e533b6ce6aa75f20f070e9538f0b6739d013965edf6effbe0c853a59c9d5235e

Analysis

max time kernel
278s
max time network
285s
platform
android_x64
resource
android-x64-arm64-20240624-en
resource tags

androidarch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20240624-enlocale:en-usos:android-11-x64system
submitted
09/10/2024, 00:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

client.apk
Size

760KB
MD5

57854c82668394ad82bd8ad9a5fec9bb
SHA1

30b5cc3ea5aa5b7b870e87c9be8ac782f62e9c7a
SHA256

e533b6ce6aa75f20f070e9538f0b6739d013965edf6effbe0c853a59c9d5235e
SHA512

631fb9c870e45e0bf307bb92758d96e719bc829493ab7f07bda7687844cf32070cc1c5ad689ffae76adafb634dc6d6ff763ec1c8efe50f3ac308e8716b9b9a77
SSDEEP

12288:BqoDMa1a8LregLuTGF7D5WmpYshXZPbGwidNpgv:Bca1a2egAGF7D5WmD9idNp4

Score

7^/10

banker discovery evasion impact persistence privilege_escalation

Malware Config

Signatures

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
banker discovery

Security Software Discovery
T1418.001

Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

Application may abuse the framework's foreground service to continue running in the foreground.

evasion persistence

Foreground Persistence

T1541

description	ioc	Process
Framework service call	android.app.IActivityManager.setServiceForeground	cmf0.c3b5bm90zq.patch

Requests enabling of the accessibility settings. 1 IoCs

description	ioc	Process
Intent action	android.settings.ACCESSIBILITY_SETTINGS	cmf0.c3b5bm90zq.patch

Tries to add a device administrator. 2 TTPs 1 IoCs

privilege_escalation impact

Device Administrator Permissions

T1626.001

Account Access Removal

T1640

description	ioc	Process
Intent action	android.app.action.ADD_DEVICE_ADMIN	cmf0.c3b5bm90zq.patch

cmf0.c3b5bm90zq.patch
1⤵
- Makes use of the framework's foreground persistence service
- Requests enabling of the accessibility settings.
- Tries to add a device administrator.
PID:4480

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Foreground Persistence

T1541

Privilege Escalation

Abuse Elevation Control Mechanism

T1626

Device Administrator Permissions

T1626.001

Defense Evasion

Foreground Persistence

T1541

Credential Access

Discovery

Software Discovery

T1418

Security Software Discovery

T1418.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Account Access Removal

T1640

Replay Monitor

Loading Replay Monitor...

Downloads

/storage/emulated/0/systeminformation.android.app/config09-10-2024.log

Filesize
39B

MD5
87b37ca018cab1d1b26ca890fa17c6c8

SHA1
6ba7b7f76333e83ecaadd3fa0ffe70ba6e07f83c

SHA256
bde713a568d66a4239aa816223b1799c26672cb88a11e4bf04a6e4d821a40c38

SHA512
ac09fa5bb2e8f7d6f786ce180ff0ecb4cb6f21bb9996848ee084aabe1078c6b6b9656ca89c74c64c732f7d7bded24d798986b866227b4b313c64bd802d686748

Download Submit
/storage/emulated/0/systeminformation.android.app/config09-10-2024.log

Filesize
68B

MD5
4adbedac4a5c5ebfa7a9948e4a8a62ec

SHA1
84bf88b16b0d5b64f22d916309c980fdd9cc8134

SHA256
bdf8546422fa0743fe8eab67bbb5ae691db40fe1fde5458429812c455834f06a

SHA512
74e8f0f36711f91bea7ea75571cb3c3ff1775e9863bf69b0c8d9a4d92dc9bb3ea03325732f1c7cd2c13c0527aa23462909df7b63fea43276317713d02af4b629

Download Submit
/storage/emulated/0/systeminformation.android.app/config09-10-2024.log

Filesize
59B

MD5
1995970072da6608cde1674fecb6a58f

SHA1
f8c8937d77b284abe3c4caee6ad985b8596821d6

SHA256
098053a7b6f3e90b391024e9280200dd1fd45d8b3d11a926cfad28b0cfff3767

SHA512
5a98ccee1772e355f906981e5382ee941e8fa9dec77fc4c4a914815f5ae863a7aa6659018dbb5c6a2e9f4ae8faadfb656d8fe8208c582c0bb239e504a888f665

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads