84298b63d63c59ba63775367bbc615a0fa1aeb2b9f02cb4a2b664f611aaa5067

Analysis

max time kernel
149s
max time network
134s
platform
android_x64
resource
android-33-x64-arm64-20240624-en
resource tags

androidarch:arm64arch:x64image:android-33-x64-arm64-20240624-enlocale:en-usos:android-13-x64system
submitted
17-02-2025 17:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ready.apk
Size

9.4MB
MD5

b5b733fe818647c731a8e5f1f839c332
SHA1

078e18aadc08dd26e410785426ab19ede31a1a67
SHA256

84298b63d63c59ba63775367bbc615a0fa1aeb2b9f02cb4a2b664f611aaa5067
SHA512

5e7b87e99550b02e371584b081fa0a731d3d77f3b42a992b0d5e47c5b74beaae53e202d6452caff7b15c76e88f7aa5c4650f0ed2c3fa87e4143fe36f63aa5606
SSDEEP

98304:ENNGh4aOCizJl4Ir6COvecaLWFDauKmzxzB3TE0tlp3C:Ee4ZR4IrDOWcf+ulzn3+

Score

7^/10

collection credential_access defense_evasion persistence

Malware Config

Signatures

Makes use of the framework's Accessibility service 4 TTPs 1 IoCs

Retrieves information displayed on the phone screen using AccessibilityService.

collection defense_evasion credential_access

Input Injection

T1516

Screen Capture

T1513

Keylogging

T1417.001

GUI Input Capture

T1417.002

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	zealand.barry.lace

Acquires the wake lock 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	zealand.barry.lace

Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

Application may abuse the framework's foreground service to continue running in the foreground.

defense_evasion persistence

Foreground Persistence

T1541

description	ioc	Process
Framework service call	android.app.IActivityManager.setServiceForeground	zealand.barry.lace

zealand.barry.lace
1⤵
- Makes use of the framework's Accessibility service
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
PID:4358

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Foreground Persistence

T1541

Privilege Escalation

Defense Evasion

Foreground Persistence

T1541

Input Injection

T1516

Credential Access

Input Capture

T1417

GUI Input Capture

T1417.002

Keylogging

T1417.001

Discovery

Lateral Movement

Collection

Input Capture

T1417

GUI Input Capture

T1417.002

Keylogging

T1417.001

Screen Capture

T1513

Command and Control

Exfiltration

Impact

Input Injection

T1516

Replay Monitor

Loading Replay Monitor...

Downloads

/storage/emulated/0/Config/sys/apps/log/log-2025-02-17.txt

Filesize
13B

MD5
de2c41a51ee9246eb1708f65b511add0

SHA1
2f442d634c8a18760a232c8829d4b5d74a52f074

SHA256
ad2d914ca347cd1930e32f21c6d5448c34104bea181b93abc85ec518985653ab

SHA512
7cdfbd001594503644e9ed80ae852f90ef9e841a8382e2eec6979e149a2c400a3b83055d205b4d1d66e1600e5127482932d5127eb5800d35a4ee5673fe34d84a

Download Submit
/storage/emulated/0/Config/sys/apps/log/log-2025-02-17.txt

Filesize
29B

MD5
ece45f8623243feea4df6c2fe45b36e1

SHA1
ef24e005271d92ed255e24a40a15d94b0d5f6bd3

SHA256
e011b2d4119782d41972729f76497925f6f503f6b87dbf8363a50d5134ff39a2

SHA512
86e5a142bb1c4607af14414558fca4711e9a043842aef5add7229d2b49a640d43d62383729edd60869f26e2ad28218d48228303e358b56038267d8bdaf6353da

Download Submit
/storage/emulated/0/Config/sys/apps/log/log-2025-02-17.txt

Filesize
29B

MD5
f8234b863eccb4fbc29c08bb35e6758a

SHA1
bcc2e817b9cf536781d03e76030abe58e7a7b4dd

SHA256
284e2fd886a1db3b8598f6175dc584bfe5ea01bac5c8b68cc211e22df72c4bbf

SHA512
434d7d601449dbdae7fddcf8ffb75e1eb4ef839d3db0e9ac0cb80da23d45530a9da7ac0a17bf2393af43c0470300dfcafe1a645759865f4100c52cc3f32205a0

Download Submit
/storage/emulated/0/Config/sys/apps/log/log-2025-02-17.txt

Filesize
25B

MD5
bdb821a955117250611e94cd23842584

SHA1
81edcea1b44f94cfc140710c8410d0696b760c67

SHA256
076eb89055ff3d929eb732e1002a0105652e628682a741151388ce1df3b6ec9d

SHA512
e52ffed4ee84acc414c530c239c8876d9e99c1f2b2c7626c0ed7fbe0c59b9cb8f8a5e9e983541bea3dfdb849dd3b9593df054c2482ed8bcda7c70ebd960ca268

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads