2149d2a70bd47236a0ac2ead264a3950b64b06c1c0bbfdf5202b612e7af55479

Resubmissions

20/01/2025, 22:13

250120-14648asjgy 10

20/01/2025, 22:10

250120-13ryxasjbs 10

Analysis

max time kernel
96s
max time network
111s
platform
android_x64
resource
android-33-x64-arm64-20240624-en
resource tags

androidarch:arm64arch:x64image:android-33-x64-arm64-20240624-enlocale:en-usos:android-13-x64system
submitted
20/01/2025, 22:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Blockchain.apk
Size

4.4MB
MD5

afbbf52a1be9a76bfb95dc4998bf2b89
SHA1

edb9dcc93d9eddffce37de455674af64cdb3ecd5
SHA256

2149d2a70bd47236a0ac2ead264a3950b64b06c1c0bbfdf5202b612e7af55479
SHA512

0f1f68d478ea237585d392d473c94f0ee959353f063da9acc238881d7181e76671ecb46984b01f2d9342e3f6cc3daa153f5d03048d7b506f12c774e85c9178c9
SSDEEP

98304:I2ZjJdEj9X4EwHhS7Q2iyDjh8mzfzBdTJ0t8XSsqt:IEjcjaEwHI823zfmQ6

Score

7^/10

banker collection credential_access defense_evasion discovery execution persistence

Malware Config

Signatures

Makes use of the framework's Accessibility service 4 TTPs 1 IoCs

Retrieves information displayed on the phone screen using AccessibilityService.

collection defense_evasion credential_access

Input Injection

T1516

Screen Capture

T1513

Keylogging

T1417.001

GUI Input Capture

T1417.002

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	com.diabetes.charter

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
banker discovery

Security Software Discovery
T1418.001

Acquires the wake lock 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.diabetes.charter

Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

Application may abuse the framework's foreground service to continue running in the foreground.

defense_evasion persistence

Foreground Persistence

T1541

description	ioc	Process
Framework service call	android.app.IActivityManager.setServiceForeground	com.diabetes.charter

Schedules tasks to execute at a specified time 1 TTPs 1 IoCs

Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.

execution persistence

Scheduled Task/Job

T1603

description	ioc	Process
Framework service call	android.app.job.IJobScheduler.schedule	com.diabetes.charter

com.diabetes.charter
1⤵
- Makes use of the framework's Accessibility service
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Schedules tasks to execute at a specified time
PID:4363

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Scheduled Task/Job

T1603

Persistence

Foreground Persistence

T1541

Scheduled Task/Job

T1603

Privilege Escalation

Defense Evasion

Foreground Persistence

T1541

Input Injection

T1516

Credential Access

Input Capture

T1417

GUI Input Capture

T1417.002

Keylogging

T1417.001

Discovery

Software Discovery

T1418

Security Software Discovery

T1418.001

Lateral Movement

Collection

Input Capture

T1417

GUI Input Capture

T1417.002

Keylogging

T1417.001

Screen Capture

T1513

Command and Control

Exfiltration

Impact

Input Injection

T1516

Replay Monitor

Loading Replay Monitor...

Downloads

/storage/emulated/0/Config/sys/apps/log/log-2025-01-20.txt

Filesize
13B

MD5
de2c41a51ee9246eb1708f65b511add0

SHA1
2f442d634c8a18760a232c8829d4b5d74a52f074

SHA256
ad2d914ca347cd1930e32f21c6d5448c34104bea181b93abc85ec518985653ab

SHA512
7cdfbd001594503644e9ed80ae852f90ef9e841a8382e2eec6979e149a2c400a3b83055d205b4d1d66e1600e5127482932d5127eb5800d35a4ee5673fe34d84a

Download Submit
/storage/emulated/0/Config/sys/apps/log/log-2025-01-20.txt

Filesize
41B

MD5
bc3e40e7cd9d2b5c4451ca1c368002ed

SHA1
c0b6dc723cf98755883bc75ae297f74c5219d221

SHA256
832275b4be93c4713c261c11a92ee43be29bf2d3d2f057973d19c87ff8a396d4

SHA512
ec67c544afe6337218a22a73a95b3341742ae2f5ea7ea3cb64ed034a3f28b418e42cb3ab229948af0747870144798d122b86015d2e907dbdc195e2b5db566a36

Download Submit
/storage/emulated/0/Config/sys/apps/log/log-2025-01-20.txt

Filesize
25B

MD5
f887057946e442b747840a9140cf77ed

SHA1
7eb1b8cfe9de8f236fb0f5619a69690f123d82e3

SHA256
5a8041977eab945a751d8549895ee2cc4984ba9d3737d78611482c4e7b992659

SHA512
d9988b569f7923f73cc3f347b65130c5903bbf111f90f1160ef0b680632d89548334e76259cd3c1c4e14469b3a6a6d235ce3c570f9d646acea4a00f33f78e785

Download Submit
/storage/emulated/0/Config/sys/apps/log/log-2025-01-20.txt

Filesize
45B

MD5
11e464064dcae11be7956bbd5e854dc1

SHA1
33f37d3846cab06a54e791fbd683e5c6359add58

SHA256
c47b1353029508b39f7b6c7660a73a6434fc47c67acbcc5fc0a4d536484594d5

SHA512
02bc0a1469cd93bb63027291c7e9ccf21a0cdebff5a56996b7e03f92020b40dbada10bcd09ab41e29415bda65d9cafe948415a9542af897fd9561560adfb3ba4

Download Submit
/storage/emulated/0/Config/sys/apps/log/log-2025-01-20.txt

Filesize
57B

MD5
4bb997cc2b2ec94fcb9bc341325b0d77

SHA1
6c6974fea18700f412b7e7b2d4be49e7c2a993ae

SHA256
941bd7bc2cca4cb941d7f89acdbb1ee3ae2613482c34a030eafbed10d22ae865

SHA512
f4d3e8b37c0f607a61468f702fe723572e47f41a869720833fc2bc3f4b9340f809484d6435f3ff0a3d45f8a5bcd765540980a9a9ac1ae5591deb0c869bd3a9a5

Download Submit

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads