6e0a8ba6bff84f0c3e544f2374da72d53c5c52057100b0b120c39743ca5d22d8

Analysis

max time kernel
126s
max time network
150s
platform
android-13_x64
resource
android-33-x64-arm64-20240910-en
resource tags

arch:arm64arch:x64arch:x86image:android-33-x64-arm64-20240910-enlocale:en-usos:android-13-x64system
submitted
30/03/2025, 11:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

base.apk
Size

15.1MB
MD5

b1c7c797891873f82992d328a32d0953
SHA1

396171fe6da60d4e9fd6944a90f51992eb97067d
SHA256

0dbf16e9260a8ff029075503c719734f61b47b21b54e230b9f41fb6b0bc234bf
SHA512

95f553393ba02bbe4d6c304113aa807e14535ea893d12b92511c4636cb48e01bfd9498af3eff980319fd3826e63ed62eafa04eb6b1c5e4283ab2f386b57d83d6
SSDEEP

393216:jxZ+M1HtgNrQBMIvabjC38MJAjrz75kWx:OyHtmUM6gjC3bW775kW

Score

7^/10

banker defense_evasion discovery impact persistence

Malware Config

Signatures

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
banker discovery

Security Software Discovery
T1418.001
Queries the phone number (MSISDN for GSM devices) 1 TTPs
discovery

System Network Configuration Discovery
T1422

Acquires the wake lock 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.abc.pmkisanyojna6december2024

Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

Application may abuse the framework's foreground service to continue running in the foreground.

defense_evasion persistence

Foreground Persistence

T1541

description	ioc	Process
Framework service call	android.app.IActivityManager.setServiceForeground	com.abc.pmkisanyojna6december2024

Queries information about active data network 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.abc.pmkisanyojna6december2024

Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

impact

Data Encrypted for Impact

T1471

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	com.abc.pmkisanyojna6december2024

com.abc.pmkisanyojna6december2024
1⤵
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Queries information about active data network
- Uses Crypto APIs (Might try to encrypt user data)
PID:4498

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Foreground Persistence

T1541

Privilege Escalation

Defense Evasion

Foreground Persistence

T1541

Credential Access

Discovery

Software Discovery

T1418

Security Software Discovery

T1418.001

System Network Configuration Discovery

T1422

System Network Connections Discovery

T1421

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

T1471

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.abc.pmkisanyojna6december2024/files/PersistedInstallation3681733399483252539tmp

Filesize
90B

MD5
853398912c80f5ad18ae3d0b5274ca5c

SHA1
610c965c4938ab6794da5f780f43b2a52b3007a0

SHA256
770050a1ef691d84346de69db72369599d4d9d5186618891673386a8539f8586

SHA512
42c8f246e23799a059128a5b696dc0e8d02f99db35affa7514bb405e4309b0b8daaf86be37ae5d4480a53d5caeb7b3c0d86e5e2036ef88ede709c786d86d0213

Download Submit
/data/data/com.abc.pmkisanyojna6december2024/files/PersistedInstallation4281564418183644379tmp

Filesize
569B

MD5
9597d97698cf8e4e71ede5a8e38b917c

SHA1
008d5ebbeada1674482863104e8d1482ca051183

SHA256
b535b121437b5c9f6b175fcabb9c91fc81c5920b9adb30229e028d5edc8386b2

SHA512
6c7a13f1c852da9da7cde7a2ecd0c549310511a4fed0bc9bb6ff20680db3ac988757811ac41ecd1ca5c7bbf619ac7a92780a9718c2da14a6f35b97a871c98432

Download Submit
/data/data/com.abc.pmkisanyojna6december2024/files/profileInstalled

Filesize
24B

MD5
8dc6308c7bdbb36737c184d7660f85d0

SHA1
21985b0b1bc620633094783a3e98e017e5bd454a

SHA256
96410450e7d0fc162365c6ffb09b3065bb86dcce8ba452605c4084034e3b63df

SHA512
41ef8a7c207efbbfaf455ad0c0ca5c99c1e5d5d11f827a1e48af7a3f67f868ad835675920e4d97c6debecb5fc3f7edad98b0d8ee29cbab8d050ec3596ec06171

Download Submit
/data/data/com.abc.pmkisanyojna6december2024/ۦۖ۫/ۦۖ۫/ۦۖ۫/ۦۖ۫/ۦۖ۫/ۦۖ۫/ۦۖ۫/ۦۖ۫/ۦۖ۫/ۦۖ۫

Filesize
4.5MB

MD5
77f4f724a07a656ddded49f01c2089ef

SHA1
35169e245cc050a7e7a205f6e6a8afd571d98113

SHA256
4ca1861d3ec4742ce4a971f3dc396acf4dfaf8b5ba2ccec8deed0151deb2ed6a

SHA512
fdf419f70c41f8ef73f27189eae1a217b618958e68c37e7b95785ef2cfbd40fb1fd6668ecc7528b1177ce74ac8fcf279c978c52aba723e23eeb8d7f66b5dbd01

Download Submit
/data/data/com.abc.pmkisanyojna6december2024/ۦۖ۫/ۦۖ۫/ۦۖ۫/ۦۖ۫/ۦۖ۫/ۦۖ۫/ۦۖ۫/ۦۖ۫/ۦۖ۫/ۦۖ۫.

Filesize
8B

MD5
8a12f8a4ad6ee575ad2fc366833308c1

SHA1
8e33195a473f613dc4263f38a3ab8123e0443c5f

SHA256
25c4f53aa912a6378b7d0a7b8734472893bf9228ab6a148c217a61c6d9cb787d

SHA512
e59b591713dc3ce15306fbaa1a28c8ead7baa824f9b2378ae231d8e8277ce87a907e4608bc02a6c303e37ea09c54e64becadb7627eb70d4f0db1beef5f75ae3b

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads