6228451bafdb12f42daf518d80997124c089eaac2e35b053433e321f33ac78d3 | Triage

Sharing

General

Target

6228451bafdb12f42daf518d80997124c089eaac2e35b053433e321f33ac78d3.bin
Size

4.3MB
Sample

250328-12hzlstpv9
MD5

c44b34a617d6e7a6e03cd1cb1b290d86
SHA1

dcbe4dadd457f24109035e820073556aa81b7a39
SHA256

6228451bafdb12f42daf518d80997124c089eaac2e35b053433e321f33ac78d3
SHA512

cd7ebd21b4dc2a360e61e7476528783b815d5ca2fe298ad9031e59381b1462d9e2681a75226af8f58195be98ec07330add0d4585c0517680f37b525e18bb80b1
SSDEEP

98304:K5vRV3T5bEl0DssSD+3sYpfdcuqWgS6ewUKvHHWkwmJhdNX4skLS08IvN0frHQ:K5vRV3T5bFssSDCsuHq+67UKvH2VmFCp

Score

7^/10

android collection credential_access defense_evasion discovery execution persistence

Malware Config

Targets

- Target
  
  6228451bafdb12f42daf518d80997124c089eaac2e35b053433e321f33ac78d3.bin
- Size
  
  4.3MB
- MD5
  
  c44b34a617d6e7a6e03cd1cb1b290d86
- SHA1
  
  dcbe4dadd457f24109035e820073556aa81b7a39
- SHA256
  
  6228451bafdb12f42daf518d80997124c089eaac2e35b053433e321f33ac78d3
- SHA512
  
  cd7ebd21b4dc2a360e61e7476528783b815d5ca2fe298ad9031e59381b1462d9e2681a75226af8f58195be98ec07330add0d4585c0517680f37b525e18bb80b1
- SSDEEP
  
  98304:K5vRV3T5bEl0DssSD+3sYpfdcuqWgS6ewUKvHHWkwmJhdNX4skLS08IvN0frHQ:K5vRV3T5bFssSDCsuHq+67UKvH2VmFCp
Score

7^/10

defense_evasion discovery execution persistence collection credential_access
- Makes use of the framework's Accessibility service
  Retrieves information displayed on the phone screen using AccessibilityService.
  collection defense_evasion credential_access
- Makes use of the framework's foreground persistence service
  Application may abuse the framework's foreground service to continue running in the foreground.
  defense_evasion persistence
- Queries information about active data network
  discovery
- Requests disabling of battery optimizations (often used to enable hiding in the background).
  defense_evasion
behavioral1 behavioral2 behavioral3

MITRE ATT&CK Mobile v15

Initial Access

Execution

Scheduled Task/Job

Persistence

Event Triggered Execution

Broadcast Receivers

Foreground Persistence

Scheduled Task/Job

Privilege Escalation

Defense Evasion

Foreground Persistence

Hide Artifacts

User Evasion

Input Injection

Credential Access

Input Capture

GUI Input Capture

Keylogging

Discovery

System Network Connections Discovery

Lateral Movement

Collection

Input Capture

GUI Input Capture

Keylogging

Screen Capture

Command and Control

Exfiltration

Impact

Input Injection

Tasks

static1

behavioral1

defense_evasiondiscoveryexecutionpersistence

behavioral2

collectioncredential_accessdefense_evasiondiscoveryexecutionpersistence

behavioral3

defense_evasiondiscoveryexecutionpersistence