Capture

2
T1417

GUI Input Capture

1
T1417.002

Keylogging

1
T1417.001

Discovery

System Information Discovery

2
T1426

System Network Configuration Discovery

1
T1422

Lateral Movement

Collection

Access Notifications

1
T1517

Clipboard Data

1
T1414

Input Capture

2
T1417

GUI Input Capture

1
T1417.002

Keylogging

1
T1417.001

Screen Capture

1
T1513

Command and Control

Exfiltration

Impact

Data Manipulation

1
T1641

Transmitted Data Manipulation

1
T1641.001

Input Injection

1
T1516

Tasks