91135fdeeab900ad00302f025096741e3fbfe3e5ba2aee57c7d513564ff24d86

Resubmissions

19/11/2024, 14:32

241119-rwbtnsxbpe10

14/11/2024, 22:11

241114-13x5xstkf110

Analysis

max time kernel
93s
max time network
132s
platform
android_x86
resource
android-x86-arm-20240624-en
resource tags

androidarch:armarch:x86image:android-x86-arm-20240624-enlocale:en-usos:android-9-x86system
submitted
19/11/2024, 14:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
91135fdeeab900ad00302f025096741e3fbfe3e5ba2aee57c7d513564ff24d86.apk
Size 1.7MB
Sample241119-rwbtnsxbpe
SHA256 91135fdeeab900ad00302f025096741e3fbfe3e5ba2aee57c7d513564ff24d86
MD5 c26183f4f0f2e9975bc024ce8b5ee589
SHA1 2041e38801cdb8d0cf97cf431862c179e55e06bf
SHA512 04d4056ce0cf87b1ae7e523f1f0222988c1836daa69582f6884fd115dcea0ec11ed21ab955aefdb6c3b72204da5f47f0b9a78b69665191314a8b065cfd793bf7
SSDEEP 24576:MY16HCMBS2sywb22L5JO2+SYCbygLBdP5uxljy9YuMDgIqjYQ24psPNwcEFByZs:MY16BsywpHO2+SXbygLxuxBKYuMMl5SG
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

collection credential_access evasion

Malware Config

Signatures

Makes use of the framework's Accessibility service 4 TTPs 2 IoCs

Retrieves information displayed on the phone screen using AccessibilityService.

collection evasion credential_access

Input Injection

T1516

Screen Capture

T1513

Keylogging

T1417.001

GUI Input Capture

T1417.002

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	org.zzzz.aaa
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByText	org.zzzz.aaa

org.zzzz.aaa
1⤵
- Makes use of the framework's Accessibility service
PID:4261

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Input Injection

T1516

Credential Access

Input Capture

T1417

GUI Input Capture

T1417.002

Keylogging

T1417.001

Discovery

Lateral Movement

Collection

Input Capture

T1417

GUI Input Capture

T1417.002

Keylogging

T1417.001

Screen Capture

T1513

Command and Control

Exfiltration

Impact

Input Injection

T1516

Replay Monitor

Loading Replay Monitor...

Downloads

profileInstalled

Path /data/data/org.zzzz.aaa/files/profileInstalled
Size 24B
SHA256 3a5f6e93fd7eae4ebc937eb6c9554cc381597f8f8631f7195595c72bbef07194
MD5 781db4f77e3c690c8e77ead822a0265c
SHA1 3107b0c9dddf51dbcba516ae9682f01b8c0d201b
SHA512 86fece3391eff56aa00deb333910ccb9155d81fe61f071190573c57a2faad712be1e3ddf23306652b655bd542d92636c32dd9289d61c0535af275902fbc2003d
MD5 SHA1 SHA512

Submit Download

profileinstaller_profileWrittenFor_lastUpdateTime.dat

Path /data/data/org.zzzz.aaa/files/profileinstaller_profileWrittenFor_lastUpdateTime.dat
Size 8B
SHA256 0f5f1b17b2d21bd7ce26caa9e7b8aa9d73eea9c50bc54c78802c9f3cece23efb
MD5 e50ec54e8786675d9689b337f9743d55
SHA1 ac59efd2189d5f3cec2016cf11a8b6d7c768e8ac
SHA512 25d5eb1b6e7c451a1cdf9627a5df53b28c1306c561428f7d70a36a4f7143b3b7b3da955474e5f4485666af3646cd300257d2ab52c30f8ed98ce46c9c3a23980b
MD5 SHA1 SHA512

Submit Download

primary.prof

Path /data/misc/profiles/cur/0/org.zzzz.aaa/primary.prof
Size 1KB
SHA256 6eefcbb1574779d599607010d03118f29488ac7797d100defd82246d556325df
MD5 5276a38e2c2eb135639987d2a0486e84
SHA1 38a08350c707b7f77fd1bb370e83954096c684de
SHA512 4358486e00a9cd395d0d27971569660203ae8cef66afccaef95a42cfa3e4abf767799312a7cec6c636bb65f29c338cddd64181845e20e5cf4afafd4bdce9de1b
MD5 SHA1 SHA512

Submit Download

primary.prof

Path /data/misc/profiles/cur/0/org.zzzz.aaa/primary.prof
Size 2KB
SHA256 d20fac568b680f691210f03e2af9df41ffb3769cd69372f01aceac4d14b15bb9
MD5 664709f366dd89536ad59274e8354699
SHA1 a8b3bb10635ff19f0e3feb475d868cc5d3b3f3ab
SHA512 77f5b18256cf02ab6d595747c5104ef42639241fb1fbb3a8bf99b00e2e9c1112d0ecc9146685f6945c519e14f0ccd1204c7aa438c1b2ed271b83a505479fcaf3
MD5 SHA1 SHA512

Submit Download

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads