Analysis
-
max time kernel
48s -
max time network
151s -
platform
android-10_x64 -
resource
android-x64-20240910-en -
resource tags
-
submitted
25/02/2025, 22:10
General
-
Target
1cb7ecc4a4b704338d30b5448de216914f1f890d454cba5700f0373d298dbe72.apk
-
Size
4.8MB
-
MD5
fabf41317034f05724b6c11d80f8ebf8
-
SHA1
7fd7a77e2494f9add7c2fd56dc96e55fb0b799e6
-
SHA256
1cb7ecc4a4b704338d30b5448de216914f1f890d454cba5700f0373d298dbe72
-
SHA512
31ab0316b4d58ec3058b90abe5789bdefc2c58b87f7fa62e789bedf3bfb7cd1ed7bf2e047e4256a271c35a4b5f723bf739c096eef34ac8c684bc07708a0f463a
-
SSDEEP
98304:vhHA4TLpoN4WNibGNa64CUYeD0fD0iD0qD0eRD0nAED0EiD0bbD0A2K:vpA4LrH6/GYeDeD3DNDvDC1DsDMbDR2K
Malware Config
Signatures
-
Makes use of the framework's Accessibility service 4 TTPs 2 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs
Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
-
Acquires the wake lock 1 IoCs
-
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
-
Performs UI accessibility actions on behalf of the user 1 TTPs 7 IoCs
Application may abuse the accessibility service to prevent their removal.
-
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
-
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
-
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
-
Checks CPU information 2 TTPs 1 IoCs
-
Checks memory information 2 TTPs 1 IoCs
Processes
-
com.intesatoken.appnuova1⤵
- Makes use of the framework's Accessibility service
- Obtains sensitive information copied to the device clipboard
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Performs UI accessibility actions on behalf of the user
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Uses Crypto APIs (Might try to encrypt user data)
- Checks CPU information
- Checks memory information
Network
MITRE ATT&CK Mobile v15
Persistence
Event Triggered Execution
1Broadcast Receivers
1Foreground Persistence
1Defense Evasion
Foreground Persistence
1Impair Defenses
1Prevent Application Removal
1Input Injection
1Virtualization/Sandbox Evasion
2System Checks
2Credential Access
Clipboard Data
1Input Capture
2GUI Input Capture
1Keylogging
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
40KB
MD5c9ba8af2c46cfab6a421f96b0c7a4aba
SHA17cf335d13973adb71de16c9683c65326e04d0107
SHA256c4ddb071f51d8ccf2ae17406c75498de55d820371a8b28c77197a127d131863c
SHA5120fb0dc739a67f5dca3872f616adbbf361a82075411e17a3d6be06d7d52126b284f2119524d9ea47c251d77752b4802727d1499f015977616dc8ddcdd40309afd
-
Filesize
121KB
MD57b38720a0352dffa26411726c72dd2b0
SHA1b15e687f42abcdc12427f146a3115ef2259211f8
SHA2562013f490d45638cada331b3474ed65b9a43cec60da773accc98332e58c06336d
SHA5120df28f87da4f9beb3ca8c108f54021a2a1a1434771abbb5ba67a2736097f2287b05e5220a33e92c42ee13ecae1144714a422b986763712794f69e65bc44c83e3
-
Filesize
11B
MD51b65c10c6215685f9d621d797f911373
SHA1cc50aaed5cd521a62ec8cf9fe0413153ec90f265
SHA2562230c2b2787663a054c47450ecd1718f0296853ad768b8e5d306ecb912685e89
SHA5125a9139f295dbe384b1584eff5c11f3f86759232f7b661b75f27fe92b996b4cdc0552e315f79b26f5f2c1f91756d9ae04cf0c3675b6172e91a3d373b9b314496f
