240640989e284dc9ebfed246b9db717654a1798b1fe1da775b57f10dd13157bb

Resubmissions

21-11-2024 06:02

241121-grwm6stndn 10

21-11-2024 05:58

241121-gpe8eayepa 10

Analysis

max time kernel
104s
max time network
112s
platform
android_x64
resource
android-33-x64-arm64-20240624-en
resource tags

androidarch:arm64arch:x64image:android-33-x64-arm64-20240624-enlocale:en-usos:android-13-x64system
submitted
21-11-2024 05:58

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ready.apk
Size

3.6MB
MD5

4808782d6d09ecb08dbd1dee07c652ff
SHA1

2d5c7e98593e02996c5db00444ac678bb9463289
SHA256

240640989e284dc9ebfed246b9db717654a1798b1fe1da775b57f10dd13157bb
SHA512

4e8ea03bdcfff3deb571eb266bd103f4d7123631991c5f2cb64cb9dc0d1ce9828f75c3559a27ba9fd2a937cf6ddabee34996e8341d33dd5233d34c43154037e8
SSDEEP

98304:Y+/42pk+ftZFLZ99Ow7d2iHkbknSmzHzBfTN0thJ:rk+1ZFLZ7Oedi6zBC3

Score

7^/10

banker collection credential_access discovery evasion execution persistence

Malware Config

Signatures

Makes use of the framework's Accessibility service 4 TTPs 3 IoCs

Retrieves information displayed on the phone screen using AccessibilityService.

collection evasion credential_access

Input Injection

T1516

Screen Capture

T1513

Keylogging

T1417.001

GUI Input Capture

T1417.002

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	vendor.eh.renaissance
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByText	vendor.eh.renaissance
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId	vendor.eh.renaissance

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
banker discovery

Security Software Discovery
T1418.001

Acquires the wake lock 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	vendor.eh.renaissance

Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

Application may abuse the framework's foreground service to continue running in the foreground.

evasion persistence

Foreground Persistence

T1541

description	ioc	Process
Framework service call	android.app.IActivityManager.setServiceForeground	vendor.eh.renaissance

Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs

evasion

User Evasion

T1628.002

description	ioc	Process
Intent action	android.settings.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS	vendor.eh.renaissance

Requests enabling of the accessibility settings. 1 IoCs

description	ioc	Process
Intent action	android.settings.ACCESSIBILITY_SETTINGS	vendor.eh.renaissance

Schedules tasks to execute at a specified time 1 TTPs 1 IoCs

Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.

execution persistence

Scheduled Task/Job

T1603

description	ioc	Process
Framework service call	android.app.job.IJobScheduler.schedule	vendor.eh.renaissance

vendor.eh.renaissance
1⤵
- Makes use of the framework's Accessibility service
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Requests enabling of the accessibility settings.
- Schedules tasks to execute at a specified time
PID:4388

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Scheduled Task/Job

T1603

Persistence

Foreground Persistence

T1541

Scheduled Task/Job

T1603

Privilege Escalation

Defense Evasion

Foreground Persistence

T1541

Hide Artifacts

T1628

User Evasion

T1628.002

Input Injection

T1516

Credential Access

Input Capture

T1417

GUI Input Capture

T1417.002

Keylogging

T1417.001

Discovery

Software Discovery

T1418

Security Software Discovery

T1418.001

Lateral Movement

Collection

Input Capture

T1417

GUI Input Capture

T1417.002

Keylogging

T1417.001

Screen Capture

T1513

Command and Control

Exfiltration

Impact

Input Injection

T1516

Replay Monitor

Loading Replay Monitor...

Downloads

/storage/emulated/0/Config/sys/apps/log/log-2024-11-21.txt

Filesize
25B

MD5
ba30336bf53d54ed3c0ea69dd545de8c

SHA1
ce99c6724c75b93b7448e2d9fac16ca702a5711f

SHA256
2d6988fb5afdaafc4e33fa1f71d6f10c95ab5a49a8ec820add5b13eef05439af

SHA512
eea34ca526e03349e746d3687ea660b4748f0174fe2ffdb65161e232e08630b345e03329614852ce881a71362ba68575e9dd08fa361a416e5b2fb231e21a0a3e

Download Submit
/storage/emulated/0/Config/sys/apps/log/log-2024-11-21.txt

Filesize
25B

MD5
fd8ed43ac31bbf329c395582c15753cd

SHA1
3c76ee3fa79dde645c0447d6b23d6f435efb3b72

SHA256
049d51bf61bf26d7b9e55391560cc23ec59d2240453ac81b87f2e81153b0fcaf

SHA512
77bb10d1eeeea15fc35f7232af698c951d3f47a5fff56682bbc32f6bea9ebecc997d89ed88c6dff9c226c09446261f184ecbac9697f95799753d73a71e6c4d37

Download Submit
/storage/emulated/0/Config/sys/apps/log/log-2024-11-21.txt

Filesize
25B

MD5
29c860eaf6f36678345f0a9f6b9cc0d9

SHA1
7ffbfbc250be31fd70760cb9f0536e6e4f45c6ef

SHA256
a1ea0cecec3d74e34e9874060753be7786995c8cc62e1daa420f930122f43eec

SHA512
290f920dbee3dd59bd258ec398f0816ee24a620392ce8deaad0e6d1eaa1208f891393522d8125aea4aef9163f9011a02b3463e2d41a4e24bde065fcbad57ed20

Download Submit
/storage/emulated/0/Config/sys/apps/log/log-2024-11-21.txt

Filesize
256B

MD5
2c74251fdb9635941b9577a88afcd9c7

SHA1
e92ee3dd8d28856ec2e4952448e30615ef7728fc

SHA256
35ff2262ff15ce1ea3ad827e52a91f220958b678e8644317256c70e5311d2b47

SHA512
1ddcdbedf1c0c7fe37ffba691ee0f86f9fb2c3025a7da60dc165f687b6785c7ded9b265ef9415ebb7fcafccf416cdc509d54b17367a0c31c1f286d1417aca4b0

Download Submit

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads