213e24786c7e7440abb88538c12fa08d91d72669a733ea081b57b1ba6b787775

Analysis

max time kernel
146s
max time network
150s
platform
android-11_x64
resource
android-x64-arm64-20240910-en
resource tags

arch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20240910-enlocale:en-usos:android-11-x64system
submitted
30/03/2025, 10:58

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

client.apk
Size

760KB
MD5

cf99b9b3f6dcb4b02e317cb3f42ab3d1
SHA1

162a0f13e5b80528390dddca4e85424927420a47
SHA256

213e24786c7e7440abb88538c12fa08d91d72669a733ea081b57b1ba6b787775
SHA512

b6328bc9160cacbf827defddcd2f84d547e5a29d5edf66f1f6cb74e6d45f39253b2cb4ce89df0e20cfcaf0421ab8ac510d79002c04a0691812f19117e5a46bf2
SSDEEP

12288:2KRNa1a8Lreg9iIQ85J5WmpYshXZPbGwidNpgRC:2aa1a2egZQ85J5WmD9idNpH

Score

8^/10

banker defense_evasion discovery evasion impact persistence privilege_escalation stealth trojan

Malware Config

Signatures

Removes its main activity from the application launcher 1 TTPs 1 IoCs

stealth trojan evasion

Suppress Application Icon

T1628.001

pid	Process
4786	cmf0.c3b5bm90zq.patch

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
banker discovery

Security Software Discovery
T1418.001

Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

Application may abuse the framework's foreground service to continue running in the foreground.

defense_evasion persistence

Foreground Persistence

T1541

description	ioc	Process
Framework service call	android.app.IActivityManager.setServiceForeground	cmf0.c3b5bm90zq.patch

Tries to add a device administrator. 2 TTPs 1 IoCs

privilege_escalation impact

Device Administrator Permissions

T1626.001

Account Access Removal

T1640

description	ioc	Process
Intent action	android.app.action.ADD_DEVICE_ADMIN	cmf0.c3b5bm90zq.patch

cmf0.c3b5bm90zq.patch
1⤵
- Removes its main activity from the application launcher
- Makes use of the framework's foreground persistence service
- Tries to add a device administrator.
PID:4786

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Foreground Persistence

T1541

Privilege Escalation

Abuse Elevation Control Mechanism

T1626

Device Administrator Permissions

T1626.001

Defense Evasion

Foreground Persistence

T1541

Hide Artifacts

T1628

Suppress Application Icon

T1628.001

Credential Access

Discovery

Software Discovery

T1418

Security Software Discovery

T1418.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Account Access Removal

T1640

Replay Monitor

Loading Replay Monitor...

Downloads

/storage/emulated/0/systeminformation.android.app/config30-03-2025.log

Filesize
39B

MD5
229a2151bd33b81b201e47cdb80c4f20

SHA1
922b970f9e3496c1da06e56913ce93246a175d60

SHA256
2f90289041b03f9f407bd091d019808575736da1169a116b133eacdd94e7fd04

SHA512
8e0540772e732804ec65da1d68ed9333aa4f3e95157b12eaa36dd7fa4d560ee5d376e206bcbacf023f1e08cc93abbfc9141833cbfcfba6db1f20509214980275

Download Submit
/storage/emulated/0/systeminformation.android.app/config30-03-2025.log

Filesize
1KB

MD5
c6f756fcec743ee82a2fda6f3ddc188f

SHA1
cff215065ffaa54cf183bb68a9b5e00a04d1cbc5

SHA256
e346fa38c389b5ecb82d5e42aa4d4a02984cf3ded16598e71c3cdc6739f3cb39

SHA512
117ca52668dc0f37b462e6d4cba7b461413c8abcbc7a01e10ff8a8b8f4941fd4aed1fb4173312ebfe52f0ada07de393838f054556535fc126fe7998e96252823

Download Submit
/storage/emulated/0/systeminformation.android.app/config30-03-2025.log

Filesize
85B

MD5
810040cddbc6d54c7bdbaaec4aa28c33

SHA1
d536e4ef161630ee8c13748c67b0e8b8503f40cd

SHA256
f5610adec17cf0f6bb58dc727bb1b8d9b0ff81742f65a5caa95c3c2e50e56d62

SHA512
06729f0d5a7cbb27a84ad8a98a1c062ef85c5dc23f8aa136b4386241d1cd909b9331214fc355f051dc64d2198945ab0bf52a86fd9d13353ac9958e4cfed0ccf9

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads