91135fdeeab900ad00302f025096741e3fbfe3e5ba2aee57c7d513564ff24d86

Resubmissions

19/11/2024, 14:32

241119-rwbtnsxbpe10

14/11/2024, 22:11

241114-13x5xstkf110

Analysis

max time kernel
93s
max time network
155s
platform
android_x64
resource
android-x64-20240624-en
resource tags

androidarch:x64arch:x86image:android-x64-20240624-enlocale:en-usos:android-10-x64system
submitted
19/11/2024, 14:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
91135fdeeab900ad00302f025096741e3fbfe3e5ba2aee57c7d513564ff24d86.apk
Size 1.7MB
Sample241119-rwbtnsxbpe
SHA256 91135fdeeab900ad00302f025096741e3fbfe3e5ba2aee57c7d513564ff24d86
MD5 c26183f4f0f2e9975bc024ce8b5ee589
SHA1 2041e38801cdb8d0cf97cf431862c179e55e06bf
SHA512 04d4056ce0cf87b1ae7e523f1f0222988c1836daa69582f6884fd115dcea0ec11ed21ab955aefdb6c3b72204da5f47f0b9a78b69665191314a8b065cfd793bf7
SSDEEP 24576:MY16HCMBS2sywb22L5JO2+SYCbygLBdP5uxljy9YuMDgIqjYQ24psPNwcEFByZs:MY16BsywpHO2+SXbygLxuxBKYuMMl5SG
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

collection credential_access evasion

Malware Config

Signatures

Makes use of the framework's Accessibility service 4 TTPs 2 IoCs

Retrieves information displayed on the phone screen using AccessibilityService.

collection evasion credential_access

Input Injection

T1516

Screen Capture

T1513

Keylogging

T1417.001

GUI Input Capture

T1417.002

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	org.zzzz.aaa
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByText	org.zzzz.aaa

org.zzzz.aaa
1⤵
- Makes use of the framework's Accessibility service
PID:4997

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Input Injection

T1516

Credential Access

Input Capture

T1417

GUI Input Capture

T1417.002

Keylogging

T1417.001

Discovery

Lateral Movement

Collection

Input Capture

T1417

GUI Input Capture

T1417.002

Keylogging

T1417.001

Screen Capture

T1513

Command and Control

Exfiltration

Impact

Input Injection

T1516

Replay Monitor

Loading Replay Monitor...

Downloads

profileInstalled

Path /data/data/org.zzzz.aaa/files/profileInstalled
Size 24B
SHA256 385f0db04f038554ec91c3b19a9bb3467969cbac7c25b2fa14d86e47d0578b4c
MD5 ca70d20b40b073264ed73a38964b4db4
SHA1 0a249d13905745d8317a7564c9f107d371bd8b2f
SHA512 da1e6e15d8f7e87441c64f0331fb88d4336e19aa1104312e9cf3c12a22b3f84b5935cacf48d1222cbc85df291450bc3c99711fd904bc88557234770829652a47
MD5 SHA1 SHA512

Submit Download

profileinstaller_profileWrittenFor_lastUpdateTime.dat

Path /data/data/org.zzzz.aaa/files/profileinstaller_profileWrittenFor_lastUpdateTime.dat
Size 8B
SHA256 6a1ba89d344e46eb7a27d332b74ebf0c622c54ff30fcd5646e5e8b3100bd548b
MD5 636f4d61658719dbf8e4fcba6443e617
SHA1 001c2e01a6fb96da9f48fd2635fedde337e18c4b
SHA512 e35b537f7b8cb367181e7808d56bae6f0cd701a7a7addccc7349b527fd8e1e09c65df24a712e4659258c5023f1998626a59cb9ec5db21e457e6b9f5daec7ab6f
MD5 SHA1 SHA512

Submit Download

primary.prof

Path /data/misc/profiles/cur/0/org.zzzz.aaa/primary.prof
Size 1KB
SHA256 6eefcbb1574779d599607010d03118f29488ac7797d100defd82246d556325df
MD5 5276a38e2c2eb135639987d2a0486e84
SHA1 38a08350c707b7f77fd1bb370e83954096c684de
SHA512 4358486e00a9cd395d0d27971569660203ae8cef66afccaef95a42cfa3e4abf767799312a7cec6c636bb65f29c338cddd64181845e20e5cf4afafd4bdce9de1b
MD5 SHA1 SHA512

Submit Download

primary.prof

Path /data/misc/profiles/cur/0/org.zzzz.aaa/primary.prof
Size 2KB
SHA256 b156fbe6614688930f00b4c980c0ebcb016530e72adcd33ae96e8e81347d4c70
MD5 6f14904c0594d7b5c08c4311ce4f0bb9
SHA1 6253e9fa4e6dd18c8fc924ab0a1ba6f5a0efd402
SHA512 47008c25f1f7fa5d004b2d619e4ac997a72f0ec8aa97bab8fe2571c553abd94ae970c3ba2bcb1228a3ce76132ef995c2528bd5112999fffc44203277698650cd
MD5 SHA1 SHA512

Submit Download

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads