Overview

overview

10

Static

static

10

1cb7ecc4a4...72.apk

android-9-x86

7

1cb7ecc4a4...72.apk

android-10-x64

7

1cb7ecc4a4...72.apk

android-11-x64

7

Sharing

Copy URL
Twitter E-mail

General

  • Target

    1cb7ecc4a4b704338d30b5448de216914f1f890d454cba5700f0373d298dbe72.bin

  • Size

    4.8MB

  • Sample

    250225-13gg6szpw7

  • MD5

    fabf41317034f05724b6c11d80f8ebf8

  • SHA1

    7fd7a77e2494f9add7c2fd56dc96e55fb0b799e6

  • SHA256

    1cb7ecc4a4b704338d30b5448de216914f1f890d454cba5700f0373d298dbe72

  • SHA512

    31ab0316b4d58ec3058b90abe5789bdefc2c58b87f7fa62e789bedf3bfb7cd1ed7bf2e047e4256a271c35a4b5f723bf739c096eef34ac8c684bc07708a0f463a

  • SSDEEP

    98304:vhHA4TLpoN4WNibGNa64CUYeD0fD0iD0qD0eRD0nAED0EiD0bbD0A2K:vpA4LrH6/GYeDeD3DNDvDC1DsDMbDR2K

Score
10/10
copybaraandroidcollectioncredential_accessdefense_evasiondiscoveryevasionimpactpersistence

Malware Config

Targets

    • Target

      1cb7ecc4a4b704338d30b5448de216914f1f890d454cba5700f0373d298dbe72.bin

    • Size

      4.8MB

    • MD5

      fabf41317034f05724b6c11d80f8ebf8

    • SHA1

      7fd7a77e2494f9add7c2fd56dc96e55fb0b799e6

    • SHA256

      1cb7ecc4a4b704338d30b5448de216914f1f890d454cba5700f0373d298dbe72

    • SHA512

      31ab0316b4d58ec3058b90abe5789bdefc2c58b87f7fa62e789bedf3bfb7cd1ed7bf2e047e4256a271c35a4b5f723bf739c096eef34ac8c684bc07708a0f463a

    • SSDEEP

      98304:vhHA4TLpoN4WNibGNa64CUYeD0fD0iD0qD0eRD0nAED0EiD0bbD0A2K:vpA4LrH6/GYeDeD3DNDvDC1DsDMbDR2K

    Score
    7/10
    collectioncredential_accessdefense_evasiondiscoveryevasionimpactpersistence

    • Makes use of the framework's Accessibility service

      Retrieves information displayed on the phone screen using AccessibilityService.

      collectiondefense_evasioncredential_access

    • Obtains sensitive information copied to the device clipboard

      Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.

      collectioncredential_accessimpact

    • Acquires the wake lock

    • Makes use of the framework's foreground persistence service

      Application may abuse the framework's foreground service to continue running in the foreground.

      defense_evasionpersistence

    • Performs UI accessibility actions on behalf of the user

      Application may abuse the accessibility service to prevent their removal.

      evasion

    • Queries the mobile country code (MCC)

      discovery
    behavioral1behavioral2behavioral3

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Event Triggered Execution

1
T1624

Broadcast Receivers

1
T1624.001

Foreground Persistence

1
T1541

Privilege Escalation

Defense Evasion

Foreground Persistence

1
T1541

Impair Defenses

1
T1629

Prevent Application Removal

1
T1629.001

Input Injection

1
T1516

Virtualization/Sandbox Evasion

2
T1633

System Checks

2
T1633.001

Credential Access

Clipboard Data

1
T1414

Input Capture

2
T1417

GUI Input Capture

1
T1417.002

Keylogging

1
T1417.001

Discovery

System Information Discovery

2
T1426

System Network Configuration Discovery

1
T1422

Lateral Movement

Collection

Clipboard Data

1
T1414

Input Capture

2
T1417

GUI Input Capture

1
T1417.002

Keylogging

1
T1417.001

Screen Capture

1
T1513

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

1
T1471

Data Manipulation

1
T1641

Transmitted Data Manipulation

1
T1641.001

Input Injection

1
T1516

Tasks