ac32dc236fea345d135bf1ff973900482cdfce489054760601170ef7feec458f | Triage

Sharing

General

Target

ac32dc236fea345d135bf1ff973900482cdfce489054760601170ef7feec458f.apk
Size

1.3MB
Sample

250327-bnt3aavzf1
MD5

93ac3627ec63373a239f4a521819dbe9
SHA1

ce1f752ba4f550e8439e24228c6ccb7aad56ef98
SHA256

ac32dc236fea345d135bf1ff973900482cdfce489054760601170ef7feec458f
SHA512

bd483c8bc6efb24c3f54a9c3632c842a2f7b606b7769d23b4fea455ea08be137f2a0e42632bf3d88490ea954c697db5af85b145596ccb3c1fbe5d90c2b0bc95a
SSDEEP

24576:N1Gk/63Nc4TlZoBP+8fQgwbigP9zlJlnP6f7I2h8r3mVZvrRa+2RplR8Qngx:N17/yZZo1Ff8GgP9zTlnP6n8rWnvrRUk

Score

8^/10

android collection credential_access defense_evasion discovery evasion persistence stealth trojan

Malware Config

Targets

- Target
  
  ac32dc236fea345d135bf1ff973900482cdfce489054760601170ef7feec458f.apk
- Size
  
  1.3MB
- MD5
  
  93ac3627ec63373a239f4a521819dbe9
- SHA1
  
  ce1f752ba4f550e8439e24228c6ccb7aad56ef98
- SHA256
  
  ac32dc236fea345d135bf1ff973900482cdfce489054760601170ef7feec458f
- SHA512
  
  bd483c8bc6efb24c3f54a9c3632c842a2f7b606b7769d23b4fea455ea08be137f2a0e42632bf3d88490ea954c697db5af85b145596ccb3c1fbe5d90c2b0bc95a
- SSDEEP
  
  24576:N1Gk/63Nc4TlZoBP+8fQgwbigP9zlJlnP6f7I2h8r3mVZvrRa+2RplR8Qngx:N17/yZZo1Ff8GgP9zTlnP6n8rWnvrRUk
Score

8^/10

discovery evasion persistence stealth trojan collection credential_access defense_evasion
- Removes its main activity from the application launcher
  stealth trojan evasion
- Makes use of the framework's Accessibility service
  Retrieves information displayed on the phone screen using AccessibilityService.
  collection defense_evasion credential_access
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Queries information about active data network
  discovery
- Queries the mobile country code (MCC)
  discovery
- Reads information about phone network operator.
  discovery
- Requests enabling of the accessibility settings.
behavioral1 behavioral2 behavioral3

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Event Triggered Execution

Broadcast Receivers

Privilege Escalation

Defense Evasion

Hide Artifacts

Suppress Application Icon

Input Injection

Credential Access

Input Capture

GUI Input Capture

Keylogging

Discovery

System Network Configuration Discovery

System Network Connections Discovery

Lateral Movement

Collection

Input Capture

GUI Input Capture

Keylogging

Screen Capture

Command and Control

Exfiltration

Impact

Input Injection

Tasks

static1

behavioral1

discoveryevasionpersistencestealthtrojan

behavioral2

collectioncredential_accessdefense_evasiondiscoveryevasionpersistencestealthtrojan

behavioral3

collectioncredential_accessdefense_evasiondiscoveryevasionstealthtrojan