b960ede018834eb90efc27162c488cf329c49ca62475661907af0edcd8221364

Analysis

max time kernel
149s
max time network
157s
platform
android_x64
resource
android-x64-20240624-en
resource tags

androidarch:x64arch:x86image:android-x64-20240624-enlocale:en-usos:android-10-x64system
submitted
07-11-2024 01:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3ef9e9ab4b0f5c39d65f43b2227984e6ca423adad60e828f6af2e0eb7ac78284.apk
Size

8.5MB
MD5

d96ee475dd19e74082f86e8441711216
SHA1

d8c2ed452a4713c1899f737665a3f9552b162317
SHA256

3ef9e9ab4b0f5c39d65f43b2227984e6ca423adad60e828f6af2e0eb7ac78284
SHA512

f076533d4edf96eb9f9a13a24706336339534aec6bfc53abf031fc339c9082059e1c93209f0d701f977a6be7628c1e0908310b11544a61d842bd8a72f3f09180
SSDEEP

49152:QH4xdmhWvywHDSkvd22aznyBe1lQIPbRLXJ+hXrXmzJzdGGSQTOnnUlYqW0cgR5t:QYvmkywjRAQe1DRLXwhDmzJzB9TI0tRD

Score

7^/10

banker collection credential_access discovery evasion execution impact persistence

Malware Config

Signatures

Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs

Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.

collection credential_access impact

Clipboard Data

T1414

Transmitted Data Manipulation

T1641.001

description	ioc	Process
Framework service call	android.content.IClipboard.addPrimaryClipChangedListener	fs.mazda.rentals

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
banker discovery

Security Software Discovery
T1418.001

Acquires the wake lock 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	fs.mazda.rentals

Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

Application may abuse the framework's foreground service to continue running in the foreground.

evasion persistence

Foreground Persistence

T1541

description	ioc	Process
Framework service call	android.app.IActivityManager.setServiceForeground	fs.mazda.rentals

Queries information about active data network 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	fs.mazda.rentals

Queries the mobile country code (MCC) 1 TTPs 1 IoCs

discovery

System Network Configuration Discovery

T1422

description	ioc	Process
Framework service call	com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone	fs.mazda.rentals

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs

persistence

Broadcast Receivers

T1624.001

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	fs.mazda.rentals

Schedules tasks to execute at a specified time 1 TTPs 1 IoCs

Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.

execution persistence

Scheduled Task/Job

T1603

description	ioc	Process
Framework service call	android.app.job.IJobScheduler.schedule	fs.mazda.rentals

Checks CPU information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	fs.mazda.rentals

Checks memory information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	fs.mazda.rentals

fs.mazda.rentals
1⤵
- Obtains sensitive information copied to the device clipboard
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Queries information about active data network
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Schedules tasks to execute at a specified time
- Checks CPU information
- Checks memory information
PID:4972