6127daf756865ee089ba83efdadebda2c047026a698759de09127d0dfe630e8d

Resubmissions

22-12-2024 18:04

241222-wn1v2svlcs 10

05-12-2024 22:02

241205-1xqtnazqfr 10

Analysis

max time kernel
146s
max time network
150s
platform
android-11_x64
resource
android-x64-arm64-20240910-en
resource tags

arch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20240910-enlocale:en-usos:android-11-x64system
submitted
22-12-2024 18:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6127daf756865ee089ba83efdadebda2c047026a698759de09127d0dfe630e8d.apk
Size

760KB
MD5

3734544ff6e3da8d41e19345384d010f
SHA1

df19a5869fe0fa2a3567c1d96186de0ac83f10ad
SHA256

6127daf756865ee089ba83efdadebda2c047026a698759de09127d0dfe630e8d
SHA512

16814c94dfe32a50a3786431c9195db899f877e8cc3c9599d8fe3e6c92d9b59e30f4fe939d12961b947a158e877af926b034d0aed95829d8466f368dd9c254ba
SSDEEP

12288:xO7GdIpJ6sgRwLzm5UOG4zT5WmpYshXZPbGwidNpg6:xwJ6sbLzmVG4zT5WmD9idNpZ

Score

8^/10

banker discovery evasion persistence stealth trojan

Malware Config

Signatures

Removes its main activity from the application launcher 1 TTPs 1 IoCs

stealth trojan evasion

Suppress Application Icon

T1628.001

pid	Process
4764	cmf0.c3b5bm90zq.patch

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
banker discovery

Security Software Discovery
T1418.001

Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

Application may abuse the framework's foreground service to continue running in the foreground.

evasion persistence

Foreground Persistence

T1541

description	ioc	Process
Framework service call	android.app.IActivityManager.setServiceForeground	cmf0.c3b5bm90zq.patch

cmf0.c3b5bm90zq.patch
1⤵
- Removes its main activity from the application launcher
- Makes use of the framework's foreground persistence service
PID:4764

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Foreground Persistence

T1541

Privilege Escalation

Defense Evasion

Foreground Persistence

T1541

Hide Artifacts

T1628

Suppress Application Icon

T1628.001

Credential Access

Discovery

Software Discovery

T1418

Security Software Discovery

T1418.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/storage/emulated/0/service player/config22-12-2024.log

Filesize
39B

MD5
ae0df0f4fce1a63f7af66314c5fcddfd

SHA1
139be471f075922688cdc2a3722649367b432aac

SHA256
de5836943518d259aba8e964dd8e558b4b0061c104ddc10be88afe4d036be587

SHA512
104a9a2c41a96e717cc77efd49a32d48b15b79c1be05dd8fe943e45987ba01756d2e6c9c5670b9e474fed9bd782426fbe1fd996e03b2280ad3a1f815ef12babb

Download Submit
/storage/emulated/0/service player/config22-12-2024.log

Filesize
76B

MD5
4879bc6cf7cdfb6d31ff0158eadfb3b1

SHA1
4db6b9fd4b2a1c8d340893fb69931abd7ea03097

SHA256
511b23d130ece1fdf7d3f8f111430f161967c8197983806021d24d7cf23e040c

SHA512
691c17428440f7188e4a1c948b0e053a180d9bbb382114f0b9a46f17c3531993af723bb93503ecf69b8b791f9d00e828c259f60b9398b2bbf6df361617897a92

Download Submit
/storage/emulated/0/service player/config22-12-2024.log

Filesize
78B

MD5
206dbfe14159415046b8df9d46428a6c

SHA1
1a143fb485a04df91074bdcb96b5b8bf3ed70132

SHA256
49adb4b8a854012ddef948fdec17449e2d3b76971dd5dc0ae6a1afaa80b07d32

SHA512
934ee410c81a9278109c972771cfe56644041111a4a0119c233c2f9793774424d65d65dbb52df08fa06e01cc76c70346c5d4512bcb61ed3233f23353225086af

Download Submit
/storage/emulated/0/service player/config22-12-2024.log

Filesize
1KB

MD5
af4cb1b9afbaff73c44c4eabc3c15d69

SHA1
6912c874d9af6a0eae39d27df42f4c2e2cb4db0d

SHA256
887fd80a788a107f0e88dbf2e57c02d22f0412ecd3f168033485d902e1da772e

SHA512
86655bdbee35a7b7d79e755f05d6d7a1cd2ee76dd10ef998c9ddd7c9ed9de3a4d69dabb38597484e45ddf67842bc40ba0dedc7bec744633ddba4fc80a70c6aad

Download Submit

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads