758cbf74036ee718530f699f327b9c9eb833f6f2ca495749ed7614644d98ac7e

Analysis

max time kernel
149s
max time network
156s
platform
android_x64
resource
android-x64-20240624-en
resource tags

androidarch:x64arch:x86image:android-x64-20240624-enlocale:en-usos:android-10-x64system
submitted
23-11-2024 02:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

758cbf74036ee718530f699f327b9c9eb833f6f2ca495749ed7614644d98ac7e.apk
Size

684KB
MD5

874a2d006e3df683e3d84a0b6ffa7427
SHA1

28f90d85bea9dcec6c246d2e1e0d81d20d84bdfd
SHA256

758cbf74036ee718530f699f327b9c9eb833f6f2ca495749ed7614644d98ac7e
SHA512

1f59fd316c5405dd18e8ac07319440fb14e02396759339b411cf01b0b7f6d35fca1c326a4f4a2bae322fd3ef3003bdebdd11b89de2537af6bae3e3a70a4a20d0
SSDEEP

12288:DphYy/p6FOjENqxpXPcRZY90ipEKbM/qd6IusT3cgtN0Fvm16Rq212gXH:NhYKkYdpEomqd6IHT3SFvm1GNjXH

Score

8^/10

collection credential_access evasion persistence stealth trojan

Malware Config

Signatures

Removes its main activity from the application launcher 1 TTPs 1 IoCs
stealth trojan evasion

Suppress Application Icon
T1628.001

Processes:

splash.app.main

pid process

4983 splash.app.main

pid	process
4983	splash.app.main

Makes use of the framework's Accessibility service 4 TTPs 2 IoCs

Retrieves information displayed on the phone screen using AccessibilityService.

collection evasion credential_access

Input Injection

T1516

Screen Capture

T1513

Keylogging

T1417.001

GUI Input Capture

T1417.002

Processes:

splash.app.main

description	ioc	process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	splash.app.main
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId	splash.app.main

Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
evasion persistence

Foreground Persistence
T1541

Processes:

splash.app.main

description ioc process

Framework service call android.app.IActivityManager.setServiceForeground splash.app.main
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
persistence

Broadcast Receivers
T1624.001

Processes:

splash.app.main

description ioc process

Framework service call android.app.IActivityManager.registerReceiver splash.app.main

description	ioc	process
Framework service call	android.app.IActivityManager.setServiceForeground	splash.app.main

description	ioc	process
Framework service call	android.app.IActivityManager.registerReceiver	splash.app.main

splash.app.main
1⤵
- Removes its main activity from the application launcher
- Makes use of the framework's Accessibility service
- Makes use of the framework's foreground persistence service
- Registers a broadcast receiver at runtime (usually for listening for system events)
PID:4983

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Foreground Persistence

T1541

Privilege Escalation

Defense Evasion

Foreground Persistence

T1541

Hide Artifacts

T1628

Suppress Application Icon

T1628.001

Input Injection

T1516

Credential Access

Input Capture

T1417

GUI Input Capture

T1417.002

Keylogging

T1417.001

Discovery

Lateral Movement

Collection

Input Capture

T1417

GUI Input Capture

T1417.002

Keylogging

T1417.001

Screen Capture

T1513

Command and Control

Exfiltration

Impact

Input Injection

T1516

Replay Monitor

Loading Replay Monitor...

Downloads

/storage/emulated/0/Config/sys/apps/log/log-MjAyNC0xMS0yMw== .txt

Filesize
24B

MD5
2cb7ee8f096cb9fbcd14bc28733cb604

SHA1
469bc56f4cd04633640b477b49691d4b95a1351e

SHA256
ab4a9ecd49e5e00fcff0a8be1281e85bbc5648fb3a1d89c72a504d7d676ebe74

SHA512
868e7a711a7ec24f178abdc3d410467b172440543a0e7b40e58af174260043329e5d526f0c421e02a01aee61eadfdfdbdff4e232cd49035aa9e3dcb4bfafee61

Download Submit
/storage/emulated/0/Config/sys/apps/log/log-MjAyNC0xMS0yMw== .txt

Filesize
24B

MD5
19e9022a0237abfcb41de0da45b6cdc8

SHA1
cfcb8500f6e281eb42e54dbf472cc05fefdf55ac

SHA256
6a3ed19be60f504848d404f19e7c3dc35b0e2d623fab204e02d6aa93acc0c4c3

SHA512
bd02400d5f3f91054f1bf60ccc35457d6f3d83fccae18b3fbbe22b81c5fa86e430d2886685a6a7777c5714d25b16499be31ce86097e64d3b878c04d89dd2aec6

Download Submit
/storage/emulated/0/Config/sys/apps/log/log-MjAyNC0xMS0yMw== .txt

Filesize
40B

MD5
3a71cc46a72de9883a7b8fa8cbe34ca1

SHA1
ef1bbdb281e546b3628a1a845b4941db1ca9e4a3

SHA256
c06d9e99f6ee253432eadfdfac6008e211182c3770fd883fd0ff6e4e08a5e201

SHA512
f65df913a1f4ecb920de54fb6c30ec52368e3b61043f9e37656f364d420f97d3a816ef2b0c6d9e770521e3cf1818cf9c5d689482418278b3c967a4d57c9bdf07

Download Submit
/storage/emulated/0/Config/sys/apps/log/log-MjAyNC0xMS0yMw== .txt

Filesize
279B

MD5
12b5ad4d0ed5dfcf236a1b2fb5a6f53d

SHA1
4177a934dbefde119cea55a015a07fa83a7eb27a

SHA256
4b68a25b37de94c8c05fad0519376d3ce7cbdd5f967239f8154c8b9a87e844d3

SHA512
5437b8c04a2fba346a33e6491df366f57b35869585902782ccf97043d3bedb03290df8f64312be862f48f77c16b07ed23d20da65bb7f05c39b155a019873fc94

Download Submit