2f0583084fab1983ddbf1c64c17b7c7395c371f35d55e917514aedfa38e7ecd9

General

Target
6aefc2c4727ce80f03867f356df462f1a1ce21c72801b877fdb95e67cd00d6a4.apk
Size 4.1MB
Sample250325-tcatdask12
SHA256 6aefc2c4727ce80f03867f356df462f1a1ce21c72801b877fdb95e67cd00d6a4
MD5 1627584b683df2fe5c57dd5fa3ab79a8
SHA1 3e3522e4fad643a1af704e73ab10ba9a39c0fcce
SHA512 3e6283f9e31ca2b524c47234e6bce20c9d63615cdbb5f6e9ec7c4de2c42517778b316cb445c9d8b61a21a74291ff47f6c59d2acf92b70453f1a7315fd6be926b
SSDEEP 98304:D477F/tOa0zF9t0L+ZwufWzyGyeezfrrUdT:s77FlcfWL4WuleFT
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

banker collection credential_access defense_evasion discovery evasion impact persistence stealth trojan

Malware Config

Signatures

Removes its main activity from the application launcher 1 TTPs 1 IoCs

stealth trojan evasion

Suppress Application Icon

T1628.001

pid	Process
5052	com.guksydvbflaqtwqg2cfuvjwxai7b.ggxfimuhpqlyzg8d2evysfqo

Makes use of the framework's Accessibility service 4 TTPs 3 IoCs

Retrieves information displayed on the phone screen using AccessibilityService.

collection defense_evasion credential_access

Input Injection

T1516

Screen Capture

T1513

Keylogging

T1417.001

GUI Input Capture

T1417.002

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	com.guksydvbflaqtwqg2cfuvjwxai7b.ggxfimuhpqlyzg8d2evysfqo:BackgroundService
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId	com.guksydvbflaqtwqg2cfuvjwxai7b.ggxfimuhpqlyzg8d2evysfqo:BackgroundService
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByText	com.guksydvbflaqtwqg2cfuvjwxai7b.ggxfimuhpqlyzg8d2evysfqo:BackgroundService

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
banker discovery

Security Software Discovery
T1418.001

Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

Application may abuse the framework's foreground service to continue running in the foreground.

defense_evasion persistence

Foreground Persistence

T1541

description	ioc	Process
Framework service call	android.app.IActivityManager.setServiceForeground	com.guksydvbflaqtwqg2cfuvjwxai7b.ggxfimuhpqlyzg8d2evysfqo:BackgroundService

Performs UI accessibility actions on behalf of the user 1 TTPs 1 IoCs

Application may abuse the accessibility service to prevent their removal.

evasion

Prevent Application Removal

T1629.001

ioc	Process
android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction	com.guksydvbflaqtwqg2cfuvjwxai7b.ggxfimuhpqlyzg8d2evysfqo:BackgroundService

Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

impact

Data Encrypted for Impact

T1471

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	com.guksydvbflaqtwqg2cfuvjwxai7b.ggxfimuhpqlyzg8d2evysfqo:BackgroundService

com.guksydvbflaqtwqg2cfuvjwxai7b.ggxfimuhpqlyzg8d2evysfqo
1⤵
- Removes its main activity from the application launcher
PID:5052

com.guksydvbflaqtwqg2cfuvjwxai7b.ggxfimuhpqlyzg8d2evysfqo:BackgroundService
1⤵
- Makes use of the framework's Accessibility service
- Makes use of the framework's foreground persistence service
- Performs UI accessibility actions on behalf of the user
- Uses Crypto APIs (Might try to encrypt user data)
PID:5088

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Foreground Persistence

1

T1541

Privilege Escalation

Defense Evasion

Foreground Persistence

1

T1541

Hide Artifacts

1

T1628

Suppress Application Icon

1

T1628.001

Impair Defenses

1

T1629

Prevent Application Removal

Input Injection

Credential Access

Input Capture

2

T1417

GUI Input Capture

1

T1417.002

Keylogging

1

T1417.001

Discovery

Software Discovery

1

T1418

Security Software Discovery

1

T1418.001

Lateral Movement

Collection

Input Capture

2

T1417

GUI Input Capture

1

T1417.002

Keylogging

Screen Capture

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

Input Injection

Replay Monitor

Loading Replay Monitor...

Downloads

database.db

Path /data/data/com.guksydvbflaqtwqg2cfuvjwxai7b.ggxfimuhpqlyzg8d2evysfqo/databases/database.db
Size 28KB
SHA256 9be97d0f0fa6a946f3268a1ccedd85be2da90e44dcc223f2da6694120960d573
MD5 f0738f4d13bcff4233bf23a0868449f8
SHA1 a89ae8060d15e06928d5c9b37fa7d928897f001a
SHA512 8a176cad017339b7e1f1194c138045660e75e580db61f8fcdd65dec3e2737b40e0638db72bcb1492d57edda99b24c539f5307427e724662a59cc1d99e3160ce1
SSDEEP 24:TLwA2nFYDKEGSi0uy3TIThDohNE5pqNTpclvPrpCCnuBJvzSsVY8MU+TbDy9H5p7:TcAqFY2TSbJTIlDYi5VVCZDb+nDyV5f
MD5 SHA1 SHA512 SSDEEP

Submit Download

database.db-journal

Path /data/data/com.guksydvbflaqtwqg2cfuvjwxai7b.ggxfimuhpqlyzg8d2evysfqo/databases/database.db-journal
Size 512B
SHA256 95e2b2a2b62ab230585cba9c8fecfe695a85d98e26e2d67591883701b302366c
MD5 4127a3d9bf4129b394b2083be70db86d
SHA1 87324f60df075293358b7f2a382fb430edddaf16
SHA512 a898c969fd3f9913fea8ee3a4d5a98905a775cbaa9ca2012662937a4b4c23444c0e36c93b00b8a3334d54c56b4cdb2a6f63873af9d633e5f2a4b64b20067e237
MD5 SHA1 SHA512

Submit Download

database.db-journal

Path /data/data/com.guksydvbflaqtwqg2cfuvjwxai7b.ggxfimuhpqlyzg8d2evysfqo/databases/database.db-journal
Size 8KB
SHA256 b32724bbc8e3816ddd19bd78fe214a15edae7812ca798c61d8be5f6a17985479
MD5 ccbd192f179da43215d61fca0535615f
SHA1 7cf8809e1651ac96c2f75d936eaf5e64b15f021a
SHA512 62a276e294b7040c91dcec7b9410a42c23bc96bbdd3e5f553dfa407844170045613efdf27c7a0548ddde657b97f8491b79ae677992260987b844a41e9b01d39f
SSDEEP 6:7+/l92Sn1ug9bNFlEuWdOlOERX4PBX4ogLugMBX4suuKP:7+t8lqLiuWdwRmBEyPb4
MD5 SHA1 SHA512 SSDEEP

Submit Download

database.db-journal

Path /data/data/com.guksydvbflaqtwqg2cfuvjwxai7b.ggxfimuhpqlyzg8d2evysfqo/databases/database.db-journal
Size 8KB
SHA256 790132987d89d3ef3f56411deda7a5541d9019547329e25a97b4aa069bb355bc
MD5 a9a2e41558244df99846c8080ce37d4d
SHA1 c14137b2539c8854cd616c82b1c4d9673ce33849
SHA512 40603d7569f7505459b60422aa2a450694c2127283e4a666692d578c1cd3483ceb1686bf58246d4e82900afb934fd5dd1f4fea4c8e73ce06294b487ce0e7f8fb
SSDEEP 6:7+/l9XV/gPg9bNFlLdrlOERX4PBX4ogLugMBX4suuKulM/v:7+tpd4qLJdTRmBEyPbrsv
MD5 SHA1 SHA512 SSDEEP

Submit Download

database.db-journal

Path /data/data/com.guksydvbflaqtwqg2cfuvjwxai7b.ggxfimuhpqlyzg8d2evysfqo/databases/database.db-journal
Size 12KB
SHA256 6d10b6d5b6b3c119116c2f07ba2931e8901a2cb1c4b59ac9434cd931eed1eb29
MD5 b03963c4f52cdd208072fd7c4499c8c4
SHA1 bf6e7c667f195fcc82ebdeb183db281e6fdd5a20
SHA512 add4a444c9d713d55f4e9ba599e5b11b3118eaf5dc239807c74591c8d3d187f5e9ecc283d08d9f6ab74a4e250ceb090a6b0cdaa2fea207d92c3a81a41b66d07e
SSDEEP 12:7+tLeNqLZe2+gqJ/5BFvjj1CDKvRmBEyPb4:7+tLeNqLH2nFYDKEGS4
MD5 SHA1 SHA512 SSDEEP

Submit Download

database.db-journal

Path /data/data/com.guksydvbflaqtwqg2cfuvjwxai7b.ggxfimuhpqlyzg8d2evysfqo/databases/database.db-journal
Size 12KB
SHA256 ea5ea4f3d5ab8e1fc1dc03ee5da1e93a2f093128bcee078dc2edc54e6da168bd
MD5 22a6d939e43c27eac890761e66e17536
SHA1 08ad3ea7708b550f1f06e5ca67a4f6fe518ff88e
SHA512 261f0b78d7d3bf581d85947434dd967e64e8d29d06a7c4a362925ca972dd478c7b610424f0427bdb978183c85b01df2eed536f510974d3be1481807e23f91e0a
SSDEEP 12:7+tLCewCHTou8MOKqLEVEU2+gqJ/5BFvjj1CDKvRmBEyPbin:7+tLCe5HTou5NqLEWD2nFYDKEGSi
MD5 SHA1 SHA512 SSDEEP

Submit Download

database.db-journal

Path /data/data/com.guksydvbflaqtwqg2cfuvjwxai7b.ggxfimuhpqlyzg8d2evysfqo/databases/database.db-journal
Size 12KB
SHA256 33c9dd2b422adb1d07fbf28c00f0dd8d244a15c73bb7a1ff9dd4d9cbd7af3f15
MD5 b82700667f1eb3dfdfde286ee3482a7c
SHA1 016b2fefef2f27b1dfc6b0d8569f8762b42d3382
SHA512 32a2e549d9ab6e45e152263095d711d382bb4fa05704842721324cd1961ed3aa9c952fbb2f8882040bb54c81723494b625f6493de3875d4af1fc64de1dfef5da
SSDEEP 48:7MBJTIlDYi5VVC5D+nDyV5fsqjqFY2TSAn:75lUivVsanGVqjcA
MD5 SHA1 SHA512 SSDEEP

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads