Overview

overview

10

Static

static

10

51173cdd9c...13.apk

android-9-x86

1

51173cdd9c...13.apk

android-10-x64

7

51173cdd9c...13.apk

android-11-x64

Sharing

Copy URL
Twitter E-mail

General

  • Target

    51173cdd9ce8880c985a8104a9ed64fa15b5c7ab70ea709af083bc92d575f913.bin

  • Size

    4.9MB

  • Sample

    250225-129sbszpv6

  • MD5

    cd92e893e4fc5aee975daed0fd8e7b7a

  • SHA1

    ef1c4ca3871e8ca457fec02b5d43be3d370f0d33

  • SHA256

    51173cdd9ce8880c985a8104a9ed64fa15b5c7ab70ea709af083bc92d575f913

  • SHA512

    bb16e86f2b27492296681cdef7ea32f306475c6dd20425a7d1cda90c188b274d57067a4da939dabd8706847196194531899eeea9d7453b422aa7bfa055dddc02

  • SSDEEP

    98304:cyYQc8ij4VDOS6VyZkxFwD0TD0yD0OD0eRD0nAUD0EiD07bD04uV:cV5PjvSlcwDeDrDZDPDCBD8DYbDBuV

Score
10/10
copybaraandroidcollectioncredential_accessdefense_evasiondiscoveryevasionimpactpersistence

Malware Config

Targets

    • Target

      51173cdd9ce8880c985a8104a9ed64fa15b5c7ab70ea709af083bc92d575f913.bin

    • Size

      4.9MB

    • MD5

      cd92e893e4fc5aee975daed0fd8e7b7a

    • SHA1

      ef1c4ca3871e8ca457fec02b5d43be3d370f0d33

    • SHA256

      51173cdd9ce8880c985a8104a9ed64fa15b5c7ab70ea709af083bc92d575f913

    • SHA512

      bb16e86f2b27492296681cdef7ea32f306475c6dd20425a7d1cda90c188b274d57067a4da939dabd8706847196194531899eeea9d7453b422aa7bfa055dddc02

    • SSDEEP

      98304:cyYQc8ij4VDOS6VyZkxFwD0TD0yD0OD0eRD0nAUD0EiD07bD04uV:cV5PjvSlcwDeDrDZDPDCBD8DYbDBuV

    Score
    7/10
    collectioncredential_accessdefense_evasiondiscoveryevasionimpactpersistence

    • Makes use of the framework's Accessibility service

      Retrieves information displayed on the phone screen using AccessibilityService.

      collectiondefense_evasioncredential_access

    • Obtains sensitive information copied to the device clipboard

      Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.

      collectioncredential_accessimpact

    • Acquires the wake lock

    • Makes use of the framework's foreground persistence service

      Application may abuse the framework's foreground service to continue running in the foreground.

      defense_evasionpersistence

    • Performs UI accessibility actions on behalf of the user

      Application may abuse the accessibility service to prevent their removal.

      evasion

    • Queries the mobile country code (MCC)

      discovery
    behavioral1behavioral2behavioral3

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Event Triggered Execution

1
T1624

Broadcast Receivers

1
T1624.001

Foreground Persistence

1
T1541

Privilege Escalation

Defense Evasion

Foreground Persistence

1
T1541

Impair Defenses

1
T1629

Prevent Application Removal

1
T1629.001

Input Injection

1
T1516

Virtualization/Sandbox Evasion

2
T1633

System Checks

2
T1633.001

Credential Access

Clipboard Data

1
T1414

Input Capture

2
T1417

GUI Input Capture

1
T1417.002

Keylogging

1
T1417.001

Discovery

System Information Discovery

2
T1426

System Network Configuration Discovery

1
T1422

Lateral Movement

Collection

Clipboard Data

1
T1414

Input Capture

2
T1417

GUI Input Capture

1
T1417.002

Keylogging

1
T1417.001

Screen Capture

1
T1513

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

1
T1471

Data Manipulation

1
T1641

Transmitted Data Manipulation

1
T1641.001

Input Injection

1
T1516

Tasks