ec4e56b56cba6b5714148360e1bc7ac132e3b2aefe8dc1f07b508d3956ea7497

General

Target

Минцифры России (1).apk
Size

3.6MB
MD5

e868a915c11db0c944d322efa8e5c620
SHA1

8c15733647c3539aab425749d611073c859a3508
SHA256

ec4e56b56cba6b5714148360e1bc7ac132e3b2aefe8dc1f07b508d3956ea7497
SHA512

c4f51c39d0f7220c5b53adab9f5d41965f9332a65db773cfd1ab30e7235fea71a20ba9b1639d295fd7b4ba6c425b555694fa4b983c1f89197094cbdc80995fa2
SSDEEP

49152:t2fugfylZzJmjzTFISfR2AsXS04O6waKmzBzdGGkQTOl7UYYqH0cg2rnxV:txvlZz4tUPP36smzBzBzTW0t2TL

Score

7^/10

banker collection credential_access discovery evasion execution impact persistence

Malware Config

Signatures

Makes use of the framework's Accessibility service 4 TTPs 3 IoCs

Retrieves information displayed on the phone screen using AccessibilityService.

collection evasion credential_access

Input Injection

T1516

Screen Capture

T1513

Keylogging

T1417.001

GUI Input Capture

T1417.002

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	mm.mexican.checking
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByText	mm.mexican.checking
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId	mm.mexican.checking

Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs

Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.

collection credential_access impact

Clipboard Data

T1414

Transmitted Data Manipulation

T1641.001

description	ioc	Process
Framework service call	android.content.IClipboard.addPrimaryClipChangedListener	mm.mexican.checking

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
banker discovery

Security Software Discovery
T1418.001

Acquires the wake lock 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	mm.mexican.checking

Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

Application may abuse the framework's foreground service to continue running in the foreground.

evasion persistence

Foreground Persistence

T1541

description	ioc	Process
Framework service call	android.app.IActivityManager.setServiceForeground	mm.mexican.checking

Queries information about active data network 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	mm.mexican.checking

Queries the mobile country code (MCC) 1 TTPs 1 IoCs

discovery

System Network Configuration Discovery

T1422

description	ioc	Process
Framework service call	com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone	mm.mexican.checking

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs

persistence

Broadcast Receivers

T1624.001

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	mm.mexican.checking

Schedules tasks to execute at a specified time 1 TTPs 1 IoCs

Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.

execution persistence

Scheduled Task/Job

T1603

description	ioc	Process
Framework service call	android.app.job.IJobScheduler.schedule	mm.mexican.checking

Checks CPU information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	mm.mexican.checking

Checks memory information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	mm.mexican.checking

mm.mexican.checking
1⤵
- Makes use of the framework's Accessibility service
- Obtains sensitive information copied to the device clipboard
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Queries information about active data network
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Schedules tasks to execute at a specified time
- Checks CPU information
- Checks memory information
PID:4969

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Scheduled Task/Job

1

T1603

Persistence

Event Triggered Execution

1

T1624

Broadcast Receivers

1

T1624.001

Foreground Persistence

Scheduled Task/Job

Privilege Escalation

Defense Evasion

Foreground Persistence

Input Injection

Virtualization/Sandbox Evasion

2

T1633

System Checks

2

T1633.001

Credential Access

Clipboard Data

1

T1414

Input Capture

2

T1417

GUI Input Capture

1

T1417.002

Keylogging

1

T1417.001

Discovery

Software Discovery

1

T1418

Security Software Discovery

1

T1418.001

System Information Discovery

2

T1426

System Network Configuration Discovery

1

T1422

System Network Connections Discovery

1

T1421

Lateral Movement

Collection

Clipboard Data

1

T1414

Input Capture

2

T1417

GUI Input Capture

1

T1417.002

Keylogging

Screen Capture

Command and Control

Exfiltration

Impact

Data Manipulation

1

T1641

Transmitted Data Manipulation

Input Injection

Replay Monitor

Loading Replay Monitor...

Downloads

/storage/emulated/0/Config/sys/apps/log/log-2024-09-29.txt

Filesize
53B

MD5
b861592bdb46df76c4a1ed200e7c1a56

SHA1
d12b2f159e54aed018fb7de78fb42ee7cb8387ad

SHA256
886130e77c02843e915ba594b4971913a5170ec9436f1164f309f800044970a9

SHA512
73aa24e6ca7c5ccc5242806972825e37fb0579df8c2cb982df67a93c8f8318591fdaf9815872d6fc069d8f118f526fe58e684454fdb1a081378d2a7c47a5d7d4

Download Submit
/storage/emulated/0/Config/sys/apps/log/log-2024-09-29.txt

Filesize
25B

MD5
ba30336bf53d54ed3c0ea69dd545de8c

SHA1
ce99c6724c75b93b7448e2d9fac16ca702a5711f

SHA256
2d6988fb5afdaafc4e33fa1f71d6f10c95ab5a49a8ec820add5b13eef05439af

SHA512
eea34ca526e03349e746d3687ea660b4748f0174fe2ffdb65161e232e08630b345e03329614852ce881a71362ba68575e9dd08fa361a416e5b2fb231e21a0a3e

Download Submit
/storage/emulated/0/Config/sys/apps/log/log-2024-09-29.txt

Filesize
304B

MD5
c1e530e7219b44726bdbab56b2785216

SHA1
682248e726b9ad2d730d95daebd16aea7077d7a5

SHA256
905717dfd93a0d0e87ebce93004aa3a8f8962efaf37bb8fe11cacfcc8deb788a

SHA512
9ffd85866c89938946a866e7e9484ce77c215a84fe3da0da8fa753e7eb0aa0d155b6b316dcee64f257ad98b7ba7af8d168d46d911f6388ec435c03d05a1b816e

Download Submit
/storage/emulated/0/Config/sys/apps/log/log-2024-09-29.txt

Filesize
90B

MD5
346788528fa2585c9e47e58225b49b51

SHA1
034faff7d56a9072b80381105ed1100835b9457e

SHA256
7c34a336a248ff4455fcc5d5262b16872b05e5fc52635fc1d900535fb1ff85e9

SHA512
ab11eb78b5b4c9c3f6f5d9741ff39359cb08e0bee27999da62e094757922f3931fa54840a6ae05aea9ac67ea495a089563d0cd77af442ea87ec50ba552bf7ab8

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads