a258f01892cdfc3a3a3f5ee19a83d948084e8c666ab75b782f35b7ff9522fcfa

Analysis

max time kernel
12s
max time network
157s
platform
android-13_x64
resource
android-33-x64-arm64-20240910-en
resource tags

arch:arm64arch:x64arch:x86image:android-33-x64-arm64-20240910-enlocale:en-usos:android-13-x64system
submitted
28/03/2025, 22:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a258f01892cdfc3a3a3f5ee19a83d948084e8c666ab75b782f35b7ff9522fcfa.apk
Size

3.2MB
MD5

93b3815cb420f995ac39e32cfcf47fb3
SHA1

5c165298c7632efd05001d2884c318eab3a6ce45
SHA256

a258f01892cdfc3a3a3f5ee19a83d948084e8c666ab75b782f35b7ff9522fcfa
SHA512

db8c89a2b67842607fd6c17fe03f17dea037ee9d6a597a50f1f7afacf7b87e2b40c69d831d3d2b7debd46224edd4837c122a388192cda493f9f71ed8177f7442
SSDEEP

98304:SlfglCN+XvF4yXRotS/LJaoSrwMlz7BI2C4mbgjFfytH:SlfglCNk4yBnJbSvW

Score

7^/10

collection credential_access defense_evasion evasion impact

Malware Config

Signatures

Loads dropped Dex/Jar 1 TTPs 1 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/com.drama.bronze/app_DynamicOptDex/aeEDS.json	4519	com.drama.bronze

Makes use of the framework's Accessibility service 4 TTPs 3 IoCs

Retrieves information displayed on the phone screen using AccessibilityService.

collection defense_evasion credential_access

Input Injection

T1516

Screen Capture

T1513

Keylogging

T1417.001

GUI Input Capture

T1417.002

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	com.drama.bronze
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByText	com.drama.bronze
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId	com.drama.bronze

Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs

Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.

collection credential_access impact

Clipboard Data

T1414

Transmitted Data Manipulation

T1641.001

description	ioc	Process
Framework service call	android.content.IClipboard.addPrimaryClipChangedListener	com.drama.bronze

Performs UI accessibility actions on behalf of the user 1 TTPs 4 IoCs

Application may abuse the accessibility service to prevent their removal.

evasion

Prevent Application Removal

T1629.001

ioc	Process
android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction	com.drama.bronze
android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction	com.drama.bronze
android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction	com.drama.bronze
android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction	com.drama.bronze

Checks CPU information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	com.drama.bronze

Checks memory information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	com.drama.bronze

com.drama.bronze
1⤵
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Obtains sensitive information copied to the device clipboard
- Performs UI accessibility actions on behalf of the user
- Checks CPU information
- Checks memory information
PID:4519

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Impair Defenses

T1629

Prevent Application Removal

T1629.001

Input Injection

T1516

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Clipboard Data

T1414

Input Capture

T1417

GUI Input Capture

T1417.002

Keylogging

T1417.001

Discovery

System Information Discovery

T1426

Lateral Movement

Collection

Clipboard Data

T1414

Input Capture

T1417

GUI Input Capture

T1417.002

Keylogging

T1417.001

Screen Capture

T1513

Command and Control

Exfiltration

Impact

Data Manipulation

T1641

Transmitted Data Manipulation

T1641.001

Input Injection

T1516

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.drama.bronze/app_DynamicOptDex/aeEDS.json

Filesize
320KB

MD5
1b3954af42bab3cfefa48082192805d1

SHA1
b6439fa19390e65fbd2efc183957ffa6b028e333

SHA256
cd945ca83b26fe9a04684788000008a465cbdf777000231500064c6dd1427b91

SHA512
b081d52c13348a786113fd88f11f1f1edd93626f59b07b49d6055c9c14f33dab20b3ba82131b00f207628960b2c69263f5852d9754c5d36641bfe910037b53e8

Download Submit
/data/data/com.drama.bronze/app_DynamicOptDex/aeEDS.json

Filesize
320KB

MD5
32d5c5af123316b8f01f5ce0ae75cdc5

SHA1
184b1dfcc0f3042be614d744c2f6c54a8f9ea913

SHA256
c5edf90aa49d992e2c16e1118da0e046bf3b4ac409947ed7b87304c147610f78

SHA512
8e3cc61ae84c4f294d66fa22413383b05b3fbe2e91157bf3626fe98237e7f0beb249ae2432107246013434e3a57d74ef1cfe602030e0bab1bb2c8e9c8ffca4da

Download Submit
/data/data/com.drama.bronze/app_DynamicOptDex/oat/x86_64/aeEDS.vdex

Filesize
2KB

MD5
c5d6ad42a5525ec7f158d2a99b620bd9

SHA1
7ee9797ba4ee29f70e291c00c3ddec05aaabdc50

SHA256
e12fe220c6389371cd638b5606f2472b9168bd8c2009479484ccbaafd0c66085

SHA512
c2dd31a2302c203bfe6459f3a8a2e064da3e3fb28ee037074085df76fbeeaee3d873aa72ab1924ff120988862ec8ea7dcddef786af7323671ab694b72e3549eb

Download Submit
/data/user/0/com.drama.bronze/app_DynamicOptDex/aeEDS.json

Filesize
635KB

MD5
94b44042d1e0507fc6dafeae54163754

SHA1
fbb9dd5c625292be95257c7cdee9d24a33189cdd

SHA256
67cb08d942783e6a45e4f089be6aa4ea7704a41186c3d70287382010c55d7998

SHA512
27d5dbcd3835d0b60f432635528f7b2680ea6ffd089f0c44626bc9c38de122b69e1d5c96af085129ddddbb7d228471c1ec496a7ff5eb4652689bd6390469e92c

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads