bd5290ff42a7f6079b070cb6e13dbfbd95c1fae3b799620fc3b3ae4a6c6368ba

Analysis

max time kernel
16s
max time network
128s
platform
android-10_x64
resource
android-x64-20240910-en
resource tags

arch:x64arch:x86image:android-x64-20240910-enlocale:en-usos:android-10-x64system
submitted
27/03/2025, 04:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c7d855979c61bafc116d1c0bfe6d87a1683bea96eecca3820bf0be954b80a237.apk
Size

1.6MB
MD5

cca20d1e7f3f55f29010317fa987e485
SHA1

a3ba674cc763ee71723c64aba0c642ae21038e4f
SHA256

c7d855979c61bafc116d1c0bfe6d87a1683bea96eecca3820bf0be954b80a237
SHA512

82a8571f3af0f21f6bcb4035e4ff933956972555928b4e241e4f18282bd10e7986eb97f693edcf64d2c8914a414d1ff4cd77b49aaff88ed96faac151e988b235
SSDEEP

24576:fbPk8jfSS5uBxAoPusA58aUhpB4qzWtSgw15od04B7S1zD0gBn0B5JbzfSaLx9:A8fSu+7pB4KkS+d04RSWq0B5J3t

Score

8^/10

banker collection discovery evasion impact stealth trojan

Malware Config

Signatures

Removes its main activity from the application launcher 1 TTPs 1 IoCs

stealth trojan evasion

Suppress Application Icon

T1628.001

pid	Process
5071	yjxq.ysrxjzb.pmnfcfhcqmc

Loads dropped Dex/Jar 1 TTPs 2 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/yjxq.ysrxjzb.pmnfcfhcqmc/app_DynamicOptDex/UblsZT.json	5071	yjxq.ysrxjzb.pmnfcfhcqmc
/data/user/0/yjxq.ysrxjzb.pmnfcfhcqmc/app_DynamicOptDex/UblsZT.json	5071	yjxq.ysrxjzb.pmnfcfhcqmc

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
banker discovery

Security Software Discovery
T1418.001

Queries account information for other applications stored on the device 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect account information stored on the device.

collection

Stored Application Data

T1409

description	ioc	Process
Framework service call	android.accounts.IAccountManager.getAccounts	yjxq.ysrxjzb.pmnfcfhcqmc

Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

impact

Data Encrypted for Impact

T1471

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	yjxq.ysrxjzb.pmnfcfhcqmc

yjxq.ysrxjzb.pmnfcfhcqmc
1⤵
- Removes its main activity from the application launcher
- Loads dropped Dex/Jar
- Queries account information for other applications stored on the device
- Uses Crypto APIs (Might try to encrypt user data)
PID:5071

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Hide Artifacts

T1628

Suppress Application Icon

T1628.001

Credential Access

Discovery

Software Discovery

T1418

Security Software Discovery

T1418.001

Lateral Movement

Collection

Stored Application Data

T1409

Command and Control

Exfiltration

Impact