Overview

overview

10

Static

static

10

8b6d047c9a...e3.apk

android-10-x64

7

Sharing

Copy URL
Twitter E-mail

General

  • Target

    8b6d047c9a1985c0c15ef0452828e8a77270fe122f51b953d16f0d81c507cce3.apk

  • Size

    8.2MB

  • Sample

    250108-gk1csaxjbs

  • MD5

    6bc387da039c291fb62616d6e8074823

  • SHA1

    83d6bf50024cb4e955a9392bb68311ad05f74290

  • SHA256

    8b6d047c9a1985c0c15ef0452828e8a77270fe122f51b953d16f0d81c507cce3

  • SHA512

    712ebce39bf9cd9eb3506b935e6c7819b845558a495bd6d9de8acf54fcdff3222552666ae83500a90fec2f6aec6942386256993c768deddfb52f578d5221903c

  • SSDEEP

    196608:+aI3W+FAOiCyrWC+DFB7jKIyXfipcLpuLqp8IwcFyWIBcDRDKDrDjDCPDvDADgtJ:y31+Dr8FpR4umqYZIK9ev3O7UkJ

Score
10/10
copybaraandroidcollectioncredential_accessdiscoveryevasionimpactpersistence

Malware Config

Targets

    • Target

      8b6d047c9a1985c0c15ef0452828e8a77270fe122f51b953d16f0d81c507cce3.apk

    • Size

      8.2MB

    • MD5

      6bc387da039c291fb62616d6e8074823

    • SHA1

      83d6bf50024cb4e955a9392bb68311ad05f74290

    • SHA256

      8b6d047c9a1985c0c15ef0452828e8a77270fe122f51b953d16f0d81c507cce3

    • SHA512

      712ebce39bf9cd9eb3506b935e6c7819b845558a495bd6d9de8acf54fcdff3222552666ae83500a90fec2f6aec6942386256993c768deddfb52f578d5221903c

    • SSDEEP

      196608:+aI3W+FAOiCyrWC+DFB7jKIyXfipcLpuLqp8IwcFyWIBcDRDKDrDjDCPDvDADgtJ:y31+Dr8FpR4umqYZIK9ev3O7UkJ

    Score
    7/10
    collectioncredential_accessdiscoveryevasionimpactpersistence

    • Makes use of the framework's Accessibility service

      Retrieves information displayed on the phone screen using AccessibilityService.

      collectionevasioncredential_access

    • Obtains sensitive information copied to the device clipboard

      Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.

      collectioncredential_accessimpact

    • Acquires the wake lock

    • Makes use of the framework's foreground persistence service

      Application may abuse the framework's foreground service to continue running in the foreground.

      evasionpersistence

    • Performs UI accessibility actions on behalf of the user

      Application may abuse the accessibility service to prevent their removal.

      evasion

    • Queries the mobile country code (MCC)

      discovery
    behavioral1

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Event Triggered Execution

1
T1624

Broadcast Receivers

1
T1624.001

Foreground Persistence

1
T1541

Privilege Escalation

Defense Evasion

Foreground Persistence

1
T1541

Impair Defenses

1
T1629

Prevent Application Removal

1
T1629.001

Input Injection

1
T1516

Virtualization/Sandbox Evasion

2
T1633

System Checks

2
T1633.001

Credential Access

Clipboard Data

1
T1414

Input Capture

2
T1417

GUI Input Capture

1
T1417.002

Keylogging

1
T1417.001

Discovery

System Information Discovery

2
T1426

System Network Configuration Discovery

1
T1422

Lateral Movement

Collection

Clipboard Data

1
T1414

Input Capture

2
T1417

GUI Input Capture

1
T1417.002

Keylogging

1
T1417.001

Screen Capture

1
T1513

Command and Control

Exfiltration

Impact

Data Manipulation

1
T1641

Transmitted Data Manipulation

1
T1641.001

Input Injection

1
T1516

Tasks