e2da21729f6299aa0802d8338803b899373891c1f906c0522b8d385392503673

General

Target
e2da21729f6299aa0802d8338803b899373891c1f906c0522b8d385392503673.apk
Size 8.5MB
Sample241106-edvgvatgpf
SHA256 e2da21729f6299aa0802d8338803b899373891c1f906c0522b8d385392503673
MD5 ff748bdc4fcb780b1b70236b7d8bf539
SHA1 35e580c0e3c1859a8cad0fe61f02643b71d0194c
SHA512 d8487c3a738e5d867c7d4e24607fe0cac2093fea09e218786bf95633a73854acc9aa8f8dc3a53d7c3e8ca077bbcb3869a7bc4c10c5305e14ae987d5ec029b393
SSDEEP 49152:km1m+8pMrS90PP+u5f1M8tlGKO5dtVd6QK3PP9Mzy/S7KmzHzdGGyQTOOZwUgYqz:vm+Qx2blgIQUX2zy/fmzHzBdTv0twj0
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

banker collection credential_access discovery evasion execution persistence stealth trojan

Malware Config

Signatures

Removes its main activity from the application launcher 1 TTPs 1 IoCs

stealth trojan evasion

Suppress Application Icon

T1628.001

pid	Process
5103	television.streaming.stream

Makes use of the framework's Accessibility service 4 TTPs 3 IoCs

Retrieves information displayed on the phone screen using AccessibilityService.

collection evasion credential_access

Input Injection

T1516

Screen Capture

T1513

Keylogging

T1417.001

GUI Input Capture

T1417.002

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	television.streaming.stream
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByText	television.streaming.stream
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId	television.streaming.stream

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
banker discovery

Security Software Discovery
T1418.001

Acquires the wake lock 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	television.streaming.stream

Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs

Web Service

T1102

flow	ioc
13	3.tcp.ngrok.io
68	3.tcp.ngrok.io
123	3.tcp.ngrok.io

Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

Application may abuse the framework's foreground service to continue running in the foreground.

evasion persistence

Foreground Persistence

T1541

description	ioc	Process
Framework service call	android.app.IActivityManager.setServiceForeground	television.streaming.stream

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs

persistence

Broadcast Receivers

T1624.001

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	television.streaming.stream

Schedules tasks to execute at a specified time 1 TTPs 1 IoCs

Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.

execution persistence

Scheduled Task/Job

T1603

description	ioc	Process
Framework service call	android.app.job.IJobScheduler.schedule	television.streaming.stream

television.streaming.stream
1⤵
- Removes its main activity from the application launcher
- Makes use of the framework's Accessibility service
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Schedules tasks to execute at a specified time
PID:5103

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

1

T1102

Exfiltration

Impact

MITRE ATT&CK Mobile v15

Initial Access

Execution

Scheduled Task/Job

1

T1603

Persistence

Event Triggered Execution

1

T1624

Broadcast Receivers

1

T1624.001

Foreground Persistence

Scheduled Task/Job

Privilege Escalation

Defense Evasion

Foreground Persistence

1

T1541

Hide Artifacts

1

T1628

Suppress Application Icon

Input Injection

Credential Access

Input Capture

2

T1417

GUI Input Capture

1

T1417.002

Keylogging

1

T1417.001

Discovery

Software Discovery

1

T1418

Security Software Discovery

1

T1418.001

Lateral Movement

Collection

Input Capture

2

T1417

GUI Input Capture

1

T1417.002

Keylogging

Screen Capture

Command and Control

Exfiltration

Impact

Input Injection

1

T1516

Replay Monitor

Loading Replay Monitor...

Downloads

log-2024-11-06.txt

Path /storage/emulated/0/Config/sys/apps/log/log-2024-11-06.txt
Size 41B
SHA256 62384ec81834761bdd1fca13a7568243c3c77294dcad333d2045fa66674e49c2
MD5 f3d8d4e96d398043495345f88ba54f17
SHA1 cf59551bfc38ea5037f591e7116716fa47022a96
SHA512 e1196ad184e028f8d1564a7a6737997725a366f8f1c347ae4cbfc7f9f6ed7197a87440549510f27055213b0bcbe7715888e8c49ab1ecd8c038fa130c34ffa8a1
MD5 SHA1 SHA512

Submit Download

log-2024-11-06.txt

Path /storage/emulated/0/Config/sys/apps/log/log-2024-11-06.txt
Size 25B
SHA256 2d6988fb5afdaafc4e33fa1f71d6f10c95ab5a49a8ec820add5b13eef05439af
MD5 ba30336bf53d54ed3c0ea69dd545de8c
SHA1 ce99c6724c75b93b7448e2d9fac16ca702a5711f
SHA512 eea34ca526e03349e746d3687ea660b4748f0174fe2ffdb65161e232e08630b345e03329614852ce881a71362ba68575e9dd08fa361a416e5b2fb231e21a0a3e
MD5 SHA1 SHA512

Submit Download

log-2024-11-06.txt

Path /storage/emulated/0/Config/sys/apps/log/log-2024-11-06.txt
Size 292B
SHA256 192a01cf6d759a3584011e92d074ce4fbcff3c9482b38635e7a288b0563bf489
MD5 e6bc780603042acb9e3a4f19f7be6946
SHA1 7f4323d91fea6ac2ee38cb0d593cf799fcd388be
SHA512 687124712febc5f763b4ca8d83d3a430b6961c369779d9abe396a1430eaaf571c81d130a8f38f5932c405be5743188dae4cfae5c4b825b2f74337db791b50c13
MD5 SHA1 SHA512

Submit Download

log-2024-11-06.txt

Path /storage/emulated/0/Config/sys/apps/log/log-2024-11-06.txt
Size 49B
SHA256 2e01117e9ff4456e6e318894d9c9f87a6c95338ddb70a45913fca3818963a475
MD5 8159fdf3e59f3669c28a9bc5025a02c3
SHA1 e8d74302d605ff69148f747fe1f7b098ae7602f5
SHA512 5450afdae9e1b7f6a1b9d21560b819bb775b7dc595e1bbcc592556688ac87e427d83e7fca3c4942099104ed5ad8503becaac55a3fa5e608f138059b46d041fb1
MD5 SHA1 SHA512

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads