282fc9917abb9518477f6e782f595f74c821612f619310743d91e69e946ec000

Analysis

max time kernel
148s
max time network
134s
platform
android_x64
resource
android-x64-arm64-20240624-en
resource tags

androidarch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20240624-enlocale:en-usos:android-11-x64system
submitted
19-02-2025 18:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

client.apk
Size

760KB
MD5

c9a25e311c30dec7d9f46fce34f0790b
SHA1

32531fbb5a1d1f0f1cb9977148dce10301b74af4
SHA256

282fc9917abb9518477f6e782f595f74c821612f619310743d91e69e946ec000
SHA512

47580c0b20509b7e169b060b8d09afd256d6fa7a803b1013018f8f028f1db4acbed63ef71222eb7370fc44318dd5c47fd94dccc94c570f2db81497efd0a9ed3f
SSDEEP

12288:wOxbAa1a8LVesP1yAMU5p5WmpYshXZPbGwidNpgvhx:wZa1aKesP1MU5p5WmD9idNpA7

Score

8^/10

banker defense_evasion discovery evasion impact persistence privilege_escalation stealth trojan

Malware Config

Signatures

Removes its main activity from the application launcher 1 TTPs 1 IoCs

stealth trojan evasion

Suppress Application Icon

T1628.001

pid	Process
4639	cmf0.c3b5bm90zq.patch

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
banker discovery

Security Software Discovery
T1418.001

Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

Application may abuse the framework's foreground service to continue running in the foreground.

defense_evasion persistence

Foreground Persistence

T1541

description	ioc	Process
Framework service call	android.app.IActivityManager.setServiceForeground	cmf0.c3b5bm90zq.patch

Requests enabling of the accessibility settings. 1 IoCs

description	ioc	Process
Intent action	android.settings.ACCESSIBILITY_SETTINGS	cmf0.c3b5bm90zq.patch

Tries to add a device administrator. 2 TTPs 1 IoCs

privilege_escalation impact

Device Administrator Permissions

T1626.001

Account Access Removal

T1640

description	ioc	Process
Intent action	android.app.action.ADD_DEVICE_ADMIN	cmf0.c3b5bm90zq.patch

cmf0.c3b5bm90zq.patch
1⤵
- Removes its main activity from the application launcher
- Makes use of the framework's foreground persistence service
- Requests enabling of the accessibility settings.
- Tries to add a device administrator.
PID:4639

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Foreground Persistence

T1541

Privilege Escalation

Abuse Elevation Control Mechanism

T1626

Device Administrator Permissions

T1626.001

Defense Evasion

Foreground Persistence

T1541

Hide Artifacts

T1628

Suppress Application Icon

T1628.001

Credential Access

Discovery

Software Discovery

T1418

Security Software Discovery

T1418.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Account Access Removal

T1640

Replay Monitor

Loading Replay Monitor...

Downloads

/storage/emulated/0/systeminformation.android.app/config19-02-2025.log

Filesize
39B

MD5
a7aa16fefeb63102f667d1fd4c608f3c

SHA1
ebcb630fb6d7ea5cf960c34e0d4b873cb3da9c16

SHA256
8f4b155660b3d1100e3dc1b48c0539bc3179dd433436e8474308e045bc5a3048

SHA512
c71ee18723bfacaf8d32c26ed4c3bc13b4b797f49b59d0dc31b9ee7205f0d2ade36f5274569fd852f23186384dc3f95b8472872202dc435324b58c357dea4944

Download Submit
/storage/emulated/0/systeminformation.android.app/config19-02-2025.log

Filesize
66B

MD5
412e668529c5a69cbe0c771f848f9f44

SHA1
d8ea3165e681e925a8d939018f7ed665ee37d98b

SHA256
916bdeeff98c060c143409e86acfc6f403c1fd70e0284b176d76312a838c5e02

SHA512
daab554a4b517124094d9a74a0ea1a8870fbfcf39bf583268828478a32e59aabafa93a152037fb71ce435a928d19d02b6ca11743d9c510f54b3feef2407ded75

Download Submit
/storage/emulated/0/systeminformation.android.app/config19-02-2025.log

Filesize
62B

MD5
ebc60d200961abac918873af555c9336

SHA1
145f40770ddd4061f135b4acc3b4cbb487b5f646

SHA256
ab1f8d85ff0007676f11ed59203b274ec3acf2cba564159f8acb5054087b7d77

SHA512
027dfe0e808ca5f7868a28ed9e6de0d06937aa56190eccd0c1032f6790bbfce8fef9c0b2ca4cdf6b6f541c496af38c30688111f577636baa5d777c597f50dbbc

Download Submit
/storage/emulated/0/systeminformation.android.app/config19-02-2025.log

Filesize
94B

MD5
0116c9462a6064ee9ac33dc347977107

SHA1
8e1086afcf32225ec3e635d7b1dafa67335b0475

SHA256
5aeeaf68ce6008744d5f47e572eb976086065d644d4b1daef206d0fd74197ae0

SHA512
7a24516b5d6da4e16947552c767b5737fa1f633b9ec21cb54cff24294cc0a10747d236d5f0b648e6fa699a8ddcbdbfc138561b7b2cf2fdca008f2c61a79b3434

Download Submit
/storage/emulated/0/systeminformation.android.app/config19-02-2025.log

Filesize
135B

MD5
8cb2c542cb1991396b07608618957bb2

SHA1
81b9c752b71e776a8011431ddd8c7335d587dfba

SHA256
c914889915f4d52da6c5e41a8aab5de1de4fcd15bde147a5dfb2e88ca8566418

SHA512
d4cbe836fce4075582010775a14f24a6c8f567d1c415c093f0ad7bb5e24e47fc23714cfac5684b65e7ab03bdc75140f9de33a9ed2a52f4bc204588b36d72ebe4

Download Submit
/storage/emulated/0/systeminformation.android.app/config19-02-2025.log

Filesize
85B

MD5
95d4b9906d0965db21dbe4a61f21f05d

SHA1
25bb259c7eb732a84a4225b2cbb04bbf50cd7642

SHA256
8893163870c153b4da69c61497725f473d8c77575f38cedc5e67860ef6331b6d

SHA512
18a5bfaf3aee2b6dd2b2aeae883db0dd5caab095f1d048ed4cd0c4ee1b0274454cec003d6819ff4babd193fd3618cf9879a2f6f35d58f44112a277a7ff30c60a

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads