ajina | f824655a2c2dc26cb021bd246abec9d99fe753b5980261c7e24be0f73f264762

Analysis

max time kernel
108s
max time network
151s
platform
android-10_x64
resource
android-x64-20240910-en
resource tags

arch:x64arch:x86image:android-x64-20240910-enlocale:en-usos:android-10-x64system
submitted
02/10/2024, 22:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
f824655a2c2dc26cb021bd246abec9d99fe753b5980261c7e24be0f73f264762.apk
Size 2.4MB
Sample241002-1z37rsshpe
SHA256 f824655a2c2dc26cb021bd246abec9d99fe753b5980261c7e24be0f73f264762
MD5 c1b24852510d354d9211b03f7e745ba3
SHA1 8b3cc27cae155f9e2f8d09bc40f5b081fc9ee9df
SHA512 bc6c490063a033247957f1bd40b6a10474a1e4d00bd0753b3d2164616bd180ea3974078973b6480bebd7815dbc7fe67db15fb2be1f40abfdb1ab329c436aa570
SSDEEP 49152:iFClMQ3IrQUEXqSa/SCJcIRkpVwPRS9t0Jf8DAIHB:kr2Xqx/SsE+PRE0t8DAIHB
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

ajina banker collection credential_access evasion infostealer rat trojan

Malware Config

Signatures

Ajina
Ajina is an Android banking trojan first seen in November 2023.
banker trojan infostealer rat ajina

Makes use of the framework's Accessibility service 4 TTPs 2 IoCs

Retrieves information displayed on the phone screen using AccessibilityService.

collection evasion credential_access

Input Injection

T1516

Screen Capture

T1513

Keylogging

T1417.001

GUI Input Capture

T1417.002

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	org.zzzz.aaa
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByText	org.zzzz.aaa

org.zzzz.aaa
1⤵
- Makes use of the framework's Accessibility service
PID:5066

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Input Injection

T1516

Credential Access

Input Capture

T1417

GUI Input Capture

T1417.002

Keylogging

T1417.001

Discovery

Lateral Movement

Collection

Input Capture

T1417

GUI Input Capture

T1417.002

Keylogging

T1417.001

Screen Capture

T1513

Command and Control

Exfiltration

Impact

Input Injection

T1516

Replay Monitor

Loading Replay Monitor...

Downloads

746c0412cdc0b104efafc74f829fa9fa77f5549b034decd2882460e60cbc768f.0.tmp

Path /data/data/org.zzzz.aaa/cache/image_manager_disk_cache/746c0412cdc0b104efafc74f829fa9fa77f5549b034decd2882460e60cbc768f.0.tmp
Size 14KB
SHA256 a2c80460147cdd5d255f405c4968bc96099dd5a4325103035965989590d2bc03
MD5 9629d97a50bb1adb24d1b558132b3e20
SHA1 f8e095f7f3b119d350ee7e5888bde15d38c15b2b
SHA512 2a4160b22e9d93ca00de67ab651cc30e771c05eb7f8b6a1ab5ac539f28c7d6eaa7d30558f3646802f55a1433a820497221cbc2036828a0d54cdb3f5d10c0e705
SSDEEP 384:1iOh8nTipSo4h18mcj7BjUeBHenVBkdErpjH14xy:IOuTi0o0jcj7eeZeVGE9jyk
MD5 SHA1 SHA512 SSDEEP

Submit Download

journal

Path /data/data/org.zzzz.aaa/cache/image_manager_disk_cache/journal
Size 179B
SHA256 5fa9fc9d6b559776729fa7deb286432b87dfcebb80739b87e39166df193bbe78
MD5 4fddcf79f41c74090652408caf261ca5
SHA1 91759364e8e7fb63676a061b60466934fd61ae15
SHA512 e2b59878077ebcdfc1d9c8a686a2c96e2aef08f73977fd4b1fdcccbe3010c313725c30fe8df87c14380d0c8dcd981200b42d406361e7c177fa3937d900581aa3
MD5 SHA1 SHA512

Submit Download

journal.tmp

Path /data/data/org.zzzz.aaa/cache/image_manager_disk_cache/journal.tmp
Size 31B
SHA256 68bb33ddeed9200be85a71f70b377985f9ee68e91578afbde8321463396f1274
MD5 8c92de9ce46d41a22f3b20f77404cc1d
SHA1 8671a6dca00edb72be47363a7071be65cf270373
SHA512 30f45fe9954215d6adafcc8f0a060a7ff41963a64f9b849a37f0d18fe045038d429ec13bf15226769c4ba78dad3c52f3d9e0dbbb4fcdea4828a1efe956e48f56
MD5 SHA1 SHA512

Submit Download

profileInstalled

Path /data/data/org.zzzz.aaa/files/profileInstalled
Size 24B
SHA256 056f915046fb8db7fb2791397f77193eb62dd94ca87a76a8016d26e9ec80c98c
MD5 8cf8226ff8056bcf3012286a4e305940
SHA1 e32133910f0b229d3da6226979bd8c1f679014e2
SHA512 d299741f05e93fc6f0428eb517226619dd4698880978cbc61351d5fd8b112c2fe94d3fed2d950d520645cd7a0ecedf3388beb4d6c4a4137b68d2e7dffa1e0cbf
MD5 SHA1 SHA512

Submit Download

profileinstaller_profileWrittenFor_lastUpdateTime.dat

Path /data/data/org.zzzz.aaa/files/profileinstaller_profileWrittenFor_lastUpdateTime.dat
Size 8B
SHA256 6bf81e4b2fcc6207cc71656eadbba62e197ee2febda2a14ac38925840b0d6b55
MD5 f150bebb45f96eaba17f90e5a7b3cf19
SHA1 db687d1cb428e32d7b7e643968bef0386db53419
SHA512 133bff3f327021f71df3a3ed356e2b25d60b1c1f54d7c165d84f8292cf2eb7105f70e5952f056cd55ce961b711e385ca4dcef6f74a5636e2245bb1a2555e6ffd
MD5 SHA1 SHA512

Submit Download

primary.prof

Path /data/misc/profiles/cur/0/org.zzzz.aaa/primary.prof
Size 1KB
SHA256 04ff6955aca4a51b48828c4963f1f3a5f59cca944fe819439e0dddebb187acd9
MD5 a0291463bc7d124f09c0e226226ebc6c
SHA1 8cc15bafbbee0aaf89411c76137650a6313a8712
SHA512 503d625fc93d623d426f98523e11a0b3890963a7a4856c96d48b5cd227d5dee842bba0255cd383d3189138c4cd511703103d2396ffc77ff5b1d135993f6d0617
MD5 SHA1 SHA512

Submit Download

primary.prof

Path /data/misc/profiles/cur/0/org.zzzz.aaa/primary.prof
Size 3KB
SHA256 24816ffa0f033dd889e7b27c7c495a1d73c406d79e7446e749aa4cd728661261
MD5 bc2719509feaf64cbd7db0220b245529
SHA1 e67fac0b1eb82c1de7a8c7ce6839f8ae07427e89
SHA512 ea809e1f43e3ebfe230ad44b3003e554be56600583b3d381b4535cd76aa94bfffb767c47961c1debcd8cb1d74d86eb3db6daa2bb3c8795538eb385ef8007e254
MD5 SHA1 SHA512

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads