Resubmissions
17-10-2024 22:13
241017-142vhasglp 10Analysis
-
max time kernel
146s -
max time network
152s -
platform
android_x86 -
resource
android-x86-arm-20240624-en -
resource tags
-
submitted
17-10-2024 22:13
General
-
Target
MediobancaToken.apk
-
Size
4.7MB
-
MD5
1150d0bf3a077be4f33eb487129d389a
-
SHA1
0fc8c1e2c08fd3dc83ceb72a4848c9aab66b7d57
-
SHA256
d852f48e1c8a37d11f9dfb90f339316a5a3fa012bf152db43de1e81b45a69ba7
-
SHA512
cd6d0097d67420d7596c3015f1b7ed777b42b7ac5b842f3107043bc3609fe3a2b391d7964d6262304ccc5255d51cbed0053a9e7e99ad350e85a1e838579cfa98
-
SSDEEP
98304:V9hinlhin6Vhinahinx1hin6hinshinUhinwFWKeUzE4b60sgPo8vI:VbCzC6DC8CxjCcCyCKCwFPecO0dhvI
Malware Config
Signatures
-
Makes use of the framework's Accessibility service 4 TTPs 2 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Acquires the wake lock 1 IoCs
-
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
-
Performs UI accessibility actions on behalf of the user 1 TTPs 7 IoCs
Application may abuse the accessibility service to prevent their removal.
-
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
-
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
-
Checks CPU information 2 TTPs 1 IoCs
-
Checks memory information 2 TTPs 1 IoCs
Processes
-
com.mediobancaapptoken.app1⤵
- Makes use of the framework's Accessibility service
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Performs UI accessibility actions on behalf of the user
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Checks CPU information
- Checks memory information
Network
MITRE ATT&CK Mobile v15
Persistence
Event Triggered Execution
1Broadcast Receivers
1Foreground Persistence
1Defense Evasion
Foreground Persistence
1Impair Defenses
1Prevent Application Removal
1Input Injection
1Virtualization/Sandbox Evasion
2System Checks
2Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
40KB
MD5c9ba8af2c46cfab6a421f96b0c7a4aba
SHA17cf335d13973adb71de16c9683c65326e04d0107
SHA256c4ddb071f51d8ccf2ae17406c75498de55d820371a8b28c77197a127d131863c
SHA5120fb0dc739a67f5dca3872f616adbbf361a82075411e17a3d6be06d7d52126b284f2119524d9ea47c251d77752b4802727d1499f015977616dc8ddcdd40309afd
-
Filesize
4KB
MD523a900124cc1be12cb153919436e517e
SHA1c3090005da02b93ca8a6a3261ab2f57e0c4252c8
SHA2564ac83031e1631aba670f1a1b79050e28f8b5769cbd9b2fe3d0ed64f999938856
SHA5125846481036919c99f172ac88632af94d6f0c9b548baa92623136c9c80e7dd64c3c8f5835cf33fef0638f7bcd72146e696019a11243297df165c82e8f5985b259
-
Filesize
4KB
MD5a0e0e3f6d7437c85d0c24025c8f36365
SHA1cd25bbeb451e7a7d84690d8ad158c756e04c53db
SHA256f6ba9f105fcc9109a953117adf5999ff32be1a847d9cc474f55239dbc74676d5
SHA5127ab017951bebf4bbcddf8412836dd5e621d94c47a43e2b8c40d1a267c9b4de9caca990a1fba6dce43e25937af8e92997a8bbec0eec53b668d7a3fc5c19eba39b
-
Filesize
32KB
MD5bb7df04e1b0a2570657527a7e108ae23
SHA15188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA256c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
SHA512768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012
-
Filesize
121KB
MD57b38720a0352dffa26411726c72dd2b0
SHA1b15e687f42abcdc12427f146a3115ef2259211f8
SHA2562013f490d45638cada331b3474ed65b9a43cec60da773accc98332e58c06336d
SHA5120df28f87da4f9beb3ca8c108f54021a2a1a1434771abbb5ba67a2736097f2287b05e5220a33e92c42ee13ecae1144714a422b986763712794f69e65bc44c83e3
-
Filesize
11B
MD51b65c10c6215685f9d621d797f911373
SHA1cc50aaed5cd521a62ec8cf9fe0413153ec90f265
SHA2562230c2b2787663a054c47450ecd1718f0296853ad768b8e5d306ecb912685e89
SHA5125a9139f295dbe384b1584eff5c11f3f86759232f7b661b75f27fe92b996b4cdc0552e315f79b26f5f2c1f91756d9ae04cf0c3675b6172e91a3d373b9b314496f
