db35c5dbc795dc0fe83cb59ee7f2e19e39b576378337e4bdaecaba948364bbc3

Analysis

max time kernel
148s
max time network
152s
platform
android_x64
resource
android-x64-20240624-en
resource tags

androidarch:x64arch:x86image:android-x64-20240624-enlocale:en-usos:android-10-x64system
submitted
03-11-2024 22:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

db35c5dbc795dc0fe83cb59ee7f2e19e39b576378337e4bdaecaba948364bbc3.apk
Size

3.3MB
MD5

f6d0dbbbc050d7d84a7627c8fc16586e
SHA1

3c5a792b5724aa1260b466b40e8f7a6f36606754
SHA256

db35c5dbc795dc0fe83cb59ee7f2e19e39b576378337e4bdaecaba948364bbc3
SHA512

41eff631737fd7bfe5bc131bb48d62f13cb75610117aa965194dfa849086b4258577a1b5fe33952639e66170544989bfc50fd177b7bb96cc4211e9fdffacef96
SSDEEP

49152:Ea1aSJ6sq7avYKo3K6TgrPitfyblFg4ggnnfrmipQWk0d/fKrWk0d/N:m+vYKo3K6aitaYGnfrmykTdo

Score

7^/10

banker discovery evasion persistence

Malware Config

Signatures

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
banker discovery

Security Software Discovery
T1418.001

Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

Application may abuse the framework's foreground service to continue running in the foreground.

evasion persistence

Foreground Persistence

T1541

Processes:

cmf0.c3b5bm90zq.patch

description	ioc	Process
Framework service call	android.app.IActivityManager.setServiceForeground	cmf0.c3b5bm90zq.patch

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs

persistence

Broadcast Receivers

T1624.001

Processes:

cmf0.c3b5bm90zq.patch

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	cmf0.c3b5bm90zq.patch

cmf0.c3b5bm90zq.patch
1⤵
- Makes use of the framework's foreground persistence service
- Registers a broadcast receiver at runtime (usually for listening for system events)
PID:5060

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Foreground Persistence

T1541

Privilege Escalation

Defense Evasion

Foreground Persistence

T1541

Credential Access

Discovery

Software Discovery

T1418

Security Software Discovery

T1418.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads