Overview

overview

10

Static

static

10

20bfd2b246...fb.apk

android-9-x86

7

20bfd2b246...fb.apk

android-10-x64

7

20bfd2b246...fb.apk

android-11-x64

7

Analysis

  • max time kernel
    149s
  • max time network
    146s
  • platform
    android-10_x64
  • resource
    android-x64-20240910-en
  • resource tags

    arch:x64arch:x86image:android-x64-20240910-enlocale:en-usos:android-10-x64system
  • submitted
    06-11-2024 02:13

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    20bfd2b2466fad95b88cf5067b29a0dbabf5016ccbffbb3a672c7366b8ec7dfb.apk

  • Size

    3.8MB

  • MD5

    42d05c75286bcfaff3d1721d813f182b

  • SHA1

    e28b64dcfcd1f985e66557e9defa50893d3673e0

  • SHA256

    20bfd2b2466fad95b88cf5067b29a0dbabf5016ccbffbb3a672c7366b8ec7dfb

  • SHA512

    65cedc6f876bfd56b7dcc797cde5471a27aa5cdb83a1ed0e52265b5ba6b3e3a1a787587e1377f7cb4a5f51e45343a863493cbf07f25a57da0b5940f8638eac76

  • SSDEEP

    98304:btyuPe0dVqg8144bQimzLzBATc0tUSaKz:htGrg81lQNzKvDR

Score
7/10
bankercollectioncredential_accessdiscoveryevasionexecutionimpactpersistence

Malware Config

Signatures

  • Makes use of the framework's Accessibility service 4 TTPs 3 IoCs

    Retrieves information displayed on the phone screen using AccessibilityService.

    collectionevasioncredential_access
  • Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs

    Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.

    collectioncredential_accessimpact
  • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
    bankerdiscovery
  • Acquires the wake lock 1 IoCs
  • Performs UI accessibility actions on behalf of the user 1 TTPs 12 IoCs

    Application may abuse the accessibility service to prevent their removal.

    evasion
  • Queries information about active data network 1 TTPs 1 IoCs
    discovery
  • Queries the mobile country code (MCC) 1 TTPs 1 IoCs
    discovery
  • Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
    persistence
  • Schedules tasks to execute at a specified time 1 TTPs 1 IoCs

    Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.

    executionpersistence
  • Checks CPU information 2 TTPs 1 IoCs
  • Checks memory information 2 TTPs 1 IoCs

Processes

  • guild.arts.seeking
    1⤵
    • Makes use of the framework's Accessibility service
    • Obtains sensitive information copied to the device clipboard
    • Acquires the wake lock
    • Performs UI accessibility actions on behalf of the user
    • Queries information about active data network
    • Queries the mobile country code (MCC)
    • Registers a broadcast receiver at runtime (usually for listening for system events)
    • Schedules tasks to execute at a specified time
    • Checks CPU information
    • Checks memory information
    PID:5237

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Scheduled Task/Job

1
T1603

Persistence

Event Triggered Execution

1
T1624

Broadcast Receivers

1
T1624.001

Scheduled Task/Job

1
T1603

Privilege Escalation

Defense Evasion

Impair Defenses

1
T1629

Prevent Application Removal

1
T1629.001

Input Injection

1
T1516

Virtualization/Sandbox Evasion

2
T1633

System Checks

2
T1633.001

Credential Access

Clipboard Data

1
T1414

Input Capture

2
T1417

GUI Input Capture

1
T1417.002

Keylogging

1
T1417.001

Discovery

Software Discovery

1
T1418

Security Software Discovery

1
T1418.001

System Information Discovery

2
T1426

System Network Configuration Discovery

1
T1422

System Network Connections Discovery

1
T1421

Lateral Movement

Collection

Clipboard Data

1
T1414

Input Capture

2
T1417

GUI Input Capture

1
T1417.002

Keylogging

1
T1417.001

Screen Capture

1
T1513

Command and Control

Exfiltration

Impact

Data Manipulation

1
T1641

Transmitted Data Manipulation

1
T1641.001

Input Injection

1
T1516

Replay Monitor

Loading Replay Monitor...

Downloads

  • /storage/emulated/0/Config/sys/apps/log/log-2024-11-06.txt
    Filesize

    41B

    MD5

    bc7a1de6d4dbada6b99f42fd40dd43e7

    SHA1

    16e7245a2b44d195c173d50cdc56de1a88857d24

    SHA256

    416d5d568fc5038622f9c4fd39059cbca7309bf96ef769065d6d2776fd86e64c

    SHA512

    ff9faedd6c4f57862de4eb241347b06724961130f8834f99881eed93c2a9d96f9e5e4d3aecb60276ae22c7cb59c34daee89c517cad67dda3342089573e7363c3

    Download Submit

  • /storage/emulated/0/Config/sys/apps/log/log-2024-11-06.txt
    Filesize

    25B

    MD5

    ba30336bf53d54ed3c0ea69dd545de8c

    SHA1

    ce99c6724c75b93b7448e2d9fac16ca702a5711f

    SHA256

    2d6988fb5afdaafc4e33fa1f71d6f10c95ab5a49a8ec820add5b13eef05439af

    SHA512

    eea34ca526e03349e746d3687ea660b4748f0174fe2ffdb65161e232e08630b345e03329614852ce881a71362ba68575e9dd08fa361a416e5b2fb231e21a0a3e

    Download Submit

  • /storage/emulated/0/Config/sys/apps/log/log-2024-11-06.txt
    Filesize

    296B

    MD5

    854da064ac2f528574f714428720b7bb

    SHA1

    ff0c71289ff586218624539972f421ba01721bfc

    SHA256

    582276fa88f9157b7cc565aac3a0e3dfb69532342e089b89e27561c966e9a6cf

    SHA512

    b8e97a770c32fd4dcc4576110dd835070368e3ce2ee147b6fa1dddb9b33484fc6e6af52c28c9af3abc84957cecc44fa5bda242750d93747b220023db753451bc

    Download Submit

  • /storage/emulated/0/Config/sys/apps/log/log-2024-11-06.txt
    Filesize

    69B

    MD5

    eae1a075878b97fa7b4ddcb26c97d019

    SHA1

    931472823c26a0c31a018d749a3d3a28ff95a39e

    SHA256

    bbdafa121bc0460dee47e8ffbb351cdee699ec0defcdcb7be7f82e1ffbedb2a6

    SHA512

    49bdf691853661037f478e010dac9e779ac9d234abdb6759ab37760618aaeb37d8f5df73d949b94d65d81c489c31e5540ad8aaf7dedb07f43d116f7a789bdd2f

    Download Submit