e769ef0d011cbf3322c9e85d4cdf70af413f021d033aed884c1431f2b7861d0d

Analysis

max time kernel
97s
max time network
104s
platform
android_x64
resource
android-x64-20240624-en
resource tags

androidarch:x64arch:x86image:android-x64-20240624-enlocale:en-usos:android-10-x64system
submitted
20-09-2024 10:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

220ec1e3effb6f4a4a3acb6b3b3d2e90.apk
Size

5.6MB
MD5

220ec1e3effb6f4a4a3acb6b3b3d2e90
SHA1

c429857766ae7fca8e65e15ad9b1fa691e0b8de7
SHA256

e769ef0d011cbf3322c9e85d4cdf70af413f021d033aed884c1431f2b7861d0d
SHA512

72ae059063abf45284402dc5f55fa281fb64d5a156d166ba155b91007169843bf2da49269c32f5435c8872dee472cc577063b7175e8858bf7205958cc68cfc93
SSDEEP

98304:K3qblT3h/tjtU6GAoNX2OnR03JhSv8TAA4DaoHuZzpIwUfS5J93QMqT5+:BblT3ltBBAlnMc441uFn5X3bqT8

Score

7^/10

banker collection credential_access discovery evasion persistence

Malware Config

Signatures

Makes use of the framework's Accessibility service 4 TTPs 2 IoCs

Retrieves information displayed on the phone screen using AccessibilityService.

collection evasion credential_access

Input Injection

T1516

Screen Capture

T1513

Keylogging

T1417.001

GUI Input Capture

T1417.002

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId	com.necapp.lpp4201
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	com.necapp.lpp4201

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
banker discovery

Security Software Discovery
T1418.001

Acquires the wake lock 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.necapp.lpp4201

Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

Application may abuse the framework's foreground service to continue running in the foreground.

evasion persistence

Foreground Persistence

T1541

description	ioc	Process
Framework service call	android.app.IActivityManager.setServiceForeground	com.necapp.lpp4201

com.necapp.lpp4201
1⤵
- Makes use of the framework's Accessibility service
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
PID:4999

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Foreground Persistence

T1541

Privilege Escalation

Defense Evasion

Foreground Persistence

T1541

Input Injection

T1516

Credential Access

Input Capture

T1417

GUI Input Capture

T1417.002

Keylogging

T1417.001

Discovery

Software Discovery

T1418

Security Software Discovery

T1418.001

Lateral Movement

Collection

Input Capture

T1417

GUI Input Capture

T1417.002

Keylogging

T1417.001

Screen Capture

T1513

Command and Control

Exfiltration

Impact

Input Injection

T1516

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.necapp.lpp4201/cache/~test.test

Filesize
4B

MD5
098f6bcd4621d373cade4e832627b4f6

SHA1
a94a8fe5ccb19ba61c4c0873d391e987982fbbd3

SHA256
9f86d081884c7d659a2feaa0c55ad015a3bf4f1b2b0b822cd15d6c15b0f00a08

SHA512
ee26b0dd4af7e749aa1a8ee3c10ae9923f618980772e473f8819a5d4940e0db27ac185f8a0e1d5f84f88bc887fd67b143732c304cc5fa9ad8e6f57f50028a8ff

Download Submit
/data/data/com.necapp.lpp4201/files/localdb.db

Filesize
12KB

MD5
e7179ba1abb576a1eb3486db34de4037

SHA1
4dc87664c9be3d7a94d4886b7f56f4a8d7b983dd

SHA256
409f05ab16c6f1f0897959456d72f94a870b03581569f7c4970b22e541db827f

SHA512
50ee847527ad249dcb43d3d95dca9d8bb5bfdc459f6e5d639db4a31895e4f2ad75355451846cb732e380a576f41f1c3af19387cdc9ee7c5e46464c61613e458a

Download Submit
/data/data/com.necapp.lpp4201/files/localdb.db

Filesize
8KB

MD5
faaca4653c8ac9916f2b936de4dcc2c6

SHA1
038337f2a2482ada5cee4eb8f62964ab99c69121

SHA256
3ed78915e81f5e91bae026ec754b8a15db15d7c410d7bd082cddd87198d5eab2

SHA512
09bb52cb14c95d0cfd8034c68da1e12dc5ecddca098a7b5be253e834993a16d118ab3a7bc0c98f5758bfbb48c55563b31a640ede2de453eaca75e5a38488df9c

Download Submit
/data/data/com.necapp.lpp4201/files/localdb.db-journal

Filesize
8KB

MD5
f856d5e27311ee18a78d10cf75429aab

SHA1
47792a5883a0b726de1249c9e009d05b41dc15ff

SHA256
a75c827694b5fbca8558f0663ae242add2db81730c3edbd8d6f72af8e3a26690

SHA512
b59dcaba0f9631eace2a1d9aa717692236dcbf09b01f52e50b44666c205c10e1f9225aaed4862cdd2d847782117c0a07aeb2acaef2c52378e0c01f47a38c65d3

Download Submit
/data/data/com.necapp.lpp4201/files/localdb.db-journal

Filesize
8KB

MD5
c59a8496d7750495aa9c8002ee462838

SHA1
e75176ce77908e8833b5a790b68605c17bfea31e

SHA256
9c189242ff49f883fb351dc1f1280815cd18642aae115641a8f22aa0717d2e57

SHA512
3c171d51422452e953b02d0049265bea63f1847dc21e0f72c367cc3df98f05e4d77785570749e1042138250012c062500410918254193121d60da9ed585e4427

Download Submit
/data/data/com.necapp.lpp4201/files/localdb.db-journal

Filesize
8KB

MD5
318c897caea1083541204e1f543bb595

SHA1
e5e6686887270d3d443168177a67dd1c28576935

SHA256
54c10f402af4da8a7e3ad1dc1749d7e352db723fb73ae4689d8ae0df567498d6

SHA512
ae23e0810be66c4a4c98daac2bc7903c3f45191e07da7fb4340cbb63c35e3b34a87d0a398f45cb862cbaa6d80529bde941ac28660102c6c6ef0d109cc33218fe

Download Submit
/data/data/com.necapp.lpp4201/files/messdb.db

Filesize
8KB

MD5
57a39108426ea4fb8e5bc74accc22a88

SHA1
73f83c87418acba44a084cb7055fc5c34f6cf25e

SHA256
9d36142e37864417222d54360d821b9a75f31ad31d1f9a45c947edb63ec6b2d2

SHA512
f122d601019b7ee6077574897b51d60cf8223780db64e0649a772183c8025ac413d3ce0683c8bf05373e293cb67ebb62d9dfea15d5d16c495bc0628279709b8a

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads