91135fdeeab900ad00302f025096741e3fbfe3e5ba2aee57c7d513564ff24d86

Resubmissions

19/11/2024, 14:32

241119-rwbtnsxbpe10

14/11/2024, 22:11

241114-13x5xstkf110

Analysis

max time kernel
93s
max time network
133s
platform
android_x64
resource
android-x64-arm64-20240624-en
resource tags

androidarch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20240624-enlocale:en-usos:android-11-x64system
submitted
19/11/2024, 14:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
91135fdeeab900ad00302f025096741e3fbfe3e5ba2aee57c7d513564ff24d86.apk
Size 1.7MB
Sample241119-rwbtnsxbpe
SHA256 91135fdeeab900ad00302f025096741e3fbfe3e5ba2aee57c7d513564ff24d86
MD5 c26183f4f0f2e9975bc024ce8b5ee589
SHA1 2041e38801cdb8d0cf97cf431862c179e55e06bf
SHA512 04d4056ce0cf87b1ae7e523f1f0222988c1836daa69582f6884fd115dcea0ec11ed21ab955aefdb6c3b72204da5f47f0b9a78b69665191314a8b065cfd793bf7
SSDEEP 24576:MY16HCMBS2sywb22L5JO2+SYCbygLBdP5uxljy9YuMDgIqjYQ24psPNwcEFByZs:MY16BsywpHO2+SXbygLxuxBKYuMMl5SG
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

collection credential_access evasion

Malware Config

Signatures

Makes use of the framework's Accessibility service 4 TTPs 2 IoCs

Retrieves information displayed on the phone screen using AccessibilityService.

collection evasion credential_access

Input Injection

T1516

Screen Capture

T1513

Keylogging

T1417.001

GUI Input Capture

T1417.002

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByText	org.zzzz.aaa
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	org.zzzz.aaa

org.zzzz.aaa
1⤵
- Makes use of the framework's Accessibility service
PID:4645

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Input Injection

T1516

Credential Access

Input Capture

T1417

GUI Input Capture

T1417.002

Keylogging

T1417.001

Discovery

Lateral Movement

Collection

Input Capture

T1417

GUI Input Capture

T1417.002

Keylogging

T1417.001

Screen Capture

T1513

Command and Control

Exfiltration

Impact

Input Injection

T1516

Replay Monitor

Loading Replay Monitor...

Downloads

profileinstaller_profileWrittenFor_lastUpdateTime.dat

Path /data/data/org.zzzz.aaa/files/profileinstaller_profileWrittenFor_lastUpdateTime.dat
Size 8B
SHA256 9c56cb4a5c1b02bf0a33856e1d85e107a374041d94e1649857a01107b54220e1
MD5 fd81f97c54231987fbb7c95484f864da
SHA1 9ebc63f8944e2c5f32a3b5ffbd7bfc6552b8454a
SHA512 e6cb873e6c3714d8dfe7d19a9f76c2e4bbbfe40052042dca6358e498161db0d55d7bd079164ce213b0000f8f7990e7afccdb1bb286d714103733e7497a3d11fa
MD5 SHA1 SHA512

Submit Download

primary.prof

Path /data/misc/profiles/cur/0/org.zzzz.aaa/primary.prof
Size 1KB
SHA256 6eefcbb1574779d599607010d03118f29488ac7797d100defd82246d556325df
MD5 5276a38e2c2eb135639987d2a0486e84
SHA1 38a08350c707b7f77fd1bb370e83954096c684de
SHA512 4358486e00a9cd395d0d27971569660203ae8cef66afccaef95a42cfa3e4abf767799312a7cec6c636bb65f29c338cddd64181845e20e5cf4afafd4bdce9de1b
MD5 SHA1 SHA512

Submit Download

primary.prof

Path /data/misc/profiles/cur/0/org.zzzz.aaa/primary.prof
Size 2KB
SHA256 3e9724402cfbd7f1f3d871be88db6671fcaa50496d995adf45dbec0d5742b568
MD5 a75bfef2900048173bf1290b5999389a
SHA1 7c1471d0f11d0374cc1cb4ff02b1cf076d2cd1b6
SHA512 2394d1a16cf903e6e32ecab52177f84948d678892f8597586b7bb2dbf24f982268bb8cae8e1de85b30290d9c6529ea54aae08f0253eb71e24fa6f034489931cc
MD5 SHA1 SHA512

Submit Download

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads