29a97e6d45ef1c7b72b475db90f2f9f79e9ceac90bdf24322e9ed7b180175751

Analysis

max time kernel
146s
max time network
151s
platform
android-11_x64
resource
android-x64-arm64-20240910-en
resource tags

arch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20240910-enlocale:en-usos:android-11-x64system
submitted
30/03/2025, 10:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

client.apk
Size

760KB
MD5

49d4ef134bd0f640742023117e5c2e21
SHA1

5dcd927edaae792444bf01adc27e9cb744edb824
SHA256

29a97e6d45ef1c7b72b475db90f2f9f79e9ceac90bdf24322e9ed7b180175751
SHA512

327204a037726c2e98927b936d90289a3b00d2c72f8f1566e5b19d75281e77b1730e7aeb4b9ab87e39a28b9c3f8ec103d82488c2dafd637efc1a6e8711636592
SSDEEP

12288:ky1Ob1a1a8LreXKnvrDM/5WmpYshXZPbGwidNpgB9:kyGa1a2eXqrDM/5WmD9idNpA

Score

8^/10

banker defense_evasion discovery evasion impact persistence privilege_escalation stealth trojan

Malware Config

Signatures

Removes its main activity from the application launcher 1 TTPs 1 IoCs

stealth trojan evasion

Suppress Application Icon

T1628.001

pid	Process
4637	cmf0.c3b5bm90zq.patch

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
banker discovery

Security Software Discovery
T1418.001

Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

Application may abuse the framework's foreground service to continue running in the foreground.

defense_evasion persistence

Foreground Persistence

T1541

description	ioc	Process
Framework service call	android.app.IActivityManager.setServiceForeground	cmf0.c3b5bm90zq.patch

Tries to add a device administrator. 2 TTPs 1 IoCs

privilege_escalation impact

Device Administrator Permissions

T1626.001

Account Access Removal

T1640

description	ioc	Process
Intent action	android.app.action.ADD_DEVICE_ADMIN	cmf0.c3b5bm90zq.patch

cmf0.c3b5bm90zq.patch
1⤵
- Removes its main activity from the application launcher
- Makes use of the framework's foreground persistence service
- Tries to add a device administrator.
PID:4637

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Foreground Persistence

T1541

Privilege Escalation

Abuse Elevation Control Mechanism

T1626

Device Administrator Permissions

T1626.001

Defense Evasion

Foreground Persistence

T1541

Hide Artifacts

T1628

Suppress Application Icon

T1628.001

Credential Access

Discovery

Software Discovery

T1418

Security Software Discovery

T1418.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Account Access Removal

T1640

Replay Monitor

Loading Replay Monitor...

Downloads

/storage/emulated/0/systeminformation.android.app/config30-03-2025.log

Filesize
39B

MD5
68f619d4c1e84836249ad0b06be0685e

SHA1
9f35cdcc4df95388d8a5b4f4eea3de39755953f4

SHA256
8bef18e23cfac4c412834e95a3570a065af703fd3d695a603146e5caaeec78e4

SHA512
81ff8b44802760ae2a55382b0138e48172508b1668397d0449e4f1d45fa3d5d34101d396dcdb5bb1ca9966881e5364307b25d02a72c1b99d8fdab08b25452fb3

Download Submit
/storage/emulated/0/systeminformation.android.app/config30-03-2025.log

Filesize
1KB

MD5
526d0904c98cfc9935dbe4f03941e3fa

SHA1
c3b998a55d23919db8ab77566370121d72b60475

SHA256
fa283d2708fc706833616706ded828158b90e52916c30e89fc2efd0c6c0cbdf0

SHA512
b1e802ee7978f701cbf81c4d78a0c2a0868a78d29ffba3f34016d3e147f3825d4aec7cfedccf5af2692c3c9c61432c3e1fd5e1e75b86ae81e8654d4231356e2e

Download Submit
/storage/emulated/0/systeminformation.android.app/config30-03-2025.log

Filesize
85B

MD5
0d8d7fe73b423d0bd713838cd283d6a8

SHA1
904eed0e9b215dd80bf73645f80bbb27ae280711

SHA256
a79313ebf290b74ad5956d181bfe61c7ff52face615ed4ee8c991f7baed73596

SHA512
c7c810eb60947b99db4c409beaa744872a442d5de8de7f69de9bc75f093642b1e130eb047303b48d9cd283dc6d8f310106c017929c9291fbf8ebb86934d6d290

Download Submit
/storage/emulated/0/systeminformation.android.app/config30-03-2025.log

Filesize
68B

MD5
1cbcd8c3d48fc93d7458cfea2bc71eaf

SHA1
27dc690d121594ec707877c30faba2e1fdbe074d

SHA256
50f9a90931ceb4666842e0da346fa1c92355e619fbf54577b36d1495fac53626

SHA512
480c740daf36e54724ef870af0e484b48b14b1b4298c53497839e6efc6555f29c77ef59a82f7f126dc7b8c83f653294542b6a02aea327f859da6b7dcdbde86ec

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads