345eef06415790547537f434ba5a609e0eae805b282b3f9f916cc31b372c5dac

Analysis

max time kernel
54s
max time network
132s
platform
android_x64
resource
android-33-x64-arm64-20240624-en
resource tags

androidarch:arm64arch:x64image:android-33-x64-arm64-20240624-enlocale:en-usos:android-13-x64system
submitted
27-11-2024 09:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

indus.credit.card-2.apk
Size

35.1MB
MD5

a146c25c8b4140101d3f68507205d8a1
SHA1

fcfc956580093622f8724c8830ce7075d84c4ca0
SHA256

345eef06415790547537f434ba5a609e0eae805b282b3f9f916cc31b372c5dac
SHA512

114a27d05565acebd81df2862b0504cf17ea456a56dd0ec8a831f1a3409c77dab013945c102408af72d275b32d0a63f6337b601696df1f6fbd8c37d7d8b23a35
SSDEEP

786432:CT4XQvCzYrVEjRW9/4m1ssWtb7QBB9R4gUnjQ+19Y:CT4AiYaKUj4BVhMQ1

Score

7^/10

collection evasion persistence

Malware Config

Signatures

Loads dropped Dex/Jar 1 TTPs 4 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

Processes:

com.rewardz.card

ioc	pid	Process
/system_ext/framework/androidx.window.extensions.jar	4307	com.rewardz.card
/system_ext/framework/androidx.window.extensions.jar	4307	com.rewardz.card
/system_ext/framework/androidx.window.sidecar.jar	4307	com.rewardz.card
/system_ext/framework/androidx.window.sidecar.jar	4307	com.rewardz.card

Reads the content of the SMS messages. 1 TTPs 1 IoCs

collection

SMS Messages

T1636.004

Processes:

com.rewardz.card

description	ioc	Process
URI accessed for read	content://sms/	com.rewardz.card

Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

Application may abuse the framework's foreground service to continue running in the foreground.

evasion persistence

Foreground Persistence

T1541

Processes:

com.rewardz.card

description	ioc	Process
Framework service call	android.app.IActivityManager.setServiceForeground	com.rewardz.card

com.rewardz.card
1⤵
- Loads dropped Dex/Jar
- Reads the content of the SMS messages.
- Makes use of the framework's foreground persistence service
PID:4307

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Foreground Persistence

T1541

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Foreground Persistence

T1541

Credential Access

Discovery

Lateral Movement

Collection

Protected User Data

T1636

SMS Messages

T1636.004

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.rewardz.card/files/mob.txt

Filesize
10B

MD5
0a9b034d3211111753c2af7f0cc40c78

SHA1
e970d2d83f4d0a08d924fed76c7fc2c3228c866e

SHA256
451b02b529a2fe3729d1de52c44501401f2c319ed55e9f6834fd8d4527c154ad

SHA512
a58e6f575d8826af58bd5feb00f037b6afddcc6bd460099f24a18e0850b631453371e113b1710c5596607b2927e61237c7000915a2bc56cb943c01da03e2aced

Download Submit
/data/data/com.rewardz.card/files/profileInstalled

Filesize
24B

MD5
3b9064f29793336f1290d558bbc3a216

SHA1
359a4edf2ca6229fd9f480cc07073dbe55dd8b5d

SHA256
aec550ab945854fce835c1077254678a045e14dd5ec70c03cc5828c524cd70a1

SHA512
3bf9a827a2e3a2392b82684c88e75538aaf37c195c146f8cd27765066c002339d3cb26b4221130b8d779e555dceff5fb8aaeeb6050129a229de6a62aa9786f84

Download Submit
/system_ext/framework/androidx.window.extensions.jar

Filesize
123KB

MD5
3056e1bdb7d4e19789d0319eff484bd0

SHA1
6791ae47aa9466fe0bca27ad6643f846853bbee4

SHA256
8e6331a07c9f2ac139214c527dcaff2c82d126bbe7bd3420cdc36d6a8c9204b0

SHA512
c790980fd68d9f89e32743bc28846807d5e5947c555f494de47714dec5cbd0c08d81c3260fa463759d1b17a953af3c44ec30b14fb08bf6b29db3837346c9f658

Download Submit
/system_ext/framework/androidx.window.sidecar.jar

Filesize
25KB

MD5
29469324e59dfcc052f24b5af4e7b2c4

SHA1
10c1e17ac6f598037bb51baa07945663645de4eb

SHA256
9195dc6a1c75a841384050240dfc972e48178964993fba6619788625f4b40d1a

SHA512
5e27c2b1431369a248298f2f749136a575005584f9999f2a4c204a0c47adce2e33c8df9f058bdafa1bde1c99e46d175560cedfcddcd8581718ed1d9973c37cc2

Download Submit