Overview

overview

7

Static

static

6

48bba46a14...e4.apk

android-9-x86

7

48bba46a14...e4.apk

android-10-x64

7

48bba46a14...e4.apk

android-11-x64

7

i.apk

android-9-x86

7

i.apk

android-10-x64

7

i.apk

android-11-x64

7

Analysis

  • max time kernel
    125s
  • max time network
    151s
  • platform
    android-10_x64
  • resource
    android-x64-20240910-en
  • resource tags

    arch:x64arch:x86image:android-x64-20240910-enlocale:en-usos:android-10-x64system
  • submitted
    10-10-2024 01:32

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    i.apk

  • Size

    7.1MB

  • MD5

    0ea1827d432e1f7564cb1f19c9c103f1

  • SHA1

    93b37065c3c6fe2b26196c05f7caf85bba21ef68

  • SHA256

    3f5064669a60ae6a5bbabe7edb12e263bd4915bf2db1497d7ac35823114c938a

  • SHA512

    52134ec2c2c1e3e0ab458af4875d5a2715e128d350ced2f784caa2eaf7f4dca574c9e6b4b27598667607b6c81c0acb519128718a0b86bc04cd44c85c410ee448

  • SSDEEP

    98304:Y6i3HB8NCRrr9aFvuwIVuzOLMxjipCB+Tk1h2reR0YwVP4Q8nkC2+kPIqVjzCp64:li3HuERrr9fDSZjiocrkkP43MPIqi2+

Score
7/10
collectioncredential_accessevasionimpactpersistence

Malware Config

Signatures

  • Loads dropped Dex/Jar 1 TTPs 4 IoCs

    Runs executable file dropped to the device during analysis.

    evasion
  • Makes use of the framework's Accessibility service 4 TTPs 2 IoCs

    Retrieves information displayed on the phone screen using AccessibilityService.

    collectionevasioncredential_access
  • Acquires the wake lock 1 IoCs
  • Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

    Application may abuse the framework's foreground service to continue running in the foreground.

    evasionpersistence
  • Performs UI accessibility actions on behalf of the user 1 TTPs 1 IoCs

    Application may abuse the accessibility service to prevent their removal.

    evasion
  • Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
    impact

Processes

  • com.hnrizrrwx.ymrrhnwee
    1⤵
    • Loads dropped Dex/Jar
    • Makes use of the framework's Accessibility service
    • Acquires the wake lock
    • Makes use of the framework's foreground persistence service
    • Performs UI accessibility actions on behalf of the user
    • Uses Crypto APIs (Might try to encrypt user data)
    PID:5081

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/data/com.hnrizrrwx.ymrrhnwee/app_app_dex/kmsgekm.nqi
    Filesize

    3.1MB

    MD5

    47d0379611610d169b7bc36de0078bca

    SHA1

    51219928bef9b5cc2184c0c108c5415ea0963ca0

    SHA256

    d96e1eff9974ffa121678ca8132f7c667303cc96615aa6378c286171e87153a4

    SHA512

    6c2d6897374be2f1e66254a0a80281c1c526b7e4c2a4dbe5f529f8ef5bb1bf5dd3c5dbb3792d60b7f9492f50a244873be7feb3036826e5bee2cab2abc575b2d4

    Download Submit

  • /data/data/com.hnrizrrwx.ymrrhnwee/app_app_dex/nwueeqs.nqi
    Filesize

    5.6MB

    MD5

    0c56b4e0f578fe3c09cafad0680ebf99

    SHA1

    57d9e101c70e4efa316f2c4836be84292af6dae9

    SHA256

    e8a53838ace9e57b54b4c3b5dc35cb9a0c71455c2c082fac42646986d5136385

    SHA512

    636f4a529d5187059ac22734a49a379023d66115170d69df605012973478fb1fb9f9182169626bed00415386693eb0febd1b537f8d40dc9f7364335b0e392189

    Download Submit