53cd4074b7e15b6cdc3ab03167bc6e320d059db222d4e5a28072cf223747942f

General

Target

cdicic.apk
Size

3.7MB
MD5

971bd47ba4409ed736a88497d48701ad
SHA1

393d97e93679b45ce67883c36ad75b581309ac1b
SHA256

53cd4074b7e15b6cdc3ab03167bc6e320d059db222d4e5a28072cf223747942f
SHA512

e6c5846db2680aa5810511f8514e35ab7b011638858fcb5a950d5a7bb396b6164aea939ebc6ad39832ff7f286fff011b1aad47240e3e7e9f955dd65dd26da778
SSDEEP

49152:/4ikbZzdGGzQTOzmzagvYq60cgY9U7o1LAIwE8zpIKSKV4seBHQDUHRrQZ4v5p1:aZzB0TEmzagu0tGtAIm/V4hjR0ZsB

Score

8^/10

banker collection credential_access discovery evasion execution persistence stealth trojan

Malware Config

Signatures

Removes its main activity from the application launcher 1 TTPs 1 IoCs
stealth trojan evasion

Suppress Application Icon
T1628.001

Processes:

schedule.realm.lights

pid process

4999 schedule.realm.lights

pid	process
4999	schedule.realm.lights

Makes use of the framework's Accessibility service 4 TTPs 3 IoCs

Retrieves information displayed on the phone screen using AccessibilityService.

collection evasion credential_access

Input Injection

T1516

Screen Capture

T1513

Keylogging

T1417.001

GUI Input Capture

T1417.002

Processes:

schedule.realm.lights

description	ioc	process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	schedule.realm.lights
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByText	schedule.realm.lights
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId	schedule.realm.lights

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
banker discovery

Security Software Discovery
T1418.001
Acquires the wake lock 1 IoCs

Processes:

schedule.realm.lights

description ioc process

Framework service call android.os.IPowerManager.acquireWakeLock schedule.realm.lights
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
evasion persistence

Foreground Persistence
T1541

Processes:

schedule.realm.lights

description ioc process

Framework service call android.app.IActivityManager.setServiceForeground schedule.realm.lights

description	ioc	process
Framework service call	android.os.IPowerManager.acquireWakeLock	schedule.realm.lights

description	ioc	process
Framework service call	android.app.IActivityManager.setServiceForeground	schedule.realm.lights

Performs UI accessibility actions on behalf of the user 1 TTPs 4 IoCs

Application may abuse the accessibility service to prevent their removal.

evasion

Prevent Application Removal

T1629.001

Processes:

schedule.realm.lights

ioc	process
android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction	schedule.realm.lights
android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction	schedule.realm.lights
android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction	schedule.realm.lights
android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction	schedule.realm.lights

Queries information about active data network 1 TTPs 1 IoCs
discovery

System Network Connections Discovery
T1421

Processes:

schedule.realm.lights

description ioc process

Framework service call android.net.IConnectivityManager.getActiveNetworkInfo schedule.realm.lights
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
persistence

Broadcast Receivers
T1624.001

Processes:

schedule.realm.lights

description ioc process

Framework service call android.app.IActivityManager.registerReceiver schedule.realm.lights
Schedules tasks to execute at a specified time 1 TTPs 1 IoCs
Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.
execution persistence

Scheduled Task/Job
T1603

Processes:

schedule.realm.lights

description ioc process

Framework service call android.app.job.IJobScheduler.schedule schedule.realm.lights

description	ioc	process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	schedule.realm.lights

description	ioc	process
Framework service call	android.app.IActivityManager.registerReceiver	schedule.realm.lights

description	ioc	process
Framework service call	android.app.job.IJobScheduler.schedule	schedule.realm.lights

schedule.realm.lights
1⤵
- Removes its main activity from the application launcher
- Makes use of the framework's Accessibility service
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Performs UI accessibility actions on behalf of the user
- Queries information about active data network
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Schedules tasks to execute at a specified time
PID:4999

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Scheduled Task/Job

1

T1603

Persistence

Event Triggered Execution

1

T1624

Broadcast Receivers

1

T1624.001

Foreground Persistence

Scheduled Task/Job

Privilege Escalation

Defense Evasion

Foreground Persistence

1

T1541

Hide Artifacts

1

T1628

Suppress Application Icon

1

T1628.001

Impair Defenses

1

T1629

Prevent Application Removal

Input Injection

Credential Access

Input Capture

2

T1417

GUI Input Capture

1

T1417.002

Keylogging

1

T1417.001

Discovery

Software Discovery

1

T1418

Security Software Discovery

1

T1418.001

System Network Connections Discovery

1

T1421

Lateral Movement

Collection

Input Capture

2

T1417

GUI Input Capture

1

T1417.002

Keylogging

Screen Capture

Command and Control

Exfiltration

Impact

Input Injection

1

T1516

Replay Monitor

Loading Replay Monitor...

Downloads

/storage/emulated/0/Config/sys/apps/log/log-2024-10-31.txt

Filesize
29B

MD5
ea2cd29c192da6b91c2d9c5ab7871659

SHA1
fbc2f5f7cba4581aa7788645826fc56b542f88e8

SHA256
f33d22e972838b1c4322a0bd77e1b0abe1b1a01bec7454fac71a698154749301

SHA512
7078fa705af06cff9072101120e9c6ff7454785bd564cafeb6f15825c3373887154a6ab2a18d2823ce0fc1d042d04de6aad87e7f682f246ca498b2fe5cf8cdfa

Download Submit
/storage/emulated/0/Config/sys/apps/log/log-2024-10-31.txt

Filesize
25B

MD5
ba30336bf53d54ed3c0ea69dd545de8c

SHA1
ce99c6724c75b93b7448e2d9fac16ca702a5711f

SHA256
2d6988fb5afdaafc4e33fa1f71d6f10c95ab5a49a8ec820add5b13eef05439af

SHA512
eea34ca526e03349e746d3687ea660b4748f0174fe2ffdb65161e232e08630b345e03329614852ce881a71362ba68575e9dd08fa361a416e5b2fb231e21a0a3e

Download Submit
/storage/emulated/0/Config/sys/apps/log/log-2024-10-31.txt

Filesize
280B

MD5
0fe2175cebbfa5838ba9aedd873e3f62

SHA1
3657f5418c8499df9ffe7121b98f535103ac451c

SHA256
112c4edbd77fe022d3f8276dd856f290fa1956de23fa146384382a49b274cd6e

SHA512
60d3903724554d4fd8146059ac50e5cccee33c250f561adfd6e6e9b1dd6e1ffbc37b62cb698880e2acc74c6af71cebcc2472260e5897163924b76b0c65a25497

Download Submit
/storage/emulated/0/Config/sys/apps/log/log-2024-10-31.txt

Filesize
57B

MD5
3af69119804d1d999d56d230338ffd36

SHA1
69350826205583c8acc385ee0a6e3fc2673ee2ca

SHA256
10994862cb263ab6b1e4428cc24cc9c585458fc67544fe0f5dfea81a5a7a115c

SHA512
4a41b19d28f637b397d9dff225621694c44c750a9bd65f3e6ad5d3b9acf0d118910ddf53d4618213f9e14c61e0fb154f33f2747dd3b8d50459990767f42fc8cb

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads