e11dbb99b9083326fc1f148c161a5ed9f4b3c59f44c976248c43600334308e21

Analysis

max time kernel
139s
max time network
152s
platform
android-9_x86
resource
android-x86-arm-20240910-en
resource tags

arch:armarch:x86image:android-x86-arm-20240910-enlocale:en-usos:android-9-x86system
submitted
11/03/2025, 05:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e11dbb99b9083326fc1f148c161a5ed9f4b3c59f44c976248c43600334308e21.apk
Size

23.2MB
MD5

a6f89aa20a2501f4e3453c7162cc75c8
SHA1

fcaefe71916b726c4588d810aa487cfb002b3c23
SHA256

e11dbb99b9083326fc1f148c161a5ed9f4b3c59f44c976248c43600334308e21
SHA512

60eaa54067c926a13917905077864302150c68ae162e1a60a6535f3b7ee20727249bcb10ad2a3034c47ffcdaa1feb7d84e133aa3778c94ef6b5e6bad844f7dd4
SSDEEP

196608:2n2vBBiqyEEzt0TEMs1sgAXFNgI7a7Yt3Zu9yzhLrZYso0h54Hh5Uh5/tg2/e3+x:EcBBAEEztSExs3FNgIuQ9zhL9TokqA

Score

8^/10

banker collection credential_access defense_evasion discovery evasion execution persistence

Malware Config

Signatures

Checks if the Android device is rooted. 1 TTPs 1 IoCs

defense_evasion

System Information Discovery

T1426

ioc	Process
/sbin/su	com.work676.o1f

Makes use of the framework's Accessibility service 4 TTPs 1 IoCs

Retrieves information displayed on the phone screen using AccessibilityService.

collection defense_evasion credential_access

Input Injection

T1516

Screen Capture

T1513

Keylogging

T1417.001

GUI Input Capture

T1417.002

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	com.work676.o1f

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
banker discovery

Security Software Discovery
T1418.001

Queries information about running processes on the device 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about running processes on the device.

discovery

Process Discovery

T1424

description	ioc	Process
Framework service call	android.app.IActivityManager.getRunningAppProcesses	com.work676.o1f

Queries the phone number (MSISDN for GSM devices) 1 TTPs
discovery

System Network Configuration Discovery
T1422

Reads the contacts stored on the device. 1 TTPs 1 IoCs

collection

Contact List

T1636.003

description	ioc	Process
URI accessed for read	content://com.android.contacts/data/phones	com.work676.o1f

Reads the content of the SMS messages. 1 TTPs 1 IoCs

collection

SMS Messages

T1636.004

description	ioc	Process
URI accessed for read	content://sms/	com.work676.o1f

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
19	raw.githubusercontent.com
21	raw.githubusercontent.com

Makes use of the framework's foreground persistence service 1 TTPs 2 IoCs

Application may abuse the framework's foreground service to continue running in the foreground.

defense_evasion persistence

Foreground Persistence

T1541

description	ioc	Process
Framework service call	android.app.IActivityManager.setServiceForeground	com.work676.o1f
Framework service call	android.app.IActivityManager.setServiceForeground	com.work676.o1f:remote

Performs UI accessibility actions on behalf of the user 1 TTPs 2 IoCs

Application may abuse the accessibility service to prevent their removal.

evasion

Prevent Application Removal

T1629.001

ioc	Process
android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction	com.work676.o1f
android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction	com.work676.o1f

Queries information about active data network 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.work676.o1f

Queries the mobile country code (MCC) 1 TTPs 1 IoCs

discovery

System Network Configuration Discovery

T1422

description	ioc	Process
Framework service call	com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone	com.work676.o1f

Queries the unique device ID (IMEI, MEID, IMSI) 1 TTPs
discovery

System Network Configuration Discovery
T1422

Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs

defense_evasion

User Evasion

T1628.002

description	ioc	Process
Intent action	android.settings.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS	com.work676.o1f

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs

persistence

Broadcast Receivers

T1624.001

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	com.work676.o1f

Schedules tasks to execute at a specified time 1 TTPs 1 IoCs

Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.

execution persistence

Scheduled Task/Job

T1603

description	ioc	Process
Framework service call	android.app.job.IJobScheduler.schedule	com.work676.o1f

Checks CPU information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	com.work676.o1f

Checks memory information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	com.work676.o1f

com.work676.o1f
1⤵
- Checks if the Android device is rooted.
- Makes use of the framework's Accessibility service
- Queries information about running processes on the device
- Reads the contacts stored on the device.
- Reads the content of the SMS messages.
- Makes use of the framework's foreground persistence service
- Performs UI accessibility actions on behalf of the user
- Queries information about active data network
- Queries the mobile country code (MCC)
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Schedules tasks to execute at a specified time
- Checks CPU information
- Checks memory information
PID:4220

com.work676.o1f:remote
1⤵
- Makes use of the framework's foreground persistence service
PID:4448

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

MITRE ATT&CK Mobile v15

Initial Access

Execution

Scheduled Task/Job

T1603

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Foreground Persistence

T1541

Scheduled Task/Job

T1603

Privilege Escalation

Defense Evasion

Foreground Persistence

T1541

Hide Artifacts

T1628

User Evasion

T1628.002

Impair Defenses

T1629

Prevent Application Removal

T1629.001

Input Injection

T1516

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Input Capture

T1417

GUI Input Capture

T1417.002

Keylogging

T1417.001

Discovery

Process Discovery

T1424

Software Discovery

T1418

Security Software Discovery

T1418.001

System Information Discovery

T1426

System Network Configuration Discovery

T1422

System Network Connections Discovery

T1421

Lateral Movement

Collection

Input Capture

T1417

GUI Input Capture

T1417.002

Keylogging

T1417.001

Protected User Data

T1636

Contact List

T1636.003

SMS Messages

T1636.004

Screen Capture

T1513

Command and Control

Exfiltration

Impact

Input Injection

T1516

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.work676.o1f/app_crashrecord/1004

Filesize
222B

MD5
deda9ceb1cc8f33395755a2b1bb9d597

SHA1
fb0064a9c45dc7efbeef7c0c664e8e41b74b6a4d

SHA256
8c08c76dde17a4687f52e743af30bd48085bdc8b293644f62063e65d12a2ee50

SHA512
f23dfe21e9c1c2973219a38e57000b9b3bdc0cfbc61046ced8464c5cd0ad958a0d50cc03a9f98a1e7a5dbf3bdc3942f4c67c0d696c421be9b412b5cbb8e28695

Download Submit
/data/data/com.work676.o1f/app_crashrecord/1004

Filesize
58B

MD5
0d210bfb2a0e1f1b4c082a6a0f79de07

SHA1
bb8ed9e364db79d1d9f2fcde3f15091893222faa

SHA256
988722c23d78a46021d0e7ca9deee7aa8bb83288269174ffacb7316f381cca1d

SHA512
536e9867b0df29b15b789f8949be6ab37fcdeccb9d39ded981da7dc2052c9533d0ec0e6f9a5444132977605d372e1463d91bdde41b528ff2ca3f65ab152325c1

Download Submit
/data/data/com.work676.o1f/cache/wp.jpeg

Filesize
143KB

MD5
5dc1983554a88c2a224ee046bb7314ec

SHA1
5b09273776014bf32fd8aa7bca9ce151d2c7d98f

SHA256
6a4d32e8ef673e70a8a4963124417be10eb09089f3aa049e1e3c7de515c69f21

SHA512
5ce30ef36c25d33f3416006c103608057a9cc88f2d88fe37de3bd895d68a005644d74aca0abd5bef02f2ed17709a38ae249b0dabeaa16d1c46c8a8c9d85c7e88

Download Submit
/data/data/com.work676.o1f/databases/bugly_db_

Filesize
4KB

MD5
f2b4b0190b9f384ca885f0c8c9b14700

SHA1
934ff2646757b5b6e7f20f6a0aa76c7f995d9361

SHA256
0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514

SHA512
ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1

Download Submit
/data/data/com.work676.o1f/databases/bugly_db_-journal

Filesize
512B

MD5
0e24dc06e86cbdae5f8cb990de0112cd

SHA1
164968bb7c9c76a757ccaa4ba2221ac859c2bf7d

SHA256
4683eaad94e2b9773ff91338da81cc338cdea2098f19e9e302bfef620a935d84

SHA512
a297260cf6735e87996a37f6e746e8d50f70718c2861554fcd7f1083fedb70d2f3d668a2ccef4c6d2d345cef777aa9c170a7bbcb8f6c4ad8fce87d2ab7032eb9

Download Submit
/data/data/com.work676.o1f/databases/bugly_db_-shm

Filesize
32KB

MD5
bb7df04e1b0a2570657527a7e108ae23

SHA1
5188431849b4613152fd7bdba6a3ff0a4fd6424b

SHA256
c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479

SHA512
768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

Download Submit
/data/data/com.work676.o1f/databases/bugly_db_-wal

Filesize
88KB

MD5
ea08d70e94c3eb67e9454574393a8e42

SHA1
6432e22d44a211883301123b47465812ab4dce75

SHA256
3b97e82cc4b075121e0acf5f0afea9fa5b8d9059c010fbbfcef9bfbd4cf2bad6

SHA512
94e8ec5435f8b58528a1b3ee80c6c1c7e35861ad16f59c86f4f11bffeed26e5760673d62d67b08ce445765c945db8c9d3c7cdd3a989274126e2a637509b73821

Download Submit
/data/data/com.work676.o1f/files/bugly_last_us_up_tm

Filesize
13B

MD5
036a1021aa9d02d01f2f8a2a081dc85e

SHA1
41ea62b969cf5a1783a270af633abd95e6f9b3c1

SHA256
865659a5f2780a93916fabf2db50ffc6649144062a655fbea5e47574bbe4a09b

SHA512
6a511188d21e08660fd0def72e7d8f0c761f82774fa6456edb8a42b30616ad2c03bb811c5aa9e25bc593cd4a9f4b33752ff49deb3a7ba8ca44c7b57f8a10dd44

Download Submit
/data/data/com.work676.o1f/files/mmkv/mmkv.default

Filesize
4KB

MD5
620f0b67a91f7f74151bc5be745b7110

SHA1
1ceaf73df40e531df3bfb26b4fb7cd95fb7bff1d

SHA256
ad7facb2586fc6e966c004d7d1d16b024f5805ff7cb47c7a85dabd8b48892ca7

SHA512
2d23913d3759ef01704a86b4bee3ac8a29002313ecc98a7424425a78170f219577822fd77e4ae96313547696ad7d5949b58e12d5063ef2ee063b595740a3a12d

Download Submit
/data/data/com.work676.o1f/files/profileInstalled

Filesize
24B

MD5
2f1efd512d0dd10b640424ad20cc5f22

SHA1
2a55e5a7a7d2518a9905241380aa1f728984ea8a

SHA256
200ff1dad9ee0efa403882d8ba5fd9b46f138e161c870e8dffbfb76a70bb77f4

SHA512
7679faf8515a709d3577bc34276fe0c130b8e530cb4fd8aacce7aff27ed355746eaa6cef1e0b48b6cdc0d8426076a72ede8c83a7c65b96119b3fc7d601f6a72a

Download Submit
/data/data/com.work676.o1f/files/profileinstaller_profileWrittenFor_lastUpdateTime.dat

Filesize
8B

MD5
10b7b9abcc7fb4bbcb8cc26cde78748d

SHA1
0a7f1439c884e3fce9c7b7c5585d4bf9e317672e

SHA256
384caff5cfe4222673b5466dca9aebdecf9a722bfaa51b0a94a9e8f5b459e42e

SHA512
8fc3fd1801e888507479d4d60fb8ac7d40b59360ffc3e392b30f317ca73c72c5033e8d75847fef10af2a0b6d8b65ea224f58a106f6258ffcbebb5718b5f91aed

Download Submit
/data/misc/profiles/cur/0/com.work676.o1f/primary.prof

Filesize
1KB

MD5
3bccb1788f69a87f8d25a5532edc07eb

SHA1
f1a87a97878813e9299de5242f86b88c114baa01

SHA256
8f836b2cbfd425cf5542d4f4b468f75c9d82165ab956b59c3d17df4a5c558d69

SHA512
15982d80bf24a93e1a85507b6c04321fd4606969a4e3be38fa40b04ea4c0db42ba3f950f7d3184af2de816663ca1a4cb2bac6a7b01a38e521399674bd46c658b

Download Submit
/data/misc/profiles/cur/0/com.work676.o1f/primary.prof

Filesize
14KB

MD5
d1dbbe2aeca29acb2c8acb275618504f

SHA1
17ae29cdfc25f6b534cb2bdffe2cdd7d5cd99974

SHA256
e272ecfd39aaa0a7ab09607c2d018d330a81e8a2f0523aa3386c1435b9c5ba78

SHA512
ea2065432bc45d27b476439d2e20556bd117f1b82f041799fde52159c9a408b0d8737bc0ef4f359a390396a9603ac1c03ade509dd3279268b15480d9715e7d87

Download Submit
/storage/emulated/0/Android/data/com.work676.o1f/files/log_data.idx

Filesize
1KB

MD5
d65c25d82635a6a7f0d9d583a3fac167

SHA1
289ccc4a1c1927a25387cb6083b277edd9de5495

SHA256
becf3ce3abbda8ef54282335ef8f6571df2eb25edc2d40c18f0e12883fffbdd5

SHA512
f71e09d7c9e18966ff51ce674fe71adcb1ff89504c242dac88f67899820345e247786b02d05fbd60aab21570986b31029e2dbc4a6ff2781fa3346a378a44960d

Download Submit
/storage/emulated/0/Android/data/com.work676.o1f/files/log_data_000

Filesize
27KB

MD5
4cb171716de35cac6cde8aa60b977286

SHA1
047ee4b66c0d724990003c943d70fd963be2b354

SHA256
76fbe470bcfe7f77be3b4afb1a15968df362a00c60a0213a2914ee9ae75fd2c8

SHA512
e6c7f5e6cff6dc03ee99ed929b4f8cd3a06374521adad86311ab162c76990a7f04c90fa4b84b13913d511fe5d3a468b135d844737d499f539c550de161e32b54

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads